NewsCompaniesFlawsGuides
Get the app
Darling Harbour, Sydney
High Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet Read

Become to hack.

One app for your Mac, iPhone and browser. It steps in before a scam can move a cent.

Get early access Watch it stop a scam

This is how someone’s mum loses her savings.

No hacking skills needed. Just one ordinary Tuesday morning, a few messages, and a phone call that sounds exactly right.

  1. A text: “Hi Mum, I broke my phone. This is my new number.”

  2. A call in her daughter’s voice. It’s an AI copy.

  3. “The bank” calls: her money isn’t safe, it has to move today.

  4. She signs in on the link they text her.

  5. She lets them see her screen, “so they can help”.

  6. She moves $98,400 to a “safe account”. It’s gone.

In 2024, Australians reported losing $2.03 billion to scams. National Anti-Scam Centre

The HARD app

This is HARD: an app for your Mac and iPhone, and an extension for Chrome and Brave. Here’s every part of it, on real screens.

Home

Open HARD and the first thing you see is a short list of what to do, most urgent first, and what it stopped for you.

HARD on a Mac: four things that need you, ranked, and the fake sign-in pages it warned you off.
  1. Ranked by real attacks What attackers use goes first.
  2. One button to fix it It opens the right app.
  3. What it stopped Fake sign-in pages, this week.

Is this legit?

Paste a text, an email or a link, or tell it about the call you’re on. HARD says what it would do, and why.

Is this legit? on a Mac: a pasted “bank fraud team” message judged a scam, with the reasons and what to do.
  1. Or: I’m on a call Answer while they talk.
  2. Paste anything A text, an email, a link.
  3. A straight answer Scam or not, and exactly why.
  4. What to do now Three steps, in plain words.

Fake site protection

HARD knows where your passwords belong. Type one into the wrong site and it’s cleared before the page can send it.

Chrome on a fake file-sharing site: HARD says that was your Google password and it cleared it.
  1. Not Google A lookalike address.
  2. HARD in your browser Chrome and Brave.
  3. Your password, cleared Before the form could send it.
  4. Straight to the fix Change it on the real Google.

Payment pause

On your bank, a new payee or a large amount stops for six honest questions first. Scammers hate the wait.

A bank’s payment page in Chrome, paused by HARD: before this money goes, six questions to answer honestly.
  1. Before the money goes New payees and big amounts.
  2. Six honest questions The ones a scam can’t pass.
  3. Ten minutes to think Hang up. Call someone.

Live

Live shows every program online, how much it sent, and the company and country at the other end.

Live on a Mac: every program online, what it sent, and who it’s talking to.
  1. Every app online Checked every ten seconds.
  2. What it sent Big uploads get flagged.
  3. Who it talks to The company and the country.

Firewall

Pick how strict: keep a record of everything, get asked about anything new, or allow only what you’ve approved.

Firewall and DNS on a Mac: Secure DNS options, the Watch, Ask me and Lock down switch, and what’s always blocked.
  1. Watch Allowed, and recorded.
  2. Ask me When an app goes somewhere new.
  3. Lock down Only what you’ve allowed.
  4. Always blocked 392,000 phishing sites.

Secure DNS

Your Mac looks up every site by name. HARD encrypts those lookups, so the Wi-Fi you’re on can’t watch them or send you somewhere fake.

Firewall and DNS on a Mac: Secure DNS options, the Watch, Ask me and Lock down switch, and what’s always blocked.
  1. Private Nobody on the Wi-Fi sees it.
  2. Block malware Known bad sites never load.
  3. HARD DNS Our own filter. Coming.

Updates

Every app is checked for missing security fixes, ranked by whether attackers are using them right now.

Updates on a Mac: missing security fixes, the ones under attack first.
  1. Under attack now These go first.
  2. One click Opens the app to update.
  3. Hidden browsers Like the old Chrome in Slack.
  4. When you can No known attacks. No rush.

Wi-Fi devices

The TV, the cameras, the printer and the router, checked from your Mac for anything that would let someone in.

Wi-Fi devices on a Mac: the router checked against every published flaw, and what to fix.
  1. Your router Against every published flaw.
  2. What to fix And how, in plain words.
  3. Every device named TVs, printers, cameras, phones.

HARD for iPhone

Scam texts go to Junk before you see them. And when a familiar voice asks for money, a HARD code proves it’s really them.

HARD on iPhone: Is this legit?, HARD codes, and the scam-text filter.
HARD codes on iPhone: pair once in person, then ask for the code when someone asks for money.
  1. Is this legit? Paste it, or answer on a call.
  2. Scam-text filter On the phone. Nothing leaves it.
  3. Your HARD code A cloned voice can’t know it.
  4. Ask for it Before any money moves.

HARD Engineer

Ask HARD’s agent about any call, text or screenshot. One tap brings in a real person: your engineer.

Ask HARD on a Mac: a question about a “NAB fraud” call, HARD’s answer, and a person being brought in.
  1. Ask a person Your engineer reads the thread.
  2. Ask anything A call, a text, a screenshot.
  3. An answer in seconds From HARD’s agent.
  4. Send a screenshot Or a photo of the letter.
Get early access See more of HARD

Coming to iPad, Windows and Android.

A family home drawn as an architect’s cutaway model, open at the front, with its eight ways in marked: the router, the Wi-Fi, the cameras and doorbell, the smart TV, the smart locks and garage, the work laptop, everyone’s phones, and email above the roof.

Harden your home

Eight ways into every family home, and HARD watches each one.

Walk through the house in 3D

Engineer

Everything HARD does, on every device in every home, and a senior engineer of your own who acts on it.

US$2,750a month, or US$33,000 a year. By introduction.

  • HARD on every device

  • A two-week check-up

  • Your own engineer, on call

  • Help if you’re hacked

  • Every home’s network, secured

  • Watched around the clock

  • Your details, removed

  • Ask anything, any hour

See HARD Engineer Request an introduction

Pricing

The same app at every level. HARD Engineer adds people.

  1. Personal

    You, on every device.

    US$4 a month

    Billed yearly. Early access.

    • Mac, iPhone, Chrome and Brave
    • Scam checks for texts, calls and links
    • Fake sites stopped before they load
    • A pause before big payments
    Get early access

  2. Family

    Up to six people, parents included.

    US$7 a month

    Billed yearly. Early access.

    Get early access

  3. Engineer

    For families who can’t afford to get it wrong.

    US$2,750 a month

    Or US$33,000 a year. By introduction.

    • Everything in Family, in every home
    • A senior engineer of your own, on call
    • Every home’s network, secured
    • Recovery included
    See HARD Engineer

Compare plans

Running a team? HARD Business is US$9 a person a month. Business on the app page

Exploit calendar

Almost every working day, CISA, the US cybersecurity agency, confirms more software flaws that attackers are actively using. The HARD app checks your devices against this list every day.

Known exploited flaws

Each number is how many flaws CISA confirmed as being used in attacks that day. Stronger colour means more.

September – November 2026. Software flaws CISA confirmed as being used in attacks, by the day it confirmed them, 21 Sep 2026 to 1 Nov 2026. Pick a day to see its flaws.
MonTueWedThuFriSatSun
1 flaw 4 flaws 2 flaws 3 flaws 2 flaws
1 flaw 1 flaw 1 flaw 2 flaws 1 flaw
5 flaws
2 flaws 4 flaws 1 flaw 2 flaws
6 flaws 2 flaws
2 flaws 2 flaws 2 flaws 2 flaws 2 flaws Today
29 October: 2 flaws attackers were using

GitLab, Cisco

  1. GitLab Community Edition and Enterprise EditionCVE-2026-97229 · Integer overflow or wraparound
  2. Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-76418 · Unchecked return value to NULL pointer dereference
28 October: 2 flaws attackers were using

Linux, Broadcom

  1. Linux KernelCVE-2026-46300 · Missing initialization of a variable
  2. Broadcom VMware ESXCVE-2026-41709 · Insufficient logging
27 October: 2 flaws attackers were using

Google, Adobe

  1. Google BrotliCVE-2026-111497 · Unchecked return value
  2. Adobe Commerce and MagentoCVE-2026-48356 · Unrestricted upload of file with dangerous type
26 October: 2 flaws attackers were using

PHP Group ×2

  1. PHP Group PHPCVE-2026-109619 · Stale internal request-state
  2. PHP Group PHPCVE-2026-109618 · Memory corruption
23 October: 2 flaws attackers were using

Arista, Collabora

  1. Arista VeloCloud OrchestratorCVE-2026-114625 · SQL injection
  2. Collabora Online – Built-in CODE ServerCVE-2026-110447 · Online – built-in CODE server OS command injection
20 October: 6 flaws attackers were using

Plex ×4, Siemens, EG Secure Solutions

  1. Siemens Software CenterCVE-2026-110936 · Uncontrolled search path element
  2. EG Secure Solutions SiteGuard Server EditionCVE-2026-106931 · OS command injection
  3. Plex Media ServerCVE-2026-96656 · External control of file name or path
  4. Plex Media ServerCVE-2026-96655 · Server-side request forgery (SSRF)
  5. Plex Media ServerCVE-2026-96654 · Improper neutralization of encoded URI schemes in a web page
  6. Plex Media ServerCVE-2026-96652 · Server-side request forgery (SSRF)
16 October: 2 flaws attackers were using

BeyondTrust, Fortinet

  1. BeyondTrust Remote SupportCVE-2026-102764 · Authentication bypass by spoofing
  2. Fortinet Multiple ProductsCVE-2025-61624 · Path traversal
15 October: one flaw attackers were using

Atlassian

  1. Atlassian Multiple ProductsCVE-2026-21589 · Files or directories accessible to external parties
14 October: 4 flaws attackers were using

Ahsay ×2, Cisco, Palo Alto

  1. AhsayCBSCVE-2026-105134 · Command injection
  2. AhsayCBSCVE-2026-105133 · Improper authentication
  3. Cisco Secure Email GatewayCVE-2026-76519 · Relative path traversal
  4. Palo Alto Networks PAN-OSCVE-2026-0322 · Code injection
13 October: 2 flaws attackers were using

Ivanti, Microsoft

  1. Ivanti Connect SecureCVE-2026-104935 · Authentication bypass by spoofing
  2. Microsoft WindowsCVE-2026-96951 · Command injection
8 October: 5 flaws attackers were using

Strapi, ONLYOFFICE, Apache, ISC, ProFTPD

  1. StrapiCVE-2023-22894 · Cleartext storage of sensitive information
  2. ONLYOFFICE DocsCVE-2021-3199 · Server path traversal
  3. Apache StrutsCVE-2016-3081 · Command injection
  4. ISC BINDCVE-2015-5477 · Data processing errors
  5. ProFTPDCVE-2015-3306 · Improper access control
4 October: one flaw attackers were using

Citrix

  1. Citrix NetScalerCVE-2026-88779 · Improper restriction of operations within the bounds of a memory buffer
2 October: 2 flaws attackers were using

Zammad ×2

  1. Zammad GmbH ZammadCVE-2026-102490 · Improper privilege management
  2. Zammad GmbH ZammadCVE-2026-102489 · Session fixation
1 October: one flaw attackers were using

Fortinet

  1. Fortinet FortiMailCVE-2026-104286 · Path traversal
30 September: one flaw attackers were using

Cisco

  1. Cisco Catalyst SD-WAN ManagerCVE-2026-76504 · Hex encoding
29 September: one flaw attackers were using

Apple

  1. Apple Multiple ProductsCVE-2026-86950 · Out-of-bounds writeHARD’s advisory
27 September: 2 flaws attackers were using

Citrix ×2

  1. Citrix NetScalerCVE-2026-88772 · Improper restriction of operations within the bounds of a memory buffer
  2. Citrix NetScalerCVE-2026-88771 · Improper input validation
25 September: 3 flaws attackers were using

WordPress, MikroTik, Microsoft

  1. WordPress CoreCVE-2026-87902 · Remote file inclusion
  2. MikroTik RouterOSCVE-2026-67279 · Improper enforcement of behavioral workflow
  3. Microsoft SharePointCVE-2026-65660 · Code injection
24 September: 2 flaws attackers were using

Adobe, WSO2

  1. Adobe Commerce and MagentoCVE-2026-71362 · Incorrect authorization
  2. WSO2 Multiple ProductsCVE-2026-5430 · Path traversal
22 September: 4 flaws attackers were using

Check Point ×2, F5, Arista

  1. F5 BIG-IP APMCVE-2026-94127 · Heap-based buffer overflow
  2. Arista VeloCloud OrchestratorCVE-2026-93952 · Improper input validation
  3. Check Point Multiple ProductsCVE-2026-93616 · Path traversal
  4. Check Point Multiple ProductsCVE-2026-85102 · Improper certificate validation
21 September: one flaw attackers were using

Zyxel

  1. Zyxel GS1900 Series SwitchesCVE-2026-7273 · Stack-based buffer overflow
30 October: 2 flaws attackers were using

Ivanti ×2

  1. Ivanti Connect SecureCVE-2026-118527 · Generation of predictable numbers or identifiers
  2. Ivanti Connect SecureCVE-2026-111357 · Missing authentication for critical function
Last 30 days: 33 flaws from 25 companies, none yet tied to ransomware. Source: CISA’s Known Exploited Vulnerabilities catalog, updated 30 Oct 2026, 1,766 flaws in all.Open the lookup
When one matters to you, HARD sends an alert, in the Situation Room, by email or RSS. The stories behind them are in the journal, and what to do in the advisories.

The reference behind it

Everything HARD watches for is written up on hard.fyi, free: the Situation Room, every flaw being used in attacks, by company, advisories and the journal.