This week’s news includes a Microsoft zero-day flaw and Yahoo’s recent email privacy snafu.

A Windows task scheduler API function does not check permissions – so any potential local bad actor can alter them to gain elevated privileges.

Changes in the group’s script may indicate that the hackers may start using attack vectors other than ActiveX.

The Zero Day Initiative said that the number of bugs reported in 2018 is on track to trump its previous busiest year, 2017.

Adobe patched the Flash Player vulnerability (CVE-2018-5002) earlier on Thursday.

A zero-day exploit targeting Adobe Flash Players has been reported by the South Korean Computer Emergency Response Team and confirmed by Adobe.

Researchers warn of copycat type attacks as exploit code used in Mirai variant goes public.

Exploit acquisition vendor Zerodium said Wednesday it will pay up to $1M for an unknown Tor Browser zero day.

Microsoft fixes 25 critical vulnerabilities including one zero day under attack and one tied to the high-profile BlueBorne attack vector.

An unnamed firm is paying up to $250,000 for vulnerabilities related to its virtualization platform.