Tech · Culture · Fiction
Article 62,969 exploit attempts hit WordPress days after patch
A WordPress Core RCE in the upgrade process drew 62,969 blocked attacks in 24 hours; patch to 7.1.4 to close the race window.
Three moderate CVEs chain to root
An Ivanti Connect Secure auth bypass, file upload, and privilege escalation chain to unauthenticated root. Patch the combined release, not just one CVE.
CISA flags exploited GitLab and Cisco flaws
CISA added a CVSS 10.0 GitLab RCE and a Cisco ASA/FTD firewall DoS to its KEV catalog after active exploitation, with a November 1 patch deadline.
CISA gives agencies until November 6 to patch WordPress
CISA added WordPress Core flaw CVE-2026-119977 to its KEV catalog after a TOCTOU race in the upgrade process enabled unauthenticated code execution.
Postman installs plugins nobody requested
Postman's desktop app auto-installed agent plugins, a CLI and an MCP connection into Codex and Claude Code, and self-approved a Codex hook trust record.
Unreleased Claude built five working exploits, all now patched
An unreleased Claude model chained bugs into five working exploits across Chrome, Safari, Android, Windows, and Linux; all vendors have since patched.
Attackers weaponize Siemens IoT2050 flaw to deploy botnet
Attackers are weaponizing CVE-2026-58115, a CVSS 10.0 missing-auth flaw in Node-RED on Siemens IoT2050 devices, to deploy Linux bots and persistent backdoors.
The Wire — latest
All →- 11-Year Reverse Engineering Effort Brings Co-op to DOS Wing Commander
- AI Godfather Hinton: Catastrophe Could Strike This Year
- AI-Powered Attackers Weaponize Backdoored ARTEX; 62 Consoles Compromised
- Apple to Scan Public iCloud Links for Harmful Content
- Coffee Makers Go Plastic-Free as Microplastics Worries Grow
- CSS Walker Physics Demo
- Datasette Apps Improves Agent Integration
- Democrats Win House Control in Major Trump Rebuke
- Five Active Cyber Threats Target US Enterprises in October
- Images 2.6: 50% Faster with Animated GIFs
Stay in the loop
New writing delivered when it's ready. No schedule, no spam.