Polymarket’s Third-Party Breach: How Malicious Scripts Drained Wallets and What Traders Should Do Next
Polymarket suffered a security incident on October 29,…
Updated 5 minutes ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
Linux TCP use-after-free (CVE-2026-98432): Anthropic’s exploit, vendor status, and what admins should do
A serious race-condition bug in the Linux kernel’s IPv4 TCP path, tracked as CVE-2026-98432, has drawn attention because the kernel team rated it 9.8/10 on the CVSS scale and because Anthropic says its AI model wrote an exploit that achieved root command execution against servers running a multipath TCP (MPTCP) listener. Vendors and distributions have diverging severity scores and staggered patch timelines, leaving many administrators deciding whether to wait for…
Invisible Texts, Visible Damage: Inside Android’s “SMS of Death” Zero-Click Flaw
A recently disclosed zero-click vulnerability—dubbed the "SMS of Death"—can render Android phones partially or wholly unusable with a single, malformed WAP Push message. The exploit leaves no trace in the user’s inbox, can drop active calls, and in some tests caused persistent loss of telephony that survived reboots and even factory resets until carriers’ retry behavior was addressed. How the flaw works The bug resides in WapPushOverSms.decodeWapPdu(), the Android routine…
Microsoft’s Passkey Push: What Entra ID Admins Need to Know
Microsoft has told Entra ID administrators to prepare for the retirement of Microsoft-provided SMS and voice authentication and to migrate users to passkeys before the change takes effect on February 1, 2027. The reminder, posted as Message Center notice MC1528000 on October 27, reinforces earlier guidance and covers Worldwide and Government Community Cloud tenants. Administrators are being encouraged not to wait until the retirement reaches their tenant before preparing affected…
Claude-written exploit exposes critical Linux kernel race, patches and uncertain attack path
Anthropic’s Frontier Red Team disclosed a striking research result: an unreleased Claude model produced a working exploit for a critical Linux kernel vulnerability tracked as CVE-2026-98432. According to Anthropic, the proof-of-concept lets a remote attacker run commands as root without a login or user interaction. The company treated the work as a lab test and said the underlying bug has been fixed upstream and backported to maintained kernel branches—but distribution…
Seven Critical Firebox Flaws in WatchGuard Fireware Could Allow Remote Code Execution
WatchGuard disclosed a set of serious vulnerabilities in Fireware OS on October 27, 2026, revealing seven critical defects that, in some cases, allow remote code execution or root-level actions without prior authentication. The advisory is part of a broader release covering 18 security issues across Fireware OS and the Windows Mobile VPN with SSL client, with the seven critical entries carrying CVSS scores between 9.1 and 9.5. Where noted, attackers…
Warp Panda Abused VMware ESX Logging Flaw to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog after researchers linked the flaw to active exploitation by a China-nexus threat actor known as Warp Panda. CrowdStrike’s reporting indicates the adversary used the vulnerability as a zero-day in early 2026 to limit audit logging, enabling covert and persistent access in targeted environments—most notably in the U.S. legal sector. The vulnerability: CVE-2026-41709…
WordPress 7.1.4: Urgent Patch Fixes 22 Flaws, Including an Unauthenticated Update-Time RCE
WordPress pushed out version 7.1.4 on October 28, 2026, closing 22 security flaws and urging site owners to update immediately. The release addresses a range of issues from an unauthenticated remote code execution risk in the update process to multiple stored cross-site scripting and access-control problems. With fixes spanning recent and older branches, the update is a reminder that timely patching remains critical for every WordPress site. The unauthenticated update-time…
GitHub Copilot Fusion: Smarter Model Routing for Faster, Cheaper Coding
GitHub has introduced Copilot Fusion, a model-routing system that automatically selects and coordinates AI models to handle coding tasks. Rather than forcing developers to pick a specific model for each request, users can choose Fusion and let it decide which models and execution patterns will best balance code quality, speed, and cost for the job. Fusion is available generally in Visual Studio Code, Copilot CLI, the GitHub Copilot app, and…
How 319 Chrome Extensions Redirected Searches and What It Means for Users and SOCs
A sprawling network of 319 browser extensions has been tied to search hijacking that affected an estimated 13.4 million users over the past decade. Marketed as benign utilities — PDF converters, safe search tools, finders, and AI helpers — these add-ons quietly routed user queries through operator-controlled servers before forwarding results to mainstream engines such as Yahoo or Bing. The result: referral revenue for operators, a persistent intermediary with visibility…
Microsoft’s Azure Fuels Record $92.3 Billion Quarter as Cloud and AI Lead Growth
Microsoft reported a landmark quarter, posting $92.3 billion in revenue for the first quarter of fiscal year 2027. The company’s cloud and AI investments — particularly Azure — drove the surge, offsetting weaker performance in Windows and Xbox. Operating income rose 21% to $45.9 billion, and net income jumped 32% to $36.6 billion, with Microsoft noting that investments in OpenAI affected the headline figure. Quarterly highlights Azure emerged as the…
Cisco Patches CVE-2026-76418 as SSL VPN Flaw Crashes ASA and FTD Devices
Cisco has released security updates for a high‑severity zero‑day, CVE-2026-76418, after its Product Security Incident Response Team observed active exploitation in October 2026. The flaw allows unauthenticated remote attackers to trigger unexpected device restarts in Secure Firewall ASA and FTD software, causing denial-of-service and disruption of remote access. Cisco assigned the vulnerability a CVSS score of 8.6 and published its advisory on October 28, 2026. The issue was discovered by…
KB5127653: What Windows 11 26H1’s big preview update actually brings
Microsoft has released KB5127653, the preview update for Windows 11 version 26H1 (OS Build 28000.3365), and it’s packed with a broad mix of quality-of-life refinements, new features, and bug fixes. Some changes overlap with recent preview releases for 25H2 and 26H2 (notably KB5127936), but KB5127653 also contains several enhancements unique to 26H1. Keep in mind that Windows 11 version 26H1 is currently available only on select new devices with supported…