Explore

Rapid Read Rapid Read
Pack2TheRoot Vulnerability in Linux Allows Unprivileged Users Root Access

Pack2TheRoot Vulnerability in Linux Allows Unprivileged Users Root Access

A high-severity vulnerability known as 'Pack2TheRoot' has been identified in the PackageKit cross-distro package management system used in Linux. This flaw, tracked as CVE-2026-41651, is a time-of-check time-of-use (TOCTOU) race condition that allows unprivileged users to install packages with root privileges. The vulnerability affects multiple Linux distributions, including Ubuntu, Debian, and Fedora. It has been present in PackageKit since version 0.8.1, released 14 years ago. The flaw allows attackers to exploit the system by running transactions with corrupted flags, leading to unauthorized root access.
Trendline Trendline
Nessus Agent Vulnerability on Windows Allows Critical System Privilege Exploitation

Nessus Agent Vulnerability on Windows Allows Critical System Privilege Exploitation

Nessus Agent Vulnerability on Windows Allows Critical System Privilege Exploitation
Rapid Read Rapid Read
OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

A critical vulnerability in OpenSSH, identified as CVE-2026-35414, has been discovered, affecting versions released over the past 15 years. This flaw allows attackers to gain full root shell access to servers by exploiting a mishandling of the authorized_keys principals option. The issue arises when a comma in an SSH certificate principal name is misinterpreted, enabling users with a valid certificate from a trusted CA to authenticate as root. The vulnerability, which has a CVSS score of 8.1, was identified by the cybersecurity firm Cyera. The flaw does not register authentication failures in logs, making detection through log-based methods unreliable. The vulnerability was patched in OpenSSH version 10.3, released in early April 2026.
Rapid Read Rapid Read
Nessus Agent Vulnerability on Windows Allows System-Level Code Execution

Nessus Agent Vulnerability on Windows Allows System-Level Code Execution

A critical security vulnerability has been identified in Tenable's Nessus Agent for Windows, which could allow attackers to execute arbitrary code with SYSTEM privileges. This flaw involves a symlink attack, where attackers can manipulate file operations to delete critical system files, leading to full control over the affected machine. The vulnerability poses a significant threat to organizations using Nessus Agents for vulnerability assessments, especially those installed on high-value or internet-adjacent systems. Tenable has released a patch in version 11.1.3 to address this issue and urges immediate updates to mitigate risks.
Trendline Trendline
Incomplete Windows Patch Exposes Users to Zero-Click Attacks

Incomplete Windows Patch Exposes Users to Zero-Click Attacks

Incomplete Windows Patch Exposes Users to Zero-Click Attacks
Trendline Trendline
GitHub Patches Critical Remote Code Execution Vulnerability Affecting Millions of Repositories

GitHub Patches Critical Remote Code Execution Vulnerability Affecting Millions of Repositories

GitHub Patches Critical Remote Code Execution Vulnerability Affecting Millions of Repositories
Trendline Trendline
Firefox Vulnerability Enables Tor User Fingerprinting Despite Privacy Measures

Firefox Vulnerability Enables Tor User Fingerprinting Despite Privacy Measures

Firefox Vulnerability Enables Tor User Fingerprinting Despite Privacy Measures
Rapid Read Rapid Read
Incomplete Windows Patch Leaves Systems Vulnerable to Zero-Click Attacks

Incomplete Windows Patch Leaves Systems Vulnerable to Zero-Click Attacks

Akamai has reported that an incomplete patch for a Windows vulnerability has led to a new security flaw, enabling zero-click attacks. The original vulnerability, CVE-2026-21510, was patched in February but left a gap that attackers could exploit without user interaction. This flaw allows attackers to steal credentials via auto-parsed LNK files. The Russian-linked group APT28 has been identified as exploiting this vulnerability, targeting entities in Ukraine and the European Union. Microsoft has since released a fix for the new vulnerability, CVE-2026-32202, as part of its April 2026 security updates.
Trendline Trendline
GitHub Vulnerability Exposes Millions of Repositories to Potential Exploits

GitHub Vulnerability Exposes Millions of Repositories to Potential Exploits

GitHub Vulnerability Exposes Millions of Repositories to Potential Exploits
Trendline Trendline
Itron Discloses Cyber-Attack, Ensures Continued Operations

Itron Discloses Cyber-Attack, Ensures Continued Operations

Itron Discloses Cyber-Attack, Ensures Continued Operations
Trendline Trendline
AI Agent Error Causes Major Disruption for Car Rental Software Startup

AI Agent Error Causes Major Disruption for Car Rental Software Startup

AI Agent Error Causes Major Disruption for Car Rental Software Startup
Trendline Trendline
OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years