Vulnerability articles

AI will keep uncovering critical software flaws for years, says Cloudflare CEO

Big quote: Cloudflare CEO Matthew Prince says the PHP flaws that forced websites offline last week are only the beginning. His company already knows of other severe vulnerabilities in critical software, and he expects AI tools to keep turning up new ones for years. Because these models have sharply cut the time and skill needed to find and exploit serious bugs, defenders and everyday users face a long stretch of disruption before the internet's core software ends up safer.

Sony's latest PS5 firmware got cracked, just in time for GTA 6's November release

Millions of routers can be hijacked over Wi-Fi thanks to a 16-year-old bug

Why it matters: Chipmakers ship buggy code all the time, that alone isn't news. What makes WPSplinter stand out is that Broadcom apparently did issue a fix eight years ago, but that fix never reached the routers sitting in people's homes. Furthermore, the lack of a CVE kept the problem invisible to the advisories and patch pipelines that router makers and ISPs rely on.

Microsoft won't patch old Windows Servers, so a small security firm is doing it

Microsoft breaks Patch Tuesday record with more than 1,000 Windows security flaws fixed

Holy Patch: Microsoft is increasingly relying on AI tools to uncover security vulnerabilities in Windows and its other software products. Yet this month's Patch Tuesday brings an unprecedented number of bug fixes, with Windows bearing the brunt of the latest security cleanup.

Google pauses bug bounties for open source because AI slop reports are drowning its reviewers

A new PS5 jailbreak works on almost every firmware version, and it already runs the latest games

Researchers found a way to bring expired credit cards back from the dead

WTF?! Credit cards aren't meant to last forever, but a team of researchers just found a way to keep expired ones alive for a little longer than intended, and not for the cardholder's benefit. Not every card is affected, but the flaw sits deep enough in how contactless payments are verified that exploitation isn't just theoretical.

Apple just patched a critical macOS flaw that let hackers break in without a password

Three new Windows flaws can bypass security, gain system privileges, and even install malware remotely

Disgruntled security researcher just dropped another Windows zero-day, right on schedule

Sounding off: NightmareEclipse did it again. The security researcher who's been on a crusade against Microsoft has published a new zero-day flaw affecting all supported Windows versions. Redmond threatened to sue, but the researcher is keeping his promise to disclose a new dangerous flaw after every month's Patch Tuesday.

AMD's TPM implementation includes two high-severity flaws, but fixes have been available since May

GeForce Now exploit unlocks full Windows desktop access

Researchers found a way to steal passkeys straight out of Chrome's memory

AI is flooding Apple with fake bug reports, and real $200K macOS exploit got lost in the noise

Winners & losers: Generative AI has become a double-edged sword for security teams. The same technology that helps uncover and fix vulnerabilities faster than ever also makes it trivially easy to flood inboxes with dubious bug reports. That tension recently pushed Apple to change its bug bounty program in a way that ended up delaying disclosure of a genuinely serious exploit.

One in six Windows PCs still runs Windows 10, and the vulnerabilities are piling up

Facing the Flaw: Many organizations have already migrated to Windows 11, but a few diehards are refusing to leave Windows 10 behind. In fact, millions of computers are still running the aging, albeit perfectly functional, operating system, and according to one market analysis, that could soon turn into a security disaster.

7-Zip patches a flaw that could run malware just from opening a bad file

Microsoft's latest Patch Tuesday fixes 570 security bugs, but some Dell PCs will have to wait

Microbugs: Microsoft has released yet another Patch Tuesday with record-breaking figures. The latest cumulative update for supported Windows editions is significant in both quality and quantity. However, some Dell machines will not receive the update anytime soon due to compatibility issues.

Zimbra patched a flaw that let hackers hijack accounts just by sending an email

Microsoft's patch for a Windows Defender 0-day may have created a new attack path

A new attack uses a BioShock-style puzzle to convince AI browsers they're not in the real world

Apple's Hide My Email feature may be exposing users' real addresses anyway

The first unpatchable iPhone exploit in six years targets chips still running Apple's latest iOS

Microsoft's June Patch Tuesday fixes a record 200 vulnerabilities, including five being actively exploited

New 7-Zip security flaw could put hundreds of millions of systems at risk

PSA: The widely used 7-Zip utility is once again affected by a potentially dangerous security vulnerability. The open-source file archiver can be exploited to execute malicious code by tricking users into opening specially crafted archives. End users and system administrators are advised to install the latest version of the software as soon as possible.