Red Hat Quay flaws expose private images and tenant tokens
Red Hat Quay has two critical flaws that…
Updated 7 minutes ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
PowerShell 7.7 adds .NET 11 support and new admin features
PowerShell 7.7 is generally available with a .NET 11 base, new commands, stronger security protections, and several breaking changes. It is the next Standard Term Support release, and PowerShell 7.6 was based on .NET 10. PowerShell 7.7 release details PowerShell 7.7 continues the alignment between PowerShell and .NET releases. The update shifts the utility onto .NET 11 and keeps its focus on security improvements, broader command support, and higher reliability.…
Windows updates tighten NTLM signing in phased enforcement
Microsoft is adding phased NTLM signing enforcement in Windows after the latest Patch Tuesday updates. The change comes alongside protections against CVE-2026-118737, a critical severity vulnerability tied to remote code execution on a network through improper verification of a cryptographic signature in Windows Remote Procedure Call Runtime. NTLM changes in Windows Microsoft has been phasing out NTLM authentication in Windows in favor of Kerberos-based alternatives over the past few years.…
eMudhra revokes eight more CA certificates after key handling flaws
eMudhra has revoked eight additional intermediate CA certificates after an investigation into its certificate security incident found improper handling of private keys during certificate generation. The new revocations bring the total affected intermediate CA certificates to 16, and the company says the incident also exposed an earlier warning sign that went unchecked for more than a year. Additional certificate revocations The newly revoked set consists of eight RSA intermediate CA…
Windows 11 update tightens PowerShell script checks
Microsoft’s November Patch Tuesday update KB5132061 adds stricter text-encoding validation for PowerShell script signing and signature verification. Older scripts that were signed before this change can fail if they contain invalid text encoding, including malformed UTF-8. PowerShell signing checks change in KB5132061 Microsoft released its November batch of Patch Tuesday updates earlier this week, bringing the usual security fixes and improvements to Windows 11. One change in the release notes…
Windows SignDrop exploit exposes a local SYSTEM escalation claim
A public Windows exploit called SignDrop targets a security feature meant to stop attacks on the Common Log File System, or CLFS. It claims that a normal user account can be turned into a SYSTEM account, which is the highest level of control on Windows. The flaw has no CVE number and no patch as of November 11, 2026. Microsoft has also not confirmed the claims. SignDrop and its public…
Microsoft fixes Exchange sign-ins broken by Windows Server updates
Microsoft has resolved Outlook sign-in and mail delivery problems on Exchange Server systems that appeared after the October 2026 Windows Server security updates. The issue affected some on-premises Exchange servers, and Microsoft said in mid-October that the impact varied by server load. Exchange sign-ins and mail flow after October updates Microsoft said the sign-in and mail delivery failures came from a new default memory limit for Endpoint Mapper when it…
Cisco BroadWorks flaw enters CISA’s actively exploited catalog
The US Cybersecurity and Infrastructure Security Agency has marked a high-severity Cisco BroadWorks vulnerability as actively exploited in attacks. Cisco BroadWorks is a cloud unified communications platform used by telecom carriers and managed service providers to offer branded cloud PBX, voice, and collaboration services to business customers. CISA’s new warning centers on CVE-2026-20320, which stems from improper restriction of an XML External Entity reference weakness in the Open Client Interface…
Windows Remote Desktop flaws let attackers run code through client connections
Microsoft has released security updates for four Windows Remote Desktop Client vulnerabilities that can let attackers run code through network connections or local access. Published on November 10, 2026, the issues include memory handling errors and a race condition, and three of them use network attack paths while the fourth depends on existing local access. Affected Windows Remote Desktop clients Microsoft’s highest-scoring issue, CVE-2026-119934, has a CVSS score of 8.8…
Git patches six flaws that can let malicious repositories run code
The Git project has patched six vulnerabilities, including a high-severity flaw that can let malicious repositories execute code during recursive cloning. The fixes were announced on November 10, 2026, and they cover unsafe file writes and memory corruption in merges, patches, and fast-import handling. Git vulnerability fixes roll out across release lines The patches ship in Git 2.56.1 and were also backported to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2.…
Windows BitLocker flaws let attackers bypass device encryption
Microsoft has disclosed two Windows BitLocker security feature bypass vulnerabilities that could let attackers with physical access weaken device protections. The issues are tracked as CVE-2026-97015 and CVE-2026-119832, and Microsoft rates both as Important. Physical access and privilege requirements CVE-2026-119832 can let a successful attacker bypass BitLocker Device Encryption on the system storage device and reach encrypted data. The attack requires physical access and basic user privileges, but it does…
Claude Code helped reveal a hidden malware trigger in an AI model
Microsoft researchers used Claude Code running Opus 4.5 to uncover the Lazarus backdoor technique, which can turn an otherwise capable AI model into a sleeper agent by changing fewer than 10 dormant neurons. The model can still pass standard evaluations and behave normally during routine tasks, and Microsoft said the finding exposes a gap for organizations that give AI agents access to terminals, files, and credentials. How Lazarus hides in…
Nitori says a breach may have exposed 37.62 million records
Nitori, a major Japanese furniture and home accessories retailer, says an unauthorized party may have obtained up to 37.62 million customer records from a system on its network. The company detected the intrusion on November 6 and blocked the access, but its investigation says the attacker may have been inside the system since mid-October. Company records and customer data Nitori, also called the “IKEA of Japan,” operates 879 stores in…