Explore

Rapid Read Rapid Read
7-Zip Vulnerability Allows Code Execution Through Crafted XZ Archives

7-Zip Vulnerability Allows Code Execution Through Crafted XZ Archives

A vulnerability in 7-Zip, identified as CVE-2026-14266, has been discovered, allowing attackers to execute code on a machine by opening a crafted XZ archive. This flaw, a heap-based buffer overflow, was detailed by Trend Micro's Zero Day Initiative (ZDI) and affects how 7-Zip processes XZ chunked data. The vulnerability allows code execution within the context of the current process, but does not grant additional privileges. The issue was reported by Landon Peng of Lunbun LLC and has been rated as a high-severity flaw by ZDI. A fix was released on June 25 in version 26.02 of 7-Zip. The vulnerability is considered a local attack vector, requiring user interaction to exploit, and as of now, there are no public proofs of concept or reports of exploitation in the wild.
Rapid Read Rapid Read
OpenSSL Addresses 'HollowByte' DoS Vulnerability with Silent Fixes

OpenSSL Addresses 'HollowByte' DoS Vulnerability with Silent Fixes

A vulnerability in OpenSSL, known as 'HollowByte', has been identified, allowing attackers to exhaust a server's memory before any security handshake. Discovered by Okta's red team, the denial-of-service (DoS) bug can be triggered by a malicious payload of only 11 bytes, which declares a larger incoming message body to initiate a buffer pre-allocation that is not immediately freed. This vulnerability existed because older OpenSSL versions pre-allocated receive buffer sizes based on the incoming message body length declared in the handshake message's 4-byte header. The issue has been silently fixed in OpenSSL version 4.0.1 and backported to earlier versions.
Rapid Read Rapid Read
OpenSSL Addresses 'HollowByte' Vulnerability to Prevent Denial-of-Service Attacks

OpenSSL Addresses 'HollowByte' Vulnerability to Prevent Denial-of-Service Attacks

OpenSSL has silently patched a vulnerability known as 'HollowByte' that could allow attackers to exhaust a server's memory, leading to a denial-of-service (DoS) condition. Discovered by Okta's red team, the vulnerability involves a malicious payload that triggers a buffer pre-allocation based on a declared message size, which is not immediately freed. This flaw affects older OpenSSL versions, allowing attackers to send multiple payloads to exhaust server memory. The vulnerability impacts various applications and servers using OpenSSL, including Apache, NGINX, and MySQL. Patches have been included in OpenSSL version 4.0.1 and backported to earlier versions, addressing the issue by adjusting buffer allocation practices.
Rapid Read Rapid Read
Ransomware Threats Escalate with New Groups Emerging Weekly, Report Warns

Ransomware Threats Escalate with New Groups Emerging Weekly, Report Warns

A report by Black Kite has revealed that more than one new ransomware group is emerging every week, contributing to a fragmented and expanding criminal ecosystem. As of June 2026, there are 146 active ransomware groups, a significant increase from 105 the previous year. The report highlights that 2026 alone has seen the emergence of 61 new groups. Despite the fragmentation, a few groups continue to dominate, with the top five accounting for nearly half of the publicly disclosed victims. The report emphasizes the importance of addressing common cybersecurity vulnerabilities, recommending that organizations prioritize patching systems and software, especially those with high CVSS scores.
Trendline Trendline
ServiceNow Issues Patches Following Exploitation of AI Platform Vulnerability

ServiceNow Issues Patches Following Exploitation of AI Platform Vulnerability

ServiceNow Issues Patches Following Exploitation of AI Platform Vulnerability
Rapid Read Rapid Read
Hugging Face Warns of Network Breach by Autonomous AI Agent

Hugging Face Warns of Network Breach by Autonomous AI Agent

Hugging Face, an open-source AI and machine learning platform, disclosed a security breach where attackers accessed internal datasets and credentials using an autonomous AI agent system. The breach exploited vulnerabilities in the company's data-processing pipeline, allowing attackers to steal cloud and cluster credentials. Hugging Face has since closed the vulnerable paths, evicted the attacker, and is working with forensic experts to assess the impact. The company is investigating whether partner or customer data was affected and has advised users to rotate access tokens and review account activity.
Discover daily Discover daily
Why the 2024 IT Outage Became a Wake-Up Call for Organizations

Why the 2024 IT Outage Became a Wake-Up Call for Organizations

In July 2024, a significant IT outage caused by a faulty software update from CrowdStrike disrupted millions of systems worldwide. This incident, a...
Trendline Trendline
WordPress REST API Vulnerability Enables Remote Code Execution, Threatens Website Security

WordPress REST API Vulnerability Enables Remote Code Execution, Threatens Website Security

WordPress REST API Vulnerability Enables Remote Code Execution, Threatens Website Security
Rapid Read Rapid Read
7-Zip Releases Critical Security Patch to Fix Remote Code Execution Vulnerability

7-Zip Releases Critical Security Patch to Fix Remote Code Execution Vulnerability

7-Zip, a widely used archive utility on Windows, has released version 26.02 to address a critical remote code execution (RCE) vulnerability. This flaw, discovered in the processing of XZ-compressed data, could allow attackers to execute arbitrary code by convincing users to open specially crafted compressed files. The vulnerability was disclosed by researcher Landon Peng and involves a heap-based buffer overflow. Users must manually update to the latest version as 7-Zip lacks an automatic update feature. The vulnerability is particularly concerning as it can be exploited through phishing campaigns or social engineering attacks.
Trendline Trendline
WordPress Vulnerabilities Exploited, Affecting Millions of Websites Globally

WordPress Vulnerabilities Exploited, Affecting Millions of Websites Globally

WordPress Vulnerabilities Exploited, Affecting Millions of Websites Globally
Trendline Trendline
WP2Shell Vulnerabilities in WordPress Exploited, Affecting Global Websites

WP2Shell Vulnerabilities in WordPress Exploited, Affecting Global Websites

WP2Shell Vulnerabilities in WordPress Exploited, Affecting Global Websites
Trendline Trendline
Airbnb CEO Brian Chesky's Social Media Account Hacked, Promotes Crypto

Airbnb CEO Brian Chesky's Social Media Account Hacked, Promotes Crypto

Airbnb CEO Brian Chesky's Social Media Account Hacked, Promotes Crypto