Active vulnerabilities, advisories, and threat intelligence — filtered for IT practitioners.
A sandbox escape in Google Chrome was exploited as a zero-day in a targeted espionage campaign against media organizations, educational institutions, and government entities in Russia.
The widely-used tj-actions/changed-files GitHub Action was compromised in a supply chain attack, executing malicious code that printed CI/CD secrets to workflow logs in hundreds of repositories.
A Windows Management Console security feature bypass was exploited by the Russian-linked Water Gamayun group to execute malicious .msc files, bypassing Windows file reputation and MotW protections.
