Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass
In one of the cases we have investigated, a few hours after the user approved the request, the attacker signed...
Request
Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them,...
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
Ravie LakshmananJul 20, 2026Cybersecurity / Hacking A single request should not be able to do this much. But this week,...
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Swati KhandelwalJul 17, 2026Vulnerability / Web Security An anonymous HTTP request can run code on a WordPress site. The bug...
GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code
An AI coding assistant that refuses to answer a dangerous request in its chat box can answer it anyway if...
Edge browser leaves passwords exposed in plain text, says researcher
Microsoft did not respond to a request for comment. David Shipley, CEO of Beauceron Security, is not impressed with Microsoft’s...
