CVE-2026-23918: Apache HTTP/2 Double-Free — Patch Now
Apache HTTP Server 2.4.66 has a critical double-free bug in mod_http2 (CVE-2026-23918, CVSS 8.8) enabling unauthenticated DoS and possible RCE on Debian and ...
Ladybird Closes Public PRs — AI Broke the Trust Signal
Ladybird browser shut down public pull requests today. AI has broken the effort-equals-good-faith assumption open ...
Google AMS: Scan Open-Weight LLMs for Safety in 40 Seconds
Google's open source AMS tool scans open-weight LLMs for intact safety training by measuring activation ...
CVE-2026-0257: GlobalProtect VPN Auth Bypass Is Being Exploited Now
CVE-2026-0257 is under active exploitation. CISA added it to the KEV catalog. If you run ...
CVE-2026-41089: Windows Netlogon Zero-Click RCE Is Being Exploited Now
CVE-2026-41089 is a CVSS 9.8 zero-click RCE in Windows Netlogon, actively exploited since May 13. ...
CVE-2026-48501: GitHub CLI Leaks Auth Token — Patch to 2.93.0 Now
GitHub CLI CVE-2026-48501 sends your auth token to non-GitHub servers during gh attestation and gh release verify. Upgrade to v2.93.0 and rotate your ...
CVE-2025-48595: Android Zero-Day Exploited — Act Now
Google's June 2026 Android patch fixes CVE-2025-48595, an actively exploited Framework zero-day. CISA deadline: June ...
CVE-2026-44338: PraisonAI Auth Bypass Exploited in 4 Hours
PraisonAI CVE-2026-44338 ships authentication disabled by default. Versions 2.5.6-4.6.33 are vulnerable. Here is what attackers ...
Google Catches First AI-Built Zero-Day: Act Now
Google's Threat Intelligence Group caught the first confirmed AI-generated zero-day exploit in the wild — ...
Sound Blaster Speaker Hack: No Patch, No Pairing Needed
A researcher turned the Creative Sound Blaster Katana V2X into a remote keystroke injector via ...