vulnerability

New BitUnlocker Downgrade Attack on Windows 11 Allows Access to Encrypted Disks in 5 Minutes

, , ,

A new tool called BitUnlocker exploits a vulnerability in Windows 11's BitLocker encryption, allowing attackers with physical access to decrypt protected volumes in under five minutes by using a downgrade attack on the boot manager. The attack leverages an unrevoked legacy signing certificate, enabling a pre-patch vulnerable boot manager to pass Secure Boot validation, but Microsoft mitigations like enabling TPM+PIN authentication and deploying update KB5025885 can protect systems against this exploit.

https://cybersecuritynews.com/bitunlocker-downgrade-attack-on-windows-11/

Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation

, ,

Google disclosed that hackers have used artificial intelligence to develop the first known zero-day exploit capable of bypassing two-factor authentication (2FA) for mass exploitation. The zero-day vulnerability, implemented in a Python script with characteristics of AI-generated code, targets a popular open-source web-based administration tool and demonstrates how AI models are accelerating the discovery and weaponization of software vulnerabilities.

https://thehackernews.com/2026/05/hackers-used-ai-to-develop-first-known.html

China Scrambles to Close AI Cyber Gap as Anthropic, OpenAI Surge with New Models

,

China is rapidly expanding its AI-driven cybersecurity industry to close the gap with US leaders like Anthropic and OpenAI, whose new models have advanced capabilities in discovering and exploiting cybersecurity vulnerabilities. According to IDC, China’s AI cybersecurity market is projected to grow from 1.58 billion yuan in 2025 to 59.35 billion yuan (US$8.7 billion) by 2030, driven by widespread adoption of AI technologies among domestic cybersecurity vendors.

https://www.scmp.com/tech/tech-trends/article/3352978/china-scrambles-close-ai-security-gap-anthropic-openai-pull-ahead-new-models

The 90 Day Disclosure Policy Is Dead

,

The article argues that the traditional 90-day vulnerability disclosure policy is no longer effective due to advances in AI and large language models (LLMs) that have drastically sped up bug discovery and exploit development. Real-world examples show multiple researchers independently finding the same critical bugs within weeks and exploits emerging minutes after patches are released, leaving no safe window for vendors to patch before attacks occur. The author urges the security industry to treat every critical bug as a top priority for immediate fix and to integrate AI-assisted tools into continuous development and security processes to keep pace with emerging threats.

https://blog.himanshuanand.com/2026/05/the-90-day-disclosure-policy-is-dead/

cPanel, WHM Release Fixes for Three New Vulnerabilities

,

cPanel has released patches to fix three vulnerabilities in cPanel and Web Host Manager (WHM) that could allow privilege escalation, code execution, and denial-of-service attacks. Users are urged to update to the latest versions promptly to protect their systems, as these flaws affect multiple releases and include issues like arbitrary file read, Perl code execution, and unsafe symlink handling.

https://thehackernews.com/2026/05/cpanel-whm-patch-3-new-vulnerabilities.html

Critical Microsoft 365 Copilot Vulnerabilities Expose Sensitive Information

, ,

Microsoft disclosed and fully mitigated three critical information disclosure vulnerabilities in Microsoft 365 Copilot and Copilot Chat in Microsoft Edge, all classified with high confidentiality risks and affecting enterprise data access. These cloud-side flaws, discovered by Microsoft and an independent researcher, required no action from users or administrators as fixes were applied server-side, but organizations are advised to enforce least-privilege access to limit potential exposure of sensitive corporate information.

https://cybersecuritynews.com/microsoft-365-copilot-vulnerabilities-data/

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

,

A new local privilege escalation vulnerability called Dirty Frag has been discovered in the Linux kernel, enabling unprivileged users to gain root access across major Linux distributions by exploiting flaws in the xfrm-ESP and RxRPC subsystems. This deterministic and highly reliable exploit, which builds on vulnerabilities like Copy Fail and Dirty Pipe, affects systems including Ubuntu 24.04.4, RHEL 10.1, and Fedora 44, prompting advisories from multiple vendors and recommendations to block affected kernel modules until patches are fully available.

https://thehackernews.com/2026/05/linux-kernel-dirty-frag-lpe-exploit.html

Dirty Frag Linux Vulnerability Let Attackers Gain Root Privileges – PoC Released

, ,

Dirty Frag is a newly disclosed Linux kernel local privilege escalation vulnerability that chains two separate page-cache write flaws, allowing attackers to gain root privileges on virtually all major Linux distributions. Discovered by security researcher Hyunwoo Kim, the exploit modifies page cache in RAM deterministically without requiring timing windows or crashing the kernel, with a public proof-of-concept released following an embargo breach on May 7, 2026. Immediate mitigation involves disabling affected kernel modules until distribution-level patches, which are partially merged upstream, become available.

https://cybersecuritynews.com/dirty-frag-linux-vulnerability/

Critical Ollama Memory Leak Vulnerability Exposes 300,000 Servers Globally

,

A critical memory leak vulnerability named “Bleeding Llama” affects Ollama, a popular platform for running local AI models, exposing approximately 300,000 internet-facing servers globally. This flaw allows unauthenticated attackers to extract sensitive data directly from server memory by exploiting a weakness in processing uploaded model files, potentially leaking prompts, environment variables, and confidential information; users are urged to update to version 0.17.1 and secure exposed deployments immediately.

https://cybersecuritynews.com/ollama-vulnerability-exposes-servers/

Google Chrome 148 Released with Fix for 127 Security Vulnerabilities – Update Now!

, , ,

Google has released Chrome 148, a major update addressing 127 security vulnerabilities, including three critical flaws such as an integer overflow in the Blink engine and use-after-free bugs in Mobile and Chromoting components. Users across Windows, Mac, and Linux are urged to update immediately to protect against potential exploits, with significant bug bounties awarded to researchers who reported these issues.

https://cybersecuritynews.com/chrome148-vulnerabilities-patched/

Microsoft Edge Stores Passwords in Process Memory, Posing Risk

, ,

Security researcher Tom Jøran Sønstebyseter Rønning revealed that Microsoft Edge stores all saved passwords in cleartext in process memory, even when sites are not actively visited, allowing anyone with administrative privileges to extract these passwords and potentially escalate attacks within corporate environments. Microsoft considers this behavior “by design,” citing trade-offs between performance, usability, and security, but experts warn it poses significant risks, especially in shared or virtualized settings, and recommend organizations limit reliance on browsers for password storage and enforce strict access controls.

https://www.darkreading.com/cyber-risk/microsoft-edge-passwords-enterprise-risk

Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE

,

The Apache Software Foundation has released updates to fix a critical vulnerability (CVE-2026-23918) in Apache HTTP Server 2.4.66 that allows denial-of-service (DoS) attacks and potential remote code execution (RCE) via a double-free bug in HTTP/2 protocol handling. The flaw can be exploited by sending specific HTTP/2 frames, with the RCE path particularly feasible on systems using the default Apache Portable Runtime mmap allocator, leading to high risk for widely deployed servers.

https://thehackernews.com/2026/05/critical-apache-http2-flaw-cve-2026.html

Critical Apache HTTP Server Flaw Exposes Millions of Servers to RCE Attacks

, ,

The Apache Software Foundation released version 2.4.67 of Apache HTTP Server to patch five vulnerabilities, including a critical double-free flaw (CVE-2026-23918) in version 2.4.66 that enables remote code execution via HTTP/2. Users are strongly urged to upgrade immediately to mitigate this high-severity risk affecting millions of servers worldwide.

https://cybersecuritynews.com/apache-http-server-rce/

cPanelSniper – PoC Exploit Disclosed for cPanel Vulnerability, 44,000 Servers Compromised

, ,

A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM, exploited by a publicly released proof-of-concept tool named “cPanelSniper,” has compromised approximately 44,000 servers worldwide since at least February 2026. The flaw allows attackers to forge root sessions without valid credentials by injecting malicious session data, prompting emergency patches from cPanel, while security experts urge immediate updates and audits to prevent further exploitation.

https://cybersecuritynews.com/cpanelsniper-poc-exploit/

The Most Severe Linux Threat to Surface in Years Catches the World Flat-Footed

,

A critical local privilege escalation vulnerability in the Linux kernel, named CopyFail (CVE-2026-31431), has been publicly disclosed with exploit code that easily grants root access across virtually all Linux distributions. The flaw affects multi-tenant servers, Kubernetes containers, and CI/CD workflows, posing a severe threat as attackers can escalate privileges quickly on vulnerable systems before widespread patches are applied. Security experts warn this is one of the most serious Linux vulnerabilities in years, urging immediate investigation and mitigation by Linux users and vendors.

https://arstechnica.com/security/2026/04/as-the-most-severe-linux-threat-in-years-surfaces-the-world-scrambles/

Scroll to Top