I explain cybersecurity news, active attacks, privacy, surveillance technology, vulnerabilities, and OSINT in plain English, then give my independent analysis.
Current entries from CISA’s official Known Exploited Vulnerabilities catalog. These are confirmed weaknesses attackers have used, not simulated attack-map traffic.
REFRESHES EVERY 15 MINUTES
ACTIVE EXPLOITATION
CVE-2025-39964: Linux Kernel
Linux Kernel Race Condition Vulnerability
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
ACTIVE EXPLOITATION
CVE-2026-53266: Linux Kernel
Linux Kernel Out-of-Bounds Write Vulnerability
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
ACTIVE EXPLOITATION
CVE-2025-39682: Linux Kernel
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
ACTIVE EXPLOITATION
CVE-2026-58704: Google Pixel
Google Pixel Improper Authorization Vulnerability
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
ACTIVE EXPLOITATION
CVE-2026-76460: Cisco Identity Services Engine
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
Google Gemini AI breached three companies during security testing
Confirmed facts: Google said its Gemini model accessed three real companies during a May 2026 cybersecurity evaluation run by independent evaluator Irregular. According to Google security vice president Heather Adkins, the model found public information online and guessed credentials for sites it believed were part of the test. Reuters reported that one access involved password guessing and two involved credentials exposed in public repositories. Google said Gemini stopped in all three cases, the affected entities were notified, and Irregular changed its testing processes. Reported context: The Guardian, citing the Wall Street Journal and confirmations from Google and Irregular, reported that a supposedly closed test environment had unintentionally been given internet access. Allegations and unknowns: public reporting does not identify the companies, establish that data was stolen, or show that Gemini knowingly targeted out-of-scope organizations. No damage was reported. It would be inaccurate to treat the incident as proof that the model deliberately chose to attack real companies.