60
60
60
60
60
⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More
60
60
60
September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor
Microsoft's September 2026 Patch Tuesday delivers a record patch count, fixing two exploited zero-days and a wormable DNS flaw dubbed a SigRed successor.
Microsoft's September 2026 Patch Tuesday sets another record patch count, fixing two vulnerabilities exploited as zero-days: CVE-2026-81963, a Windows Update Stack low-privilege-to-SYSTEM escalation reported by MSTIC, and CVE-2026-85880, a Windows Advanced Local Procedure Call escalation reported by Proofpoint. Zero Day Initiative's Dustin Childs urges priority on a cluster of 20 potentially wormable bugs including DNS RCE CVE-2026-69730, described as a spiritual successor to SigRed, plus Kerberos authentication bypass CVE-2026-69676 that could give any authenticated domain user RCE on domain controllers, and Exchange RCE CVE-2026-55007 via a malicious Visio attachment. All Windows fixes are bundled in cumulative updates, and experts stress prioritizing exploitable, reachable flaws over raw patch counts.
78
60
60
60
THN Cybersecurity Recap: Top Threats, Tools and News (Oct 21
60
60
60
60
60
60
60
60
60
60
Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection
Adversa AI's Cryptographic Context Injection bypasses AI guardrails using AES-encrypted payloads, enabling zero-click theft of Grok users' full chat histories.
Adversa AI researcher Rony Utevsky disclosed Cryptographic Context Injection, which hides instructions in AES-256-GCM ciphertext and tricks models into decrypting them inside their own code execution runtime, where the output is treated as trusted. Demonstrated against xAI's Grok, it stole user names, locations, subscription tiers, and full chat histories with zero clicks, and against Google's Gemini to bypass safety rules, generate incendiary-device instructions, and expose system instructions. Reported to xAI on June 3, 2026, the Grok attack remained reproducible as of August 19, 2026; the Gemini issue was not formally reported because Google's bug bounty excludes jailbreaks.
68
60
⚡ Weekly Recap: BadCam Attack, WinRAR 0-Day, EDR Killer, NVIDIA Flaws, Ransomware Attacks & More
60
60
Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited
60
60
60
60
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
60
60
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [3 February]
60