Search: “Free”

3,034 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 857 Ransomware 724 Vulnerability 673 Data breach 354 Threat actor 171 Malware 110 Policy & legal 59 Phishing & fraud 30 Advisory 19 AI industry 18 AI safety & security 18 Model release 12 AI research 2 AI tools & infra 2

SeverityAll critical 2695 high 292 medium 23 low 0 info 43

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including 113 critical, with two Windows privilege-escalation bugs (CVE-2026-81963, CVE-2026-85880) exploited in the wild.

Microsoft's September 2026 security update addresses 973 vulnerabilities across its product lineup, 113 rated critical, of which 82 are remote code execution flaws. Two vulnerabilities are confirmed exploited in the wild: CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack (CVSS 7.8), and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (CVSS 7.8). Microsoft flags several bugs as more likely to be exploited, including a 9.8 RCE in Windows DNS Server (CVE-2026-69730), an 8.8 RCE in Windows Kerberos (CVE-2026-69676), and a 9.0 EoP in Spring Cloud Azure (CVE-2026-69854). Cisco Talos published accompanying Snort rules to detect exploitation attempts against the prominent flaws.

Cisco TalosSep 8, 22:16 UTC · 8d agoAdvisory in the wildCVE-2026-81963 CVE-2026-85880 CVE-2026-69676+27 CVEs

Is It the Beginning of the End For Use-After

Palo Alto Unit 42Nov 1, 09:17 UTC · Nov 1, 2018Exploit / PoC in the wildCVE-2014-1815 CVE-2014-1776 CVE-2014-0322+1 CVEs

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm CenterAug 31, 20:00 UTC · 16d agoAI safety & security1

Microsoft Patch Tuesday, September 2026 Security Update Review

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

Qualys ThreatPROTECTSep 9, 12:23 UTC · 7d agoVulnerability in the wildCVE-2026-81963 CVE-2026-85880 CVE-2026-58599+27 CVEs

Vulnerability Deep Dive - Ichitaro Office Excel File Code Execution Vulnerability

Cisco TalosFeb 24, 17:42 UTC · Feb 24, 2017Vulnerability in the wildCVE-2017-2790

Product showcase: Free email security test by ImmuniWeb Community Edition

Help Net SecurityMar 11, 13:19 UTC · Mar 11, 2024Ransomware

Centrify unveils free cloud-based PAM offering for organizations that do not have a password vault

Help Net SecurityJul 25, 00:00 UTC · Jul 25, 2019Data breach

Cynet's Free Incident Response Tool — Stop Active Attacks With Greater Visibility

The Hacker NewsMay 7, 18:56 UTC · May 7, 2019Data breach

Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild

Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.

Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.