The Edge of the Cyber World See the latest
AWS rolled out Lambda MicroVMs in June 2026, and it changes the calculus for anyone building interactive, multi-tenant, or AI-agent workloads on serverless infrastructure. Instead of the stateless, sub-15-minute request-response model that has defined Lambda since 2014, MicroVMs give each user or job a dedicated, VM-isolated compute environment that can hold state for up to…
A Bitcoin sidechain used by several major exchanges to move funds behind the scenes has just handed the crypto industry its biggest security scare of the second half of 2026. On September 6, an attacker withdrew roughly 4,000 BTC, worth about $320 million, from the federation reserve behind Blockstream’s Liquid Network. Within a day, most…
N-able shipped a fourth emergency hotfix for its N-central remote monitoring and management platform on September 6, 2026, after Huntress security researchers flagged CVE-2026-86218, a pre-authentication remote code execution flaw carrying the maximum possible severity score of 10.0. It is the third distinct N-central vulnerability disclosed inside six weeks, and the second time in three…
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. “Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences
The proof-of-concept (PoC) exploits lead to privilege escalation, spawning a shell with System privileges. The post Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits appeared first on SecurityWeek.
The StyleSmuggler zero-day allows attackers to execute code and deploy a stealthy backdoor on Adobe Commerce and Magento stores. The post Adobe Commerce Zero-Day Exploited to Backdoor Online Stores appeared first on SecurityWeek.
Three days after OpenAI shipped its most powerful model yet, the company’s own chief scientist told the public he isn’t sure anyone is ready for what comes next. GPT-6 Astra launched on September 3, 2026, and by September 6, Jakub Pachocki had published warnings that go well beyond the usual safety-page boilerplate. He wrote that…
Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able’s incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform,…
A TantoSec proof-of-concept turns an AES-CBC “padding oracle” in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild. Security firm TantoSec has published a working exploit chain…
SonicWall’s SMA1000 secure access gateways are under attack again. On September 1, 2026, the vendor disclosed two new vulnerabilities in its SMA 1000 Series, CVE-2026-83548 and CVE-2026-83549, and confirmed both were already being exploited in the wild before the patch shipped. It’s the second time in roughly seven weeks that attackers have found and weaponized…
