Cybersecurity

1,000+ Kiteworks MFT servers sit internet-exposed on Shodan — yet the company asked every customer to power down for 6–9 hours based on an unnamed law-enforcement threat. 🛑 No CVE. No exploit details. Two contradictory shutdown windows. One healthcare provider went dark anyway, leaving clinicians cut off from

The Pentagon took NINE months to notice intruders had accessed up to 4 million military personnel records — unencrypted. 🛡️ That's longer than a human pregnancy. Unencrypted SSNs, names, dates of birth, and job codes of people with high-level clearance, sitting in the digital equivalent of a glass house.

Meta's Muse exposed a local setting that lets malware redirect your Mac's cloud dictation to an attacker's server—reaching your iPhone, email, WhatsApp, and more. 🎙️ Researcher Patrick Wardle found the undocumented endo_voyager_dictation_endpoint in five days; no trojan or privilege escalation needed.

Ten ways to get root on a single router—and none needs a password. 🔐 Researcher Daniel Lim found 10 command-injection flaws across 10 CGI scripts in Prolink's PRC2402M. The login page itself passed input straight to shell. One "password check" compared your input to an

40+ unpatched flaws hit OpenSSL, the library encrypting ~1/3 of the internet—including remote code execution in PKCS7_verify(). 🔐 That's like finding roaches in the kitchen of a five-star restaurant: one library buried in load balancers, routers, and clouds everyone trusts. But here's the

Six CVEs. One codebase. The same root cause. In April 2019, Adobe patched 6 flaws (CVE-2019-7118–7123) clustered in Acrobat Reader's 2d.x3d module—the component rendering 3D content in PDFs 📄🔓 The trigger: an external texture image (shading_M.u3d) loaded inside a crafted 3D PDF.