Scribd’s breach notice itemizes emails, card last four digits, issuer, expiry and payment history, but no passwords. Here is what that gap means for users.
Meta paused Muse AI chat sharing after researchers found 6,800+ discoverable links leaking internal documents, a marketing company’s revenue review marked for its CEO, and loan files via passive DNS.
A real Google alert can carry an attacker-supplied message. Here is how recovery addresses and app-password labels turn Google’s own notifications into phishing lures.
CISA added CVE-2026-41709 to KEV after CrowdStrike tied the ESX logging bypass to WARP PANDA zero-day use. What the 2.7 flaw does, what it does not, and how to patch.
A malicious 2.1.313 build on Open VSX added an SSH key, opened a reverse tunnel, and set persistence. Here is what is confirmed and what is not.
A compromised third-party script drained about $2.7 million from hundreds of Polymarket accounts. Here’s how it worked and what it means for prediction markets.
Binance suspended deposits and withdrawals after a suspected hot-wallet breach. Here’s what is confirmed, what remains an estimate, and what users should watch.
WordPress 7.1.4 fixes 22 security issues, including a core-update race condition and several stored XSS bugs. Here is who needs it and how to update.
CISA added CVE-2026-48356 to its KEV catalog on October 27, with a November 10 deadline for federal agencies. Adobe fixed the flaw in July; a separate 953-store CMS-malware campaign has 471 initial accesses tied to PolyShell.
A 16-year-old buffer overflow in EDK II’s PXE driver lets a network attacker corrupt firmware memory before the OS loads. The code is widespread; the exposure is narrower than ‘most servers.’
Tailscale’s TS-2026-014 through TS-2026-017 are fixed in 1.104.4+. The investigation page still lags, but the patch is available; here is what changed and what to do.
Go shipped an urgent crypto/x509 update blocking eight compromised eMudhra intermediates. Here is why every Go binary must be rebuilt to pick up the fix.