Toggle light / dark theme

Materials surrounding a fusion reaction can dramatically increase how often it occurs

Fusion at high temperatures powers the sun and, if harnessed, could provide a potential source of energy here on Earth. But controlling fusion reactions has other benefits. The process also generates subatomic particles called neutrons that are used in a range of applications spanning medicine, research and national security.

Scientists at the University of California, Davis, and the Department of Energy’s Lawrence Berkeley National Laboratory (Berkeley Lab) have found that the materials surrounding a fusion reaction can dramatically increase how often it occurs, particularly at low energies where fusion is rare. Their study is published in Nature Communications. The study’s first author is Micah Karahadian, a doctoral candidate in Munday’s lab at UC Davis.

Their approach establishes a way to study and engineer nuclear reactions within solid materials, opening a new field of “materials-driven fusion.” Instead of designing materials just to survive the harsh conditions of fusion, researchers might be able to design materials that boost the reaction under specific conditions, similar to the way catalysts speed up chemical processes.

Kimi K3 Agents Found Redis ZeroDays and Built RCE Exploit, Researchers Say

Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0.

All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis says the underlying memory flaws may lead to remote code execution.

Redis 6.2.23, 7.2.15, and 7.4.10 fix the Streams shared-NACK use-after-free; Redis 8.2.8, 8.4.5, and 8.6.5 fix both the Streams issue and the RedisBloom and TDigest out-of-bounds writes; Redis 8.8.1 fixes the RedisBloom and TDigest loaders, while the Streams guard was already present in Redis 8.8.0.

A petavoxel fragment of human cerebral cortex reconstructed at nanoscale resolution

From the article:

“In a 2024 Science study, researchers performed a high-resolution EM reconstruction of the ultrastructure of a cubic millimeter of human temporal cortex. According to the authors, the reconstruction contains roughly 57,000 cells, about 230 millimeters of blood vessels, and nearly 150 million synapses, comprising 1,400 terabytes of data.”


This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

Why Modern SOCs Need MultiLayered Detections

Endpoint, identity, and cloud platforms each offer a valuable perspective on corporate security. Host tools track processes in memory, identity solutions monitor credentials, and cloud environments log configuration changes. While each source provides visibility, these systems operate in isolation, leaving gaps in visibility that attackers can easily exploit.

Each tool sees only its fragment of the attack chain. Threat actors can compromise a workstation, leverage blind spots between endpoint and identity systems to hide credential theft, move laterally into cloud infrastructure, and exfiltrate data before the SOC is aware. That is why unified, correlated telemetry across these domains is essential to revealing the full picture.

Network Detection and Response (NDR), validates, enriches, and connects these separate signals using network data. Because it’s collected out of band, the data remains immutable even when local agents go dark or when threat actors disable endpoint tools. And because it captures traffic across the entire enterprise, NDR provides vital context, recording every conversation, transaction, and data transfer, delivering the undeniable proof defenders require to respond.

Windows LegacyHive zero-day flaw gets free, unofficial patches

Free unofficial patches are available for a recently disclosed Windows zero-day flaw that allows attackers to escalate privileges on up-to-date Windows systems.

The vulnerability (dubbed LegacyHive and without a CVE ID for easy tracking) was found by a security researcher using the “Nightmare Eclipse” handle in the Windows User Profile Service.

Nightmare Eclipse disclosed it the day Microsoft released its July 2026 Patch Tuesday updates, together with a stripped proof-of-concept exploit designed to make it harder for threat actors to weaponize this security issue in attacks.

Critical wp2shell WordPress flaws exploited to install webshells

Hackers are exploiting the “wp2shell” critical vulnerability suite (CVE-2026–63030 and CVE-2026–60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.

The critical exploit chain abuses the WordPress REST API’s batch-processing feature, allowing remote attackers to execute code on vulnerable installations without the need to authenticate.

Although the technical details were not released, proof-of-concept exploits started to emerge over the weekend, shortly after threat intelligence and cyber risk management company SearchLight Cyber disclosed the wp2shell security issue.

Mythos Didn’t Break Your Security Program. Your Exposure Window Could

The industry spent the initial months after Anthropic’s April 7 Mythos reveal focused on volume. How many new CVEs would Mythos add to an already overloaded pipeline? How quickly would the flood of AI-driven discovery overwhelm triage capabilities? How long would it take adversaries to weaponize Mythos findings at scale? Those questions were and remain valid. Yet they all stop short of addressing the single metric that determines whether any of those vulnerabilities actually lead to a breach: the exposure window.

The exposure window — the gap between the moment a vulnerability becomes exploitable and the moment your team fixes it — is the time an attacker has to do actual damage. That window is currently open far too wide. In 2025, the average eCrime breakout time dropped to 29 minutes. Even PCI DSS — the strictest compliance framework in the industry — allows 30 days to remediate a critical vulnerability. That’s a 1,000-to-1 gap between how fast attackers move and how fast organizations are expected to respond. And the stick propping this exposure window open? Mobilization — the ownership, remediation, and organizational complexity that lowers response times and raises risk.

In this article, I’ll walk through why the exposure window is now the metric that matters most, what keeps it open, and how AI-driven discovery is forcing proactive security teams to adopt the speed-based metrics that SOC teams have used for years.

New 7Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

26.02 subtracts the bytes already written and bails out if that running total ever exceeds the buffer. The same flawed length handling appears unchanged in 7-Zip source back to at least version 21.07 (2021), though neither ZDI nor 7-Zip has said which releases are actually exploitable.

CVE-2026–14266 is the latest in a run of memory-safety bugs in 7-Zip’s archive handlers. On April 27, version 26.01 fixed a batch of them, including the higher-scored CVE-2026–48095, an NTFS-handler heap-write overflow that GitHub Security Lab detailed on May 22 with a working proof-of-concept. The XZ flaw is the quieter of the two so far, and 26.02 rolls up every one of these fixes, so one update covers them all.

So update to 7-Zip 26.02 or later on every machine that opens archives from outside. Updating is a manual install from the official site, so set-and-forget machines will not pick it up on their own. Any product that ships a vulnerable copy of 7-Zip’s XZ decoder needs its own vendor fix.

WordPress Core “wp2shell” RCE flaws get public exploits, patch now

Public exploits have been released for the critical “wp2shell” remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately.

The wp2shell attack consists of two flaws, tracked as CVE-2026–63030 and CVE-2026–60137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.

The flaws were discovered by Adam Kues of Searchlight Cyber, which says an unauthenticated attacker can exploit them against a default WordPress installation.

New Windows LegacyHive zero-day gives hackers admin privileges

A security researcher using the “Nightmare Eclipse” handle has released a Windows zero-day exploit dubbed LegacyHive that allows attackers to escalate privileges on up-to-date Windows systems.

Nightmare Eclipse published a proof-of-concept (PoC) exploit hours after Microsoft released its July 2026 Patch Tuesday updates, saying that it abuses a security vulnerability in the Windows User Profile Service, which has yet to receive a CVE ID for easier tracking.

However, unlike previous exploits released by NightmwareEclipse, the LegacyHive PoC has been modified to require additional credentials, making it harder for attackers to weaponize the vulnerability.

/* */