Critical LoadMaster Command Injection Is Under Active Attack, Patch Now
If you run Progress LoadMaster (or the Kemp-branded versions of it), this is a patch-this-week story, not a note-for-later story. CISA has confirmed that a critical command injection vulnerability in the load balancer is being actively exploited in the wild, and the agency has added it to the Known Exploited Vulnerabilities catalog. That KEV listing […]
Microsoft Fabric Flips Item Recovery On By Default, and That Is a Good Thing
Microsoft is about to make a quiet change to Fabric that most tenants will never notice, but it will save a few of them from real pain. Starting August 23, 2026, Fabric will enable Item Recovery by default for any tenant that has not explicitly configured the setting. For supported item types, that means a […]
Mythos Attack Breaks a Post-Quantum Crypto Candidate, and the Lesson Is Uneasy
Late last month a team of cryptographers took a post-quantum signature scheme out of contention before it ever shipped, and they did it with an attack that left the research community quietly reassessing how much trust to place in the standards pipeline. The scheme was HAWK, a lattice-based digital signature candidate that had made it […]
TrueConf Servers Hijacked to Push Backdoored Installers
Video conferencing vendor TrueConf has confirmed a supply chain attack in which hackers hijacked servers and swapped legitimate client installers for backdoored versions. The intrusions, attributed by Kaspersky to the hacktivist group Head Mare, targeted unpatched TrueConf servers and used them to hand malicious software to anyone who downloaded the client. The attack is a […]
Januscape: The 16-Year-Old KVM Flaw That Earned a $250K Bounty
Google handed out $250,000 for a Linux kernel vulnerability that had been hiding in plain sight for 16 years. Named Januscape and tracked as CVE-2026-53359, the flaw is a use-after-free bug in the KVM hypervisor’s shadow MMU code. It lets a guest virtual machine escape to the host, and it is the first KVM exploit […]
LegacyHive Zero-Day Bypasses July’s Record Patch Tuesday
Microsoft shipped its largest Patch Tuesday in history on July 14, 2026, fixing 622 CVEs. Within hours, a security researcher released a proof-of-concept for a Windows privilege escalation bug that the massive update did not fix. Named LegacyHive, the exploit targets the Windows User Profile Service and lets a standard user reach administrator privileges on […]
Sheetz is moving 11,000 VMs off VMware after Broadcom’s licensing changes
Sheetz, the Pennsylvania-based convenience store chain with more than 800 locations across the eastern US, is packing up 11,000 virtual machines and leaving VMware. The company is moving its entire virtualization estate over to StorMagic’s SvHCI platform, and the decision came down to a simple reason: Broadcom created too much uncertainty. The migration is a […]
Metabase SQL injection zero-day is being exploited for data theft
A critical Metabase vulnerability is being actively exploited in the wild to steal customer data, and at least two well-known companies have already confirmed they were hit. Framework Computer and the accounting platform Tally both disclosed breaches tied to the flaw, which is an unauthenticated SQL injection in Metabase versions 1.58 and newer. If you […]
Shopify swapped Redis for MySQL and its inventory reservations scaled
Shopify moved the inventory reservation system that backs its checkout flow off Redis and onto MySQL, and the migration held up through a Black Friday peak. The engineering team wrote up the details on the Shopify Engineering blog, and the writeup is worth reading if you run anything with hot rows and high contention. The […]
The decade-long hole in Microsoft Secure Boot and what to do about it
Security researchers at ESET have detailed a hole in Microsoft Secure Boot that was quietly exploitable for over a decade. The finding is uncomfortable because Secure Boot is one of the foundational trust mechanisms on modern PCs, and the bypass hinges on eleven old firmware shims that Microsoft still signed and that UEFI systems continued […]
pgrust shows Postgres can catch up on analytics with batching and SIMD
A Rust-based Postgres rewrite called pgrust has been making the rounds, and its claim is hard to ignore: it runs analytical queries hundreds of times faster than stock Postgres. The author’s write-up walks through how, and the techniques are refreshingly concrete. This is not a vaporware benchmark grab, it is a working implementation that passes […]
OpenAI’s GPT-5.6 upgrade brings better accuracy and free unlimited chats
OpenAI shipped a meaningful upgrade to ChatGPT this week, and the headline is simple: most of it lands for free users too. The company introduced GPT-5.6 Sol for Plus and Pro subscribers, made GPT-5.6 Luna the default for Free and Go tiers, and gave everyone a couple of new controls over how the model reasons. […]