The single-packet attack: making remote race-conditions 'local'
The single-packet attack is a new technique for triggering web race conditions.
Threat Intelligence Feed
Aggregating 6807 articles from trusted cybersecurity sources
LATEST CVEs
MED · CVE-2026-58523
Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over
CVE-2026-14617
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function Gatewa
MED · CVE-2026-58597
Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to pe
MED · CVE-2026-58524
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)
MED · CVE-2026-58522
Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
CRIT · CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state w
HIGH · CVE-2026-58424
Permanent Fork PR Workflow Approval Gate Bypass
HIGH · CVE-2026-58423
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
CVE-2026-58422
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
CVE-2026-58421
Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
CVE-2026-58419
Notification API leaks private issue metadata after access revocation
MED · CVE-2026-58418
SSRF via HTTP Redirect in Repository Migration
MED · CVE-2026-58300
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
HIGH · CVE-2026-58299
Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execu
HIGH · CVE-2026-58298
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)
HIGH · CVE-2026-58297
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a
HIGH · CVE-2026-58296
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a
HIGH · CVE-2026-58295
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
HIGH · CVE-2026-58294
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
HIGH · CVE-2026-58293
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code
HIGH · CVE-2026-58292
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netw
MED · CVE-2026-58291
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker t
HIGH · CVE-2026-58290
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
CRIT · CVE-2026-58289
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
HIGH · CVE-2026-58288
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
HIGH · CVE-2026-58287
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
HIGH · CVE-2026-58286
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne
HIGH · CVE-2026-58285
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
HIGH · CVE-2026-58284
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network
HIGH · CVE-2026-58283
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
HIGH · CVE-2026-58282
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne
MED · CVE-2026-58278
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofin
HIGH · CVE-2026-58276
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
HIGH · CVE-2026-57993
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofin
HIGH · CVE-2026-57992
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
HIGH · CVE-2026-57991
Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized
HIGH · CVE-2026-57988
Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a networ
MED · CVE-2026-57987
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofin
HIGH · CVE-2026-57986
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
HIGH · CVE-2026-57985
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netw
Latest News
How to build custom scanners for web security research automation
In this post, I'll share my approach to developing custom automation to aid research into under-appreciated attack classes and (hopefully) push the boundarie...
Version 2.9 of the Mozilla Root Store Policy
Online security is constantly evolving, and thus we are excited to announce the publication of MRSP version 2.9, demonstrating that we are committed to keep ...
Smashing the state machine: the true potential of web race conditions
For too long, web race condition attacks have focused on a tiny handful of scenarios.
Updated GPG key for signing Firefox Releases
The GPG key used to sign the Firefox release manifests is expiring soon, and so we’re going to be switching over to new key shortly. The new GPG fingerprint ...
Student Loan Breach Exposes 2.5M Records
2.5 million people were affected, in a breach that could spell more trouble down the line.
Watering Hole Attacks Push ScanBox Keylogger
Researchers uncover a watering hole attack likely carried out by APT TA423, which attempts to plant the ScanBox JavaScript-based reconnaissance tool.
Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system.
Ransomware Attacks are on the Rise
Lockbit is by far this summer’s most prolific ransomware group, trailed by two offshoots of the Conti group.
Cybercriminals Are Selling Access to Chinese Surveillance Cameras
Tens of thousands of cameras have failed to patch a critical, 11-month-old CVE, leaving thousands of organizations exposed.
Twitter Whistleblower Complaint: The TL;DR Version
Twitter is blasted for security and privacy lapses by the company’s former head of security who alleges the social media giant’s actions amount to a national...
Firewall Bug Under Active Attack Triggers CISA Warning
CISA is warning that Palo Alto Networks’ PAN-OS is under active attack and needs to be patched ASAP.
Data Breaches
U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case
A U.S.
The Good, the Bad and the Ugly in Cybersecurity – Week 27
FBI apprehends IRGC-linked cybercriminal, Russian hackers steal Signal backup keys, and unknown hackers breach the DHS information network.
The Anatomy of a Shadow AI Supply-Chain Breach: Lessons from the 2026 Vercel Incident
Vercel breach happened after an employee used an unvetted AI tool. Attackers exploited it as a trusted link to access systems, steal data, and extort $2M.
Medtronic Data Breach Impacts 3.8 Million People
Medical technology giant Medtronic is notifying more than 3.8 million individuals that their personal and medical information was compromised in a recent dat...
DHS investigating breach of intelligence sharing platform
Hackers reportedly gained access to HSIN servers in late May and early June, potentially exposing sensitive but unclassified information.
Aflac Japan data breach affects 4.38 million customers
Hackers gained access to Aflac Japan's systems between June 15 and June 25, stealing personal information from the company's policyholder portal.
Scattered Spider suspect extradited over $8 million ransom scheme
A suspected Scattered Spider member has been extradited to the United States to face charges linked to cyberattacks against U.S.
Medtronic notifies customers impacted by ShinyHunters data breach
Healthcare device firm Medtronic is notifying affected customers about a data breach that exposed their personal data to an unauthorized third party. [.
Huntress CEO addresses insider threat claims amid employee-cybercriminal communication
The controversy surfaced when former Huntress analyst Ben Folland alleged that a current employee disclosed law enforcement inquiries to Devman, a ransomware...
Teen suspect in Scattered Spider hacks is extradited to US
A complaint unsealed this week accuses a 19-year-old of participating in incidents including a breach of a "luxury-jewelry retailer" in 2025.
Intruder offers Free security plan for lean IT and security teams
Intruder has announced the launch of its Free plan, providing security, IT, and DevOps teams ongoing access to professional-grade vulnerability management, c...
The Gentlemen Ransomware Targets Large Corporations and Critical Infrastructure Worldwide
The Gentlemen ransomware group has emerged in 2026 as a highly adaptive and technically sophisticated ransomware-as-a-service (RaaS) operation targeting larg...