Researchers built a working macOS kernel memory corruption exploit with AI help.
A group used Anthropic s Mythos AI model to help find a kernel memory corruption vulnerability and exploit on Apple s M5.
The research targeted Apple M5 hardware running macOS 26.4.1.
Google shipped Chrome 148 with fixes for multiple critical bugs. Attackers can trigger remote code execution simply by getting a victim to visit a malicious website.
CVE-2026-9111 is a use-after-free in WebRTC that lets code execution on Linux via crafted HTML. CVE-2026-9110 allows UI spoofing after renderer compromise on Windows. Both carry critical severity.
Update affects Windows/Mac at 148.0.7778.178/179 and Linux at 148.0.7778.178. Every Chrome user who browses untrusted sites needs the patch.
This release skipped the separately leaked Browser Fetch flaw that went public days earlier.
Two Microsoft Defender flaws are being exploited in the wild, including one privilege escalation bug and one denial-of-service bug.
CISA added seven vulnerabilities to its KEV catalog, including the two Defender ones. CVE-2026-41091 is rated CVSS 7.8 and can allow local privilege escalation to SYSTEM. CVE-2026-45498 is rated CVSS 4.0 and can disrupt Defender’s normal operation.
Affects Windows endpoints running current Defender versions across enterprises, home users, and managed services.
Seven total entries hit the catalog this week, with the Defender pair among the newest additions.
A contractor for CISA kept a public GitHub repo that exposed credentials for privileged AWS GovCloud accounts and many internal CISA systems.
The repo stayed live until this past weekend. Experts flagged it after the contractor left the project.
This was a serious exposure of highly privileged government cloud credentials. No sophisticated attack needed.
Credentials covered multiple highly privileged accounts and a large number of internal CISA systems.
Hackers stole Grafana's codebase and other data through a supply chain compromise at TanStack.
Attackers used a compromised token from the TanStack attack. They did not rotate it, giving them access to Grafana's GitHub repositories.
This shows how one breach can chain into others when tokens linger. Grafana joins downstream victims in the same supply chain incident.
Grafana confirmed the incident after the TanStack disclosure and said no customer production systems or operations were compromised.
Attackers used throwaway accounts to push malicious commits into over five thousand GitHub repositories in just six hours.
They forged author identities with names like build bot and ci bot, then injected malicious CI CD workflows that run on every push.
The campaign is fully automated and low effort, relying on volume rather than stealth or novel exploits.
Megalodon hit 5 561 repos with 5 718 malicious commits inside a single six-hour window.
Vulnerable Windows kernel drivers become usable from user mode without their original hardware attached.
Researchers mapped driver interfaces to let user-mode code trigger the same paths a real device would. They tested multiple common drivers that ship with Windows or third-party software.
This is genuine technical work, not a survey. It focuses on reversing the driver stack to simulate hardware responses rather than relying on vendor marketing claims.
The approach works for drivers developed for specific network cards or storage devices.