John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
The 732-Byte Secret to Root: Everything You Know About Hardening Just Failed
Copy Fail (CVE-2026-31431) is a nine-year-old logic flaw that grants root on basically every Linux distro. It's tiny, it's reliable, and your file integrity monitors won't see a thing.
Read More
Your Antivirus Is Harvesting Passwords Now: BlueHammer Hits CISA KEV
The BlueHammer flaw has moved from a research curiosity to an active threat. This Windows Defender zero-day turns your security software into a password harvester by exploiting a race condition to steal credentials. CISA says patch now.
Read More
Management Planes: The Internet's Industrialized Front Door
Hackers have stopped chasing individual servers. They are after the tools that manage thousands of them at once. BeyondTrust, Palo Alto, and Cisco are the current bulls-eye.
Read More
The Switchboard Strike: Why CISA is Scrambling to Secure SD-WAN
CISA just issued an emergency order for federal agencies to hunt for Cisco SD-WAN exploits. It turns out a shadow campaign has been hijacking enterprise network switchboards since 2023. If you run a distributed network, the hunt is on.
Read More
Antivirus as a Weapon: The Defender Trilogy No One Can Patch
A single researcher has spent April taking Windows Defender apart. The results are a set of three zero-days that turn your antivirus into a malware delivery system and then blind it so it can't see the damage.
Read More
165 CVEs in One Day. Two Zero-Days. One Kerberos Bug That Should Have Your Full Attention.
Microsoft dropped 165 CVEs today including two zero-days, a critical Kerberos credential relay vulnerability, and a FortiClient EMS flaw with a 48-hour CISA deadline. Here's how to prioritize.
Read More
Adobe Reader Had a Zero-Day in the Wild for Four Months Before Anyone Patched It
CVE-2026-34621 was sitting in the wild since November 2025. Adobe patched it in April 2026. That's a four-month window where opening the wrong PDF could get you owned.
Read More
China's Ransomware Groups Are Using Zero-Days Now. That Changes the Math.
Microsoft links China-based Storm-1175 to Medusa ransomware using zero-day exploits, while Qilin deploys EDR-killing techniques before encryption.
Read More
A Disgruntled Researcher Just Handed Every Attacker a Free Windows Privilege Escalation Exploit
A frustrated researcher publicly released BlueHammer, a working Windows privilege escalation zero-day, after clashing with Microsoft's disclosure process.
Read More
The AI That Found Every Bug: Anthropic's Mythos, Project Glasswing, and the End of Security as We Know It
Read More
Update Chrome Now. Update FortiClient Now. Here's Why.
Two critical vulnerabilities are being actively exploited right now: a Chrome WebGPU zero-day and a Fortinet pre-auth privilege escalation, and both have patches available today.
Read More
A Zero-Day Turned TrueConf's Update Channel Into a Malware Delivery System
Chinese-nexus actors exploited a zero-day in TrueConf to hijack the update mechanism and push trojanized updates to Southeast Asian government agencies.
Read More
Interlock Ransomware Had a Cisco Firewall Zero-Day Before Anyone Knew It Existed
The Interlock ransomware group exploited a critical Cisco ASA/FTD zero-day for weeks before disclosure, marking a real shift as criminal groups gain access to capabilities once reserved for nation-states.
Read More
Update Everything: Chrome Zero-Days, Android's March Bulletin, and the Patch Gap That Puts You at Risk
Two Chrome zero-days under active attack, 129 Android vulnerabilities in March, and the stubborn reality that 'patch available' and 'you're protected' are two very different things.
Read More
iPhone Exploit Kits Go Mainstream: DarkSword, Coruna, and the End of 'iOS Is Enough'
New research from Google, iVerify, and Lookout confirms iOS exploit kits have moved from rare targeted spyware to website-level deployment against broad populations. A companion toolkit was found targeting US government officials specifically.
Read More
Mobile Trust Is Fracturing: Android Fraudware and iOS Exploit Chains Converge
Perseus on Android, DarkSword on iOS, and new iPhone exploitation reporting point to a shared reality: mobile trust assumptions are breaking across both ecosystems.
Read More
Zero-Day by Default: Why Cisco FMC Should Reorder This Week's Patch Queue
Interlock operators have been exploiting a Cisco FMC zero-day since January. If you're still sorting patch queues by CVSS score, that's the problem.
Read More
Patch Chrome Now: Two Zero-Days Being Actively Exploited in the Wild
Google just patched two zero-days in Chrome 146 that were already being used in real attacks. Update now or stay exposed.
Read More
March Patch Tuesday: Two Zero-Days Already Public, Plus a SolarWinds Deadline That's Right Now
Microsoft patched 79+ flaws including two publicly disclosed zero-days. No confirmed active exploitation yet, which is rare. But the SolarWinds Web Help Desk CISA deadline is today, and 'publicly disclosed' means attackers already have the blueprints.
Read More
Patch Week From Hell: Microsoft, Adobe, SAP, and HPE All Drop Critical Fixes at Once
March 2026 might be the worst coordinated patching week in years. Microsoft, Adobe, SAP, and HPE all dropped critical fixes in the same 48-hour window. Here's what to patch first.
Read More