Vulnerabilities
Ongoing coverage on Vulnerabilities.
Latest coverage
Final Fantasy XIV re-opens PC logins after players form a ‘PHP Watering Service’ to keep crops alive
Final Fantasy XIV has restored PC logins after a PHP vulnerability caused temporary server maintenance. During the outage, players formed a community initiative called the 'PHP Watering Service' to help others maintain their in-game crops. Console players were unaffected by the login issues.
PHP Foundation claims leaked info & broken embargoes spread awareness of vulnerabilities
The PHP Foundation has cited cybersecurity firm Chainguard for leaking critical information about a fix for recent vulnerabilities, allowing attackers access before users could patch their systems. Another firm, Calif, is also mentioned for mistakenly publishing details about vulnerabilities. The foundation emphasizes that the unauthorized early sharing of this information is the primary cause of the widespread panic and temporary shutdowns experienced this week.
"Your body is foreign territory": Small-town mystery puzzler Patience is a Virtue explores power and vulnerability by way of a unique conversation system
Patience is a Virtue, a mystery puzzler from teaisfortoby!, explores themes of power and vulnerability through its unique conversation system. The game's mechanics, which require players to reassemble dialogue, reflect the protagonist Louis's struggles with communication and societal expectations, particularly as a neurodivergent and chronically ill individual. Despite challenging encounters, the game offers moments of curiosity and joy.
Don't fear the BIOS update: Asus has just fixed a local access vulnerability affecting older Intel motherboards
Asus has released a BIOS update to fix a local access vulnerability affecting older motherboards for 8th and 9th Gen Intel chips. The vulnerability, designated CVE-2026-93495, requires physical proximity to exploit but has a high severity score. Asus strongly recommends updating to the latest BIOS version for affected models, including various ROG Strix and ROG Maximus motherboards.
A Zoom Zero-Click Was Found in Under a Day — With AI Tools Anyone Can Download
The cybersecurity firm A Security discovered a zero-click remote code execution vulnerability in Zoom's annotation tool using publicly available AI models and fewer than 20 prompts. This flaw allowed attackers to execute code on a victim's machine simply by sharing their screen, even with end-to-end encryption enabled. Zoom has released a patch, and users are urged to update their software immediately.
PSA: Apple has released security updates for Mac
Apple has released security updates for its macOS operating systems, including Tahoe, Sequoia, and Sonoma. These patches address a vulnerability found in the Screen Sharing feature.
Apple has reportedly fixed its Hide My Email vulnerability
Apple has reportedly addressed a vulnerability within its Hide My Email feature for iCloud+ users. This fix ensures that users' email addresses are no longer exposed when using the service.
It's probably time to update 7-Zip as the app has just been patched to fix a pretty big vulnerability
A significant vulnerability in the file compression application 7-Zip has been patched, requiring users to manually update to version 26.02 or later. The vulnerability allows for arbitrary code execution if a user interacts with a malicious file or webpage. This fix was reported by Lunbun LLC and released by 7-Zip after a few weeks.
Evening Safety Dance
A vulnerability in Apple's 'Hide My Email' feature has been discovered, potentially exposing users' real email addresses. Separately, the EvilTokens device-code phishing kit is noted for its advanced malicious capabilities.
Morning Safety Dance
A critical vulnerability in Microsoft's Copilot has been discovered, allowing hackers to steal two-factor authentication codes from users. This exploit poses a significant security risk, potentially compromising user accounts.
Sunday Safety Dance
Cisco is facing attacks on a zero-day vulnerability within its SD-WAN solution, with no patch currently available. The article also touches on physical security threats involving USB sticks and mentions Oxford University.
Evening Safety Dance
Meta's AI chatbot has allegedly been used by hackers to hijack Instagram accounts. Separately, a Windows Server vulnerability has been discovered that could grant system privileges through a malformed packet, posing a risk to domain controllers.
Security researcher describes freshly uncovered Windows 11 vulnerability as 'one of the most insane discoveries I…
A security researcher known as Nightmare-Eclipse has discovered a BitLocker bypass vulnerability in Windows 11, dubbed YellowKey. The exploit allows attackers to access encrypted drives by abusing the Windows Recovery Environment, a vulnerability that does not appear to affect Windows 10. Microsoft has acknowledged the issue as a security feature bypass.
NVIDIA reveal more GPU driver security flaws for May 2026
NVIDIA has revealed multiple security vulnerabilities affecting its GPU drivers for Windows and Linux, with potential impacts including denial of service, privilege escalation, and code execution. These flaws, detailed with CVE identifiers and severity ratings, highlight ongoing security concerns within graphics driver software.
Fragnesia and ssh-keysign-pwn are the latest Linux security problems
Two new Linux security vulnerabilities, Fragnesia and ssh-keysign-pwn, have been disclosed. Fragnesia is a local privilege escalation exploit within the Dirty Frag class, allowing arbitrary writes to read-only kernel files. Ssh-keysign-pwn enables unprivileged users to read root-owned files. Users are advised to keep their systems updated.
Linux security flaws Dirty Frag and Copy Fail are a good reminder to stay up to date
Two significant security vulnerabilities, Dirty Frag and Copy Fail, have been discovered in Linux systems, allowing unprivileged local users to gain root access. Patches are being rolled out across various distributions, and a temporary workaround for Dirty Frag is available via the terminal. Users are advised to update their systems promptly.
Evening Safety Dance
Microsoft's Edge browser reportedly has a vulnerability that could easily leak user passwords, a feature Microsoft claims is "by design." This information comes from a Neowin report and is part of a broader vulnerability summary for the week of April 27, 2026, from CISA.
Canonical, the company that makes Ubuntu Linux, says its web infrastructure is under a 'sustained, cross-border…
Canonical, the company behind Ubuntu Linux, is experiencing a sustained, cross-border cyberattack that has impacted its website, blog, and potentially its software repositories. The company is working to address the issue and provide updates through official channels. Reports suggest a hacktivist group may have claimed responsibility for the attack.
A 17-year-old Excel vulnerability is currently being exploited by threat actors, and it's been flagged by the…
A 17-year-old vulnerability in Microsoft Office, originally reported in 2009, is now being actively exploited by threat actors, according to CISA. The agency has flagged the exploit, which has a severity score of 8.8, and is urging Microsoft to patch it again. A separate, less severe but automatable exploit in Microsoft Office SharePoint has also been identified.
X.Org X server and Xwayland security advisory released for multiple issues
X.Org and Xwayland developers have released security advisories detailing multiple vulnerabilities affecting previous versions of the X server and Xwayland. Newly released versions, xorg-server-21.1.22 and xwayland-24.1.10, include fixes for these issues, such as integer underflows and out-of-bounds reads, discovered by Jan-Niklas Sohn working with TrendAI Zero Day Initiative.
