AI & software security
-
ShieldBreak tests Microsoft Defender patch boundary
A public proof of concept named ShieldBreak can elevate a local Windows user to SYSTEM and is claimed to bypass Microsoft’s earlier fix for the Defender flaw CVE-2026-50656.
-
Adobe patches critical Commerce authorisation flaw
Adobe has fixed a critical unauthenticated authorisation vulnerability in Commerce and Magento Open Source that can allow privilege escalation without administrator access or user interaction.
-
Ransomware fragments as data theft gains ground
Check Point recorded 2,139 ransomware leak-site victims in Q2 2026 as active groups reached a record 93 and smaller affiliate-driven operations gained ground.
-
Microsoft August patch load tops 400 flaws
Microsoft’s August security release covers 421 vulnerabilities, including an exploited Windows privilege-escalation flaw, as enterprise patch volumes remain far above historic norms.
-
Zoom patches meeting-based code execution flaw
Zoom has patched a high-severity annotation vulnerability that could allow one meeting participant to execute code on another participant’s device through network interaction.
-
Plug and Play trust enables SYSTEM attacks
Researchers have demonstrated attack chains that make Windows install signed vendor software for emulated devices, creating routes to SYSTEM privileges through trusted Plug and Play behaviour.
-
Mindgard raises $30m for AI security expansion
UK-rooted AI security company Mindgard has raised $30 million to expand a platform built around adversarial testing of models, agents, and AI applications.
-
LiteLLM exposure estimate tops 2,500 organisations
CloudSEK estimates that the LiteLLM supply chain compromise potentially exposed more than 2,500 organisations and 434,000 CI/CD pipelines, while stressing that exposure does not establish compromise.
-
Mozilla revokes exposed Firefox signing key
Mozilla has revoked and replaced a GPG subkey used for some Firefox and Thunderbird release artefacts after an unencrypted copy was committed to a private GitHub repository.
-
Poisoned feed compromises BdThemes WordPress plugins
Attackers compromised infrastructure serving a remote data feed used by seven BdThemes WordPress plugins, allowing malicious code to run inside administrators’ browsers without altering plugin files in the official repository.