Feed aggregator

The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild.

The post SharePoint Vulnerability Exploited Shortly After PoC Release appeared first on SecurityWeek.

Researchers have found three vulnerabilities in the popular Zoom meeting platform that could let one meeting participant attack another through malicious collaboration data.

The vulnerabilities, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, affect the code Zoom uses to process annotation data shared during meetings. The researchers named the set of flaws “Zoomsday.”

Affected applications are:

• Zoom Workplace on all supported platforms before version 7.1.5 and 7.0.6, depending on the release branch
• Zoom Workplace VDI Client for Windows before versions 7.0.11 and 6.6.16, depending on the release branch
• Zoom Rooms on all supported platforms before version 7.1.5
• Zoom Meeting SDK on all supported platforms before version 7.1.5

What can happen

What this means is that someone in the same Zoom meeting could send data that the Zoom app was not prepared to handle. Instead of simply displaying a drawing, text box, or other annotation, a vulnerable client could be tricked into crashing, leaking information, or even running attacker-controlled code.

Annotation features sound simple, but the underlying process is not. Your Zoom client receives structured data from another participant and turns that data into an object it can display on screen. According to the research, the annotation parser contained several memory-safety bugs. Like any software that processes data supplied by a third party, it has to be very careful about validating lengths, counts, and references before using them.

Remarkably, there is a discrepancy between the severity ratings assigned by the researchers, who rated them as Critical, and Zoom, which rated them as High.

The difference appears to come down to how the vulnerabilities are scored under the Common Vulnerability Scoring System (CVSS score). Zoom considers successful exploitation to require user interaction.

In practice, an attacker would first need to get into the same meeting as the intended victim. That could mean joining an open meeting, abusing a leaked meeting link, posing as an expected attendee, or compromising an account that already has access. Zoom considers it user interaction if the attacker persuades the target to join a meeting with the intent to compromise their machine.

How to stay safe

Zoom has published a security bulletin explaining which programs need to be updated and where to find the fixed versions.

To protect yourself from Zoomsday and have safe meetings:

• Update Zoom to the latest version as soon as possible.
• Restrict who can join your Zoom meetings. Use passcodes, waiting rooms, authenticated-user restrictions, and unique meeting links for sensitive calls.
• If features like annotation, whiteboards, remote control, file transfer, or third-party apps are not needed, consider turning them off, especially for meetings that have an open invitation nature.
• One crashed meeting is not proof of an attack, but if it happens on a regular basis, it’s worth investigating.
• Use an up-to-date, real-time anti-malware solution to block malicious code on your devices.
• Organizations should also check their device-management tools to make sure every deployed Zoom client is receiving updates.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

I'm a backend developer working with high-load services and databases. One ClickHouse node I operate holds 3.42 TiB compressed and 19.10 TiB uncompressed across its active parts. I built ProbeDeck to inspect a cluster and handle a few operations from an iPhone or iPad when I don't have a laptop.

The app turns ClickHouse system tables into screens for running queries, replica state, storage pressure, and mutations. It derives QPS from system.metric_log and shows no value when that log is disabled. You can inspect a target before sending KILL QUERY or KILL MUTATION. The KILL screens use a confirmation sheet. Destructive SQL in the editor adds a typed confirmation.

The phone sends ClickHouse HTTP or HTTPS traffic straight to the server, or through one SSH bastion. ProbeDeck does not relay database traffic. It stores passwords, SSH private keys, TLS client material, and AI API keys in the iOS Data Protection Keychain. It keeps non-secret connection metadata in app settings. SSH authentication accepts a password or an unencrypted OpenSSH Ed25519 private key.

The second first-run screen shows separate switches for anonymous Aptabase analytics and Sentry crash/error reports. Both start on. You can turn either one off on that screen or in Settings. The AI assistant sends requests to the Ollama or API provider you choose. It explains cluster state and drafts SQL; you decide whether to run it.

Explore demo data uses bundled data and skips ClickHouse and AI connections. Diagnostics still follow the two switches. The current version counts the demo as the single free saved connection, so you need to delete it before adding a real server.

ProbeDeck works in the foreground. It does not monitor the cluster while closed or send push notifications. Monitoring, schema browsing, and read SQL are free. A one-time $19.99 purchase unlocks KILL, writes, the AI assistant, and multiple saved connections.

Screenshots and connection details are at https://probedeck.app/

I'd like feedback on the boundary: which checks and actions belong on a phone during an incident?

ClickHouse is a registered trademark of ClickHouse, Inc. ProbeDeck is not affiliated with, endorsed by, or sponsored by ClickHouse, Inc.

Comments URL: https://news.ycombinator.com/item?id=49272559

Points: 1

# Comments: 0

Article URL: https://danielmiessler.com/blog/where-watermarks-hide-in-text

Comments URL: https://news.ycombinator.com/item?id=49272558

Points: 1

# Comments: 0

Article URL: https://guillaumetech.github.io/posts/jpg-scaling-chrome/

Comments URL: https://news.ycombinator.com/item?id=49272549

Points: 1

# Comments: 0

Article URL: https://www.phoronix.com/news/QEMU-11.1-Released

Comments URL: https://news.ycombinator.com/item?id=49272542

Points: 1

# Comments: 0

Article URL: https://github.com/mbuchel/sass2mlir-bench

Comments URL: https://news.ycombinator.com/item?id=49272536

Points: 1

# Comments: 1

Article URL: https://huggingface.co/Qwen/Qwen3.8-27B

Comments URL: https://news.ycombinator.com/item?id=49272534

Points: 1

# Comments: 0

Article URL: https://wesmckinney.com/blog/agentic-engineering-aug-2026/

Comments URL: https://news.ycombinator.com/item?id=49272531

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=49272514

Points: 1

# Comments: 0

Article URL: https://cordhq.app/

Comments URL: https://news.ycombinator.com/item?id=49272486

Points: 1

# Comments: 0

A Liquidsoap-inspired audio streaming engine in Rust.

Comments URL: https://news.ycombinator.com/item?id=49272485

Points: 1

# Comments: 0

Article URL: https://chad.cm/posts/2026-8-11-my-agent-setup

Comments URL: https://news.ycombinator.com/item?id=49272484

Points: 2

# Comments: 0

Article URL: https://arxiv.org/abs/2605.19516

Comments URL: https://news.ycombinator.com/item?id=49272472

Points: 1

# Comments: 0

Article URL: https://www.phoronix.com/news/Linux-7.2-Reverting-DRM-Fair

Comments URL: https://news.ycombinator.com/item?id=49272467

Points: 1

# Comments: 0

Article URL: https://www.servethehome.com/minisforum-n5-max-review-with-amd-ryzen-ai-max-395/

Comments URL: https://news.ycombinator.com/item?id=49272450

Points: 1

# Comments: 0

Article URL: https://web.archive.org/web/20220823105749/http://blogs.tedneward.com/post/the-vietnam-of-computer-science/

Comments URL: https://news.ycombinator.com/item?id=49272430

Points: 1

# Comments: 0

Article URL: https://thehistoricalinsights.page/2026/07/giant-concrete-arrows-america-before-gps.html

Comments URL: https://news.ycombinator.com/item?id=49272420

Points: 1

# Comments: 0