Active Directory Saw Two Different Names. Kerberos Saw the Same Identity.
KerberLoss can disrupt Kerberos services. ResetNightmare can turn a directory write permission into a privileged password reset and domain takeover.
Security
Vulnerabilities, defensive security, architecture and operational security.
Windows 11 KB5120998 verwijderen | How to uninstall KB5120998
KB5120998 may reset cursor styling, wallpaper and text rendering on some Windows 11 PCs. This Dutch and English guide explains when and how to remove the optional update safely.
GitLab’s Claude Agent Read User-Controlled Configuration. Developer Access Reached Arbitrary CI Commands.
GitLab patched a Duo Claude flaw that let a Developer turn user-controlled configuration into arbitrary commands inside a CI job.
McKesson Confirmed the Data Left. ShinyHunters Claims 284 Million Patient-Data Rows.
McKesson confirmed unauthorised access to third-party applications and data exfiltration. ShinyHunters claims 284 million patient-related data rows, but the scale and data types remain unverified.
$20,000 Humanoid Robot, $0 Authentication: Bluetooth to Root
Two independent flaws let network-adjacent or Bluetooth-range attackers reach root on a Unitree G1 EDU robot.
TeamSystem Attackers Stole the Data That Makes Fake Invoices Look Real
TeamSystem attackers reportedly stole IBANs and accounting records, giving criminals the context needed to make invoice fraud look routine.
WordPress Registration Was Disabled. GiveWP Still Created the Account and Reached Server Commands.
GiveWP CVE-2026-82222 chains plugin-specific account creation, stored PHP objects and a shipped gadget chain into unauthenticated server command execution. Version 4.16.7.2 fixes it.
130 Tech Companies Say We Have Months to Prepare. Their Letter Includes No Deadlines
More than 130 organisations warn that defenders have only months to prepare, but their voluntary pledge includes no deadlines.
The Bug Was Three Years Old. Attackers Could Still Treat ownCloud as Their File System.
CISA says attackers are exploiting a critical ownCloud WebDAV authentication bypass first disclosed in 2023. A known username and a missing signing key can expose a user's files without authentication.
A Local IPv6 Packet Became a Route From an Unprivileged Container to the Linux Host.
CISA confirms active exploitation of Linux kernel CVE-2026-53362. A public IPv6 fragmentation exploit can turn local access into root and, under specific conditions, escape an unprivileged container.