One in six Windows PCs still runs Windows 10, and the vulnerabilities are piling up
Windows 10 holdouts carry nearly 3x the security risk of Windows 11, report finds
Vulnerability articles
7-Zip patches a flaw that could run malware just from opening a bad file
Unlike most software, 7-Zip has no auto-update mechanism, so users must install the fix manually
Microsoft's latest Patch Tuesday fixes 570 security bugs, but some Dell PCs will have to wait
AI is finding more Windows bugs than ever, but patches still aren't reliable
Microbugs: Microsoft has released yet another Patch Tuesday with record-breaking figures. The latest cumulative update for supported Windows editions is significant in both quality and quantity. However, some Dell machines will not receive the update anytime soon due to compatibility issues.
Zimbra patched a flaw that let hackers hijack accounts just by sending an email
It's the latest in a string of XSS vulnerabilities that have targeted Zimbra for nearly five years
Microsoft's patch for a Windows Defender 0-day may have created a new attack path
Exploiting the bug could let attackers quarantine massive files until a system's storage is completely full
A new attack uses a BioShock-style puzzle to convince AI browsers they're not in the real world
Researchers found a way to trick AI browsers into "forgetting" safety rules
Apple's Hide My Email feature may be exposing users' real addresses anyway
The bug reportedly remained exploitable more than a year after Apple was told about it
The first unpatchable iPhone exploit in six years targets chips still running Apple's latest iOS
A new unpatchable exploit affects the iPhone 11 and other older Apple devices
Microsoft's June Patch Tuesday fixes a record 200 vulnerabilities, including five being actively exploited
Five zero-days, 55 remote code execution bugs, and a disputed BitLocker backdoor fix
New 7-Zip security flaw could put hundreds of millions of systems at risk
The situation is bad, but a software update is already available
PSA: The widely used 7-Zip utility is once again affected by a potentially dangerous security vulnerability. The open-source file archiver can be exploited to execute malicious code by tricking users into opening specially crafted archives. End users and system administrators are advised to install the latest version of the software as soon as possible.
Google accidentally published a four-year-old Chromium security bug, then tried to hide it again
Discovered in 2022 and rated high priority, it still hasn't been fixed
Facepalm: The open-source Chromium project provides the foundation for Google Chrome and many other popular web browsers like Microsoft Edge, Opera, and Brave. When a serious security flaw is discovered in the shared codebase, it can quickly become a widespread threat affecting millions of devices across multiple computing platforms.
A security researcher says Microsoft secretly built a backdoor into BitLocker, releases an exploit to prove it
YellowKey exploit bypasses BitLocker full volume encryption via USB stick and WinRE
Newly disclosed "Dirty Frag" vulnerability left Linux exposed for nearly a decade
Another massive support headache for the Linux world
Facepalm: The open-source community is once again facing a major security incident tied to an "unprecedented" vulnerability. The new flaw could give attackers a reliable way to escalate user privileges, and no patch is available yet. Fortunately, the mitigation process is relatively straightforward. Still, kernel developers are already growing frustrated with the seemingly endless stream of critical bugs.
"Copy Fail" is a rare Linux bug that can turn an unprivileged user into a root admin in seconds
Affects virtually every Linux distro released in the past nine years, and working exploits were on GitHub within 24 hours
Facepalm: Security researchers recently unveiled "Copy Fail," a bug that could potentially bring the entire Linux ecosystem to a screeching halt. The flaw can be reliably exploited across all Linux-based systems, both on local machines and in cloud environments. Vendors are now scrambling to patch the issue.
Researchers warn Microsoft Defender vulnerability is already being exploited
The "Red Sun" flaw can overwrite system files and grant elevated access through Defender's file handling behavior
New Rowhammer attack can grant kernel-level control on Nvidia workstation GPUs
ECC offers only limited protection
New "Zombie ZIP" attack can evade most antivirus scanners
However some experts argue the technique is not a true security flaw
Hackers are selling a critical Windows zero-day exploit for $220,000 on the dark web
Another day, another Windows zero-day being exploited in the wild
Mozilla says Claude AI uncovered over 100 Firefox bugs in just two weeks, including 14 high-severity flaws
Apparently AI can accelerate both attacks and defenses in computer security
Hackers can now track your car's location through tire pressure sensors
$100 DIY device can intercept TPMS data from 50 meters away
A developer accidentally gained control of more than 10,000 DJI devices
Vibe-coded remote control app revealed camera feeds, floor plans, and more from 24 countries
New study finds security gaps in Bitwarden, LastPass, and Dashlane
Zero-knowledge encryption doesn't fully protect popular password managers
OpenClaw (formerly Clawdbot) can manage your entire digital life, but it might leak your credentials
The assistant can browse the web, handle files, and even use your credit card
In brief: A new local AI assistant first popularized under the name "Clawdbot" is experiencing a surge in popularity because it fulfills many of the promises made by prior smart assistants and AI agents. However, its impressive range of capabilities requires full access to the user's device, files, and login credentials – and security researchers have found gaping vulnerabilities.
Patched WinRAR vulnerability remains a favorite tool for hackers and spies
When a dangerous n-day security vulnerability becomes a commodity
Critical vulnerability in React JS framework has a near 100% chance to be exploited
A "perfect ten" security flaw that requires immediate patching on web servers