Sony Network Communications says 2,585,481 So-net and plala member records were exposed, alongside 54,401 separate email credential records. Here is what was disclosed, what customers should do, and what remains unknown.
Two MyReport Updater flaws can turn reachable gRPC access or a local foothold into SYSTEM control. Check versions, TCP 9095 exposure, egress and the updater service now.
Apple’s iOS 27.2 and iPadOS 27.2 advisory contains 163 unique CVE records. Here is what that count means, who should update, and why the exploited iOS 18 backport is separate.
CVE-2026-80097 could let a malicious local Android app obtain Microsoft authentication tokens. Update Authenticator to 6.2606.4246 or later and review potentially exposed accounts.
Microsoft shipped out-of-band .NET fixes for CVE-2026-111497. Here is who is exposed, which versions are fixed, and why self-contained and NativeAOT apps must be rebuilt.
Tailscale has confirmed serious privilege-escalation issues affecting Tailscale SSH. Here is the confirmed exposure boundary, the vendor mitigation, and what remains unknown while a patched client is pending.
PHP rebuilt its official Windows 8.2–8.5 packages with Brotli 1.2.1. Check exact package provenance, the -1 rebuild suffix, and cURL decompression reachability.
CPython merged a defense-in-depth denylist for compromised eMudhra intermediate keys, but the captured sources do not establish a released fixed CPython version.
Cisco version 1.1 identifies impacted products, cloud-remediation states, upgrade targets and products still under investigation after the eMudhra CA-key compromise.
Keystone says unauthorized website access exposed customer shipping and order information. Its detailed report is still pending, so cause and full scope remain unresolved.
