> booting the archive…
we use a small set of cookies. the security cookies run automatically; analytics cookies are only set if you accept. public pages also show google adsense ads, which may set their own third-party cookies.
> booting the archive…
A bug in the GoBalance load balancer let anyone recover a dark-web site's Tor master key from one public descriptor, no server access required.
At Pwn2Own Ireland, three teams broke into a fully patched Google Pixel 10 over the network on the same day, splitting $562,500 in prizes.
A single prompt to a public AWS Bedrock AgentCore agent can hijack AgentCore agents in the same account and region via IMDS and an overprivileged default role.
CISA and partners warn China-linked actors combine automated scanning, botnets and hands-on exploitation to steal sensitive data from critical infrastructure.
LMCache unpickles data straight off an unauthenticated socket. One message is RCE, your exposure is one flag wide, and no patch exists.
Cling hides its C2 inside STUN traffic to 13 public servers. The protocol it abuses to blend in is exactly what gives it away.
CISA has added CVE-2026-76504, a critical auth bypass in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities list after active exploitation.
Google is rolling out Gemini 4 Argon to trusted cyber defenders via its Fairwind Program with a planned guardrail-free variant for full defensive capabilities.
A 9.9 template-injection flaw in GitLab's self-hosted AI Gateway lets any Duo Agent Platform user escape the prompt sandbox. The fix is three patch versions.
A 9.8 path traversal plus NULL byte flaw in FortiMail is under attack. The workaround is three CLI lines, and it does nothing for boxes already written to.