Artifactory’s Default Configuration Could Give an Unauthenticated Attacker Admin Access.
JFrog fixed a critical Artifactory authentication bypass that can grant administrative privileges without credentials under the default configuration.
Active Directory Saw Two Different Names. Kerberos Saw the Same Identity.
KerberLoss can disrupt Kerberos services. ResetNightmare can turn a directory write permission into a privileged password reset and domain takeover.
How to Uninstall Windows 11 Update KB5120998
Illustrated rollback steps for KB5120998, with current guidance on when removal is still appropriate.
Windows 11-update KB5120998 verwijderen
Geïllustreerde stappen om KB5120998 terug te draaien, met actueel advies over wanneer verwijderen nog passend is.
Windows 11 KB5120998 verwijderen | How to uninstall KB5120998
KB5120998 may reset cursor styling, wallpaper and text rendering on some Windows 11 PCs. This Dutch and English guide explains when and how to remove the optional update safely.
GitLab’s Claude Agent Read User-Controlled Configuration. Developer Access Reached Arbitrary CI Commands.
GitLab patched a Duo Claude flaw that let a Developer turn user-controlled configuration into arbitrary commands inside a CI job.
McKesson Confirmed the Data Left. ShinyHunters Claims 284 Million Patient-Data Rows.
McKesson confirmed unauthorised access to third-party applications and data exfiltration. ShinyHunters claims 284 million patient-related data rows, but the scale and data types remain unverified.
$20,000 Humanoid Robot, $0 Authentication: Bluetooth to Root
Two independent flaws let network-adjacent or Bluetooth-range attackers reach root on a Unitree G1 EDU robot.
TeamSystem Attackers Stole the Data That Makes Fake Invoices Look Real
TeamSystem attackers reportedly stole IBANs and accounting records, giving criminals the context needed to make invoice fraud look routine.
WordPress Registration Was Disabled. GiveWP Still Created the Account and Reached Server Commands.
GiveWP CVE-2026-82222 chains plugin-specific account creation, stored PHP objects and a shipped gadget chain into unauthenticated server command execution. Version 4.16.7.2 fixes it.
130 Tech Companies Say We Have Months to Prepare. Their Letter Includes No Deadlines
More than 130 organisations warn that defenders have only months to prepare, but their voluntary pledge includes no deadlines.
The Bug Was Three Years Old. Attackers Could Still Treat ownCloud as Their File System.
CISA says attackers are exploiting a critical ownCloud WebDAV authentication bypass first disclosed in 2023. A known username and a missing signing key can expose a user's files without authentication.