Critical Copilot vulnerability allowed hackers to steal 2FA code from users

Last Tuesday, Microsoft patched a vulnerability it rated as max critical in its M365 Copilot AI platform. On Monday, the researchers who discovered the vulnerability and reported it to Microsoft ...
The Hacker News

New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos

Fake CVE exploit repos pull frint and skytext packages to steal researcher credentials, with servers still live as of July 1.
Tech Times

Defender Zero-Day Patched 29 Days After Public Exploit Exposed Millions of PCs

Windows Defender zero-day CVE-2026-50656 — known as RoguePlanet — has been patched by Microsoft 29 days after researcher ...
Bleeping Computer

Critical Erlang/OTP SSH pre-auth RCE is 'Surprisingly Easy' to exploit, patch now

A critical vulnerability in the Erlang/OTP SSH, tracked as CVE-2025-32433, has been disclosed that allows for unauthenticated remote code execution on vulnerable devices. The flaw was discovered by ...

Critical libssh2 vulnerability: Proof-of-concept exploit released

The libssh2 library, which is widely used, contains a critical security vulnerability. A published proof-of-concept exploit ...
SecurityWeek

Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability

Exploit for "Bad Epoll" Linux kernel vulnerability (CVE-2026-46242) can lead to root access on desktops, servers, and Android ...
TweakTown

WinRAR 'high-risk' exploit discovered, make sure you update to the latest release

'RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability' can place files in the Windows Startup folder and cause real damage. TL;DR: WinRAR has a critical security vulnerability ...

New Windows Zero-Day Claims BitLocker Bypass Amid Microsoft Disclosure Fight

A new Windows zero-day reportedly bypasses BitLocker, adding pressure on Microsoft as researchers debate the exploit’s real-world impact.
Infosecurity-magazine.com

Malicious VS Code Extensions Exploit Name Reuse Loophole

A new campaign involving malicious Visual Studio Code (VS Code) extensions has exposed a loophole in the VS Code Marketplace that allows threat actors to reuse names of previously removed packages.
Dark Reading

Critical VMware RCE Vulnerabilities Targeted by Public Exploit Code

Three security vulnerabilities affecting VMware's vRealize Log Insight platform now have public exploit code circulating, offering a map for cybercriminals to follow to weaponize them. These include ...
The Journal

Attackers Exploit Claude Code Tool to Infiltrate Global Targets

San Francisco-based AI developer Anthropic recently reported that attackers linked to China leveraged its Claude Code AI to carry out intrusions against about 30 global organizations. According to the ...
Ars Technica

Google publishes exploit code threatening millions of Chromium users

Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase that threatens millions of people using Chrome, Microsoft Edge, and virtually all other ...