Vulnerabilities

TotalRecall reveals how Recall’s AES-256-GCM encryption and Windows Hello protections fail once decrypted data reaches an unprotected process.

GitLab security update addresses CVE-2026-5173 and 11 flaws. This GitLab security update security patch fixes DoS and access risks in...

Forest Blizzard exploits SOHO router compromise to hijack DNS, intercept traffic, and launch AiTM attacks targeting enterprises and governments.

A ClickFix-style macOS attack uses Script Editor and an Apple-themed webpage to bypass Terminal protections and deploy malware.

Flowise RCE vulnerability CVE-2025-59528 is actively exploited, allowing attackers to execute arbitrary code on exposed systems worldwide.

CVE-2026-35616 and CVE-2026-21643 flaws in FortiClientEMS enable SQL Injection and RCE, with attackers actively exploiting them in real-world attacks.

The Chrome Stable Channel Update fixes 21 security vulnerabilities, including a high-risk code smuggling vulnerability actively exploited in the wild.

Leipzig University finds governments provide prevention advice but scarce recovery steps after a smart home breach, exposing Wi-Fi vulnerabilities.

CVE-2026-3055 in Citrix NetScaler exposes SAML IDP systems to memory overread attacks, with active reconnaissance already targeting vulnerable setups.

This week’s The Cyber Express roundup covers ransomware, AI risks, geopolitical threats, and key developments in global cybersecurity news.