Lead story / windows
Windows Zero-Day Lets Low-Privilege Accounts Hijack Admins
A researcher dropped working exploit code the same day Microsoft pushed its largest-ever Patch Tuesday, targeting the Windows User Profile Service.
Tagged / vulnerability
vulnerability.
The Revision stories tagged vulnerability — 21 stories on the wire, decoded into one clear voice.
All stories tagged vulnerability
Security
NAT Slipstreaming v2.0 Claims Universal Port Access
A researcher claims NAT Slipstreaming v2.0 can expose any TCP or UDP port to remote attackers, but the writeup offers few verifiable details.
Security
Tailscale SSH Argument Bug Let Attackers Gain Root Access
Tailscale's bulletin TS-2026-009 describes an argument-handling flaw in its SSH feature that could be used to reach root on connected systems.
Security
CISA Flags Active SharePoint Exploits, Urges Patching
Three SharePoint Server vulnerabilities are being actively exploited for remote code execution and credential theft, with two more flagged as high-risk.
Security
Nebusec Claims 15-Year Linux Stack Bug Across All Distros
A security research firm says a stack use-after-free bug called GhostLock hides in every Linux distribution, but its age claim doesn't hold up.
Security
Windows Defender Patch Trades One Bug for a Disk-Filling Risk
Microsoft's fix for a remote-code-execution zero-day in its Malware Protection Engine may cause Windows machines to consume all available disk space.
Security
Critical Flaw in OpenPLC v3 Lets Attackers Run Code on ICS
A CVSS 9.9 file-write bug in OpenPLC v3's web UI can be escalated into full native code execution — and the only fix is upgrading to v4.
Security
Amazon Q Developer flaw let cloned repos steal AWS credentials
A patched high-severity bug in Amazon Q Developer allowed a malicious repository's config file to silently run commands and exfiltrate AWS credentials.
Security
Rockwell Analytics Flaw Lets Unauthenticated Users Run Admin Commands
A missing authorization check in FactoryTalk Analytics PavilionX versions before 7.01 lets attackers manage users and roles without credentials.
Security
AMD Changed Its Bug Bounty Rules to Avoid Paying for a Critical Flaw
A researcher found a critical-severity AMD vulnerability worth $10,000 under program terms — AMD responded by rewriting those terms retroactively.
Security
Oracle Flags Security Flaw Already Used to Hit 100-Plus Companies
Google notified more than 100 organizations with exposed Oracle servers after a cybercrime gang quietly launched a mass-exploitation campaign.
Security
Ivanti Sentry Hit by Perfect-10 RCE Flaw, Exploit Already Public
CVE-2026-10520 carries a perfect CVSS score, a public working exploit, and a CISA known-exploited designation, leaving little room to delay patching.
Security
One Hard-coded Password Let Anyone Command Every Yarbo Robot
A credential baked into Yarbo's app binary unlocked real-time telemetry and remote command access for every robot in the global fleet.
Security
Researcher Microsoft Threatened Drops His Seventh Windows Zero-Day
Hours after June Patch Tuesday closed a record 200 bugs, Chaotic Eclipse published RoguePlanet, a privilege-escalation exploit for fully patched Windows machines.
Security
Microsoft's Record Patch Tuesday Fixes Over 200 Flaws
AI-assisted vulnerability discovery gets the credit for a June update that addressed more than 200 flaws, an all-time Patch Tuesday record.
Security
Microsoft Fixes 0-day After Heated Clash With Researcher
Microsoft patched two zero-days disclosed by a researcher called Nightmare Eclipse, following what appears to have been a prolonged and contentious dispute.
Security
One Stray Character Left the Linux Kernel Open to Attack
A logic inversion bug caused by a single wrong character was found in the Linux kernel, which runs most of the world's servers and devices.
Security
Google Confirms First AI-Discovered Zero-Day Deployed in the Wild
A criminal actor used a frontier AI model to find a 2FA bypass, build an exploit, and deploy it before any defender knew the flaw existed.
Security
Hitachi Energy Patches XML Parser Flaw in Grid Software
A heap-based buffer overflow in MACH HiDraw's XML parser could let an authenticated local attacker crash or compromise industrial control systems.
Security
A DoS Flaw in B&R Industrial OS Puts OPC-UA Servers at Risk
An unauthenticated attacker with network access can permanently lock legitimate users out of the OPC-UA server on unpatched B&R PPT30 devices.
Security
ABB Door Hardware Bug Unlocks Buildings via Default Debug Mode
A default-on compatibility mode in ABB's Busch-Welcome door actuators bypasses authentication, and the only fix is a manual toggle-and-reboot at each site.
