Everyone spent last week patching PHP2Shell. Meanwhile a second RCE, just as broad, was sitting in Google's Brotli compression code, used by every language on the internet. ⬇️

A root-trusted certificate authority generated a private key that was literally the number four. Not a metaphor: 4. The fallout is ending its entire TLS business. ⬇️

A ransomware crew ran its intrusions through commercial AI models and left the chat logs on an open server. 8,257 messages later, we can read exactly how a machine breaks into a company. ⬇️

Moderna lost about 24 billion dollars in market value in a day. Not after a hack: after its own trial results appeared online two days before the embargo lifted. ⬇️

The NSA's advice to every org running PHP this week: install the emergency update now, or take your systems offline until you can. Four governments chose offline. ⬇️

One hacker breached more than 100 companies in under a month. The toolkit: AI agents and roughly 5,000 dollars in tokens. Researchers watched it happen live, through the attacker's own dashboards. ⬇️

Six days before Serbia votes, Pegasus turned up on the phone of the university rector leading its protest movement. The prosecutor who probed Trump Tower Belgrade got a spyware warning too. ⬇️

A VM escaped toward its host through a few crafted IPv4 packets. CVE-2026-99999, aka PwnEscape, cracks the wall every shared cloud is built on. ⬇️

A hacker says he has 586,854 French sport shooters. Another is selling 1.2 million Italian ones, at 50 euros per weapon with the owner's details. The week's scariest data leaks are about guns. ⬇️

More than 400 AI researchers, Hinton and Bengio among them, just asked for frontier AI models to be born air-gapped. Their letter says the escapes have already started. ⬇️