News Archives

Anthropic’s Claude Mythos uncovers thousands of zero-day defects across major platforms

Anthropic has launched Project Glasswing, using a preview of its new Claude Mythos model to uncover thousands of high-severity zero-day flaws across major operating systems and browsers. The initiative pairs Anthropic with industry leaders, commits substantial credits and donations, and follows recent accidental leaks and a patched vulnerability in Claude Code.

April 9, 2026

New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips

New research exposes GPUBreach, a set of GDDR6 RowHammer attacks that corrupt GPU page tables to gain arbitrary GPU memory R/W and, in some cases, full CPU root privileges even with IOMMU enabled.

April 7, 2026

36 Malicious npm Packages Abused Redis and PostgreSQL to Install Persistent Implants

Researchers found 36 malicious npm packages masquerading as Strapi plugins that exploit Redis and PostgreSQL to deliver reverse shells, harvest secrets, and install persistent implants.

April 5, 2026

Microsoft: Attackers Use Cookies to Control PHP Web Shells and Maintain Persistence via Cron on Linux Servers

Microsoft Defender researchers warn that threat actors are using HTTP cookies to control PHP web shells on Linux, pairing cookie-gated execution with cron-based persistence to maintain remote code execution while minimizing detection. Learn the attack patterns and mitigation steps.

April 3, 2026

New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released

Google has patched 21 Chrome vulnerabilities, including an actively exploited zero-day (CVE-2026-5281) in the Dawn WebGPU implementation. Update Chrome to the latest 146.0.7680.x releases and ensure other Chromium-based browsers receive vendor fixes.

April 2, 2026

Anthropic Says npm Packaging Mistake Exposed Claude Code Source

Anthropic says a packaging mistake caused the Claude Code source to be exposed via npm. The leak—discovered in a source map—revealed thousands of TypeScript files and internal systems, and has prompted warnings about supply-chain and typosquatting risks.

April 1, 2026