313 articles
Microsoft addressed 1,413 CVEs in its October 2026 Patch Tuesday, including a critical Windows zero-day exploited in the wild that bypasses Mark of the Web protections.
A heap buffer overflow in Ghostscript versions 9.21 through 10.07.1 allows unauthenticated remote code execution when processing malicious PDFs, affecting WordPress and other systems that render uploaded PDFs.
Attackers exploited a chain of three zero-days in Ivanti Connect Secure, including CVE-2026-104935, to bypass authentication and execute remote code before Ivanti issued a patch.
Microsoft's October 2026 Patch Tuesday update addresses more than 1,400 security flaws across Windows and related software, including two actively exploited zero-day vulnerabilities in Windows Shell and .NET Framework.
Microsoft's October 2026 Patch Tuesday addressed a record 1,411 security flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities, while ending support for Windows 11 24H2 and Windows 10 LTSB 2016.
A critical flaw in Docker Hub allowed attackers to hijack personal access tokens during account-to-organization conversion, enabling them to impersonate users and tamper with container images without consent.
Flock has been authorized to assign CVE IDs to vulnerabilities in its surveillance products, but experts question whether the company can be trusted to disclose flaws impartially given its history of law enforcement misuse and secrecy.
Citrix warns administrators to immediately patch NetScaler ADC and Gateway appliances configured as SAML IdP or SP due to a critical remote code execution flaw tracked as CVE-2026-107406.
Attackers are exploiting a maximum-severity SSRF vulnerability (CVE-2026-102255) in SonicWall SMA1000 appliances to access internal CouchDB services via unauthenticated requests.
Cisco patched over a dozen critical-severity vulnerabilities in products including Meraki, NX-OS, and APIC, with flaws allowing remote code execution, DoS, and unauthorized access without authentication.
Security researchers demonstrated three separate zero-day exploit chains against the Samsung Galaxy S26 on day two of Pwn2Own Ireland 2026, earning $232,500 in total awards.
tenfold’s free Community Edition now includes shared content governance and real-time event auditing features for organizations under 150 users.
Google has temporarily paused accepting product vulnerability submissions to its Open Source Software Vulnerability Reward Program due to a significant rise in invalid automated reports, effective October 1, 2026.
A critical path traversal vulnerability in Dell System Update CLI allows unauthenticated remote attackers to execute code with root privileges on unpatched systems.
Threat actors are actively exploiting CVE-2026-61500 in Rejetto HFS to bypass authentication and gain remote code execution by reversing the Math.random() PRNG to forge administrator session cookies.
CISA and Fortinet warn of a critical zero-day in FortiMail (CVE-2026-104286) being exploited in the wild, allowing arbitrary file write and potential remote code execution via HTTP/HTTPS requests.
Citrix has released emergency patches for CVE-2026-88779, a memory buffer flaw in NetScaler ADC and Gateway appliances using SAML authentication, which is being actively exploited in denial-of-service attacks and may allow remote code execution.
Attackers exploit weak identity verification during employee onboarding and service desk interactions to gain trusted access, bypassing even strong MFA and Zero Trust controls.
GitLab has released security updates for its AI Gateway service after discovering a critical remote code execution vulnerability that could allow authenticated users with Duo Agent Platform access to execute arbitrary commands.
Fortinet confirms CVE-2026-104286, a critical path traversal and null byte injection flaw in FortiMail, is being actively exploited in zero-day attacks to execute arbitrary code via unauthenticated HTTP requests.
CISA has issued an advisory warning of a critical pre-authentication remote code execution vulnerability in MikroTik RouterOS, tracked as CVE-2026-84411, affecting versions below 7.24 and allowing unauthenticated attackers to execute arbitrary code as root or cause denial of service.
Google's Threat Intelligence Group reports vulnerability disclosures reached 10,740 per month in August 2026, doubling from January levels, with AI accelerating the weaponization of known flaws.
Google's Threat Intelligence Group found AI-driven tools doubled monthly vulnerability disclosures in 2026 and accelerated exploitation of known flaws, though zero-day use rose only slightly.
OpenSSL and WolfSSL have released patches addressing dozens of vulnerabilities, including high-severity flaws that could allow remote attackers to leak heap memory, crash applications, or bypass authentication without user interaction.
Citrix confirmed active exploitation of two critical NetScaler zero-days after a weekend of unofficial warnings, releasing patches for CVEs-2026-88771 and -88772 amid criticism over delayed communication.
Citrix confirmed active exploitation of two critical zero-day vulnerabilities in NetScaler ADC and Gateway, prompting emergency patches and CISA KEV catalog additions.
Microsoft addressed 974 vulnerabilities in its September 2026 Patch Tuesday, its largest monthly update ever, including two actively exploited zero-days and 113 critical flaws.
Citrix confirmed that CVE-2026-88771 and CVE-2026-88772, two critical remote code execution flaws in NetScaler ADC and Gateway, are being actively exploited in the wild and has released security patches for affected versions.
CISA has added two critical vulnerabilities in WSO2 and Adobe Commerce to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply fixes by September 27.
Microsoft has paused the rollout of the optional KB5002907 update after users reported it deactivated or removed perpetual Office 2016 and 2019 installations, even though the update was intended only for outdated Microsoft 365 Apps.
Three flaws in Salesforce Agentforce, dubbed SalesBleed, allowed attackers to exfiltrate CRM data and distribute phishing messages through poisoned Web-to-Lead forms and Slack integration, with two enabling zero-click attacks.
Researchers show that file-change notification features in major operating systems can be exploited to monitor keystrokes, website visits, and file transfers without elevated privileges.
Archived code shows Australia's Medicare portal directed users to an unauthenticated endpoint, suggesting the OpenAI agent accessed data as intended, not through a hack.
Researchers found exposed GitLab project email addresses in public documentation that allow attackers to create issues and merge requests as legitimate users, bypassing IP restrictions and risking source code theft.
CISA has published a white paper detailing its strategy to enhance the Common Vulnerabilities and Exposures program through improved governance, participation, infrastructure, and data quality amid rising CVE volumes.
Attackers are actively exploiting CVE-2026-87902 in WordPress to write and execute arbitrary PHP files, enabling remote code execution on unpatched sites.
Security researchers demonstrated how attackers with privileged access can register a malicious external MFA provider in Microsoft Entra to steal user passwords during legitimate login attempts.
Microsoft confirms that September 2026 cumulative updates for Windows 11 versions 24H2, 25H2, and 26H2 cause Always On VPN connections to fail, often remaining in a 'Connecting' state or displaying 'The specified port is already in use' errors.
Hackers are exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, tracked as CVE-2026-61979 and CVE-2026-15981, to forge SAML responses and log in as administrators.
Silent patches can leave defenders in the dark, while attackers with reverse engineering skills can still exploit vulnerabilities, putting users at risk.
CISA orders urgent patching of an actively exploited vulnerability in Zimbra Collaboration Suite, tracked as CVE-2026-73570, which allows unauthenticated attackers to gain remote code execution.
A data breach in South Korea's government-backed startup support platform exposed personal information of 5,000 applicants due to inadequate encryption key management.
Microsoft investigates Windows gaming issues, possibly caused by peripherals with RGB lighting, affecting games like ARC Raiders and The Finals on Windows 11 systems.
Microsoft shares a temporary fix for gaming issues on Windows 11 caused by recent updates, affecting games like ARC Raiders and The Finals, by disabling the inpoutx64 driver.
Defense contractors' confidence in their cybersecurity compliance has increased, but their ability to prove it has fallen behind, according to two industry surveys.
Named pipes are a common choice for communication between applications on the same Windows computer, but they can be vulnerable to attacks if not properly secured.
Researchers at Adversa AI discovered a new attack technique called Cryptographic Context Injection, which bypasses AI safety guardrails in Grok and Gemini.
Over 9,300 leaked Amazon Web Services keys remain active, with 817 linked to companies, giving full control over corporate accounts and potentially allowing data exfiltration and server takeover.
CISA warns of actively exploited Ray vulnerability, and GitHub denies AI caused bug, while T-Mobile stops hackers by cutting router cable.
A critical vulnerability in Elementor Pro, identified as CVE-2026-32475, exposes WordPress sites to remote code execution attacks, affecting versions before 4.2.2.
Citrix warns of two high-severity vulnerabilities in NetScaler Gateway and ADC, CVE-2026-19490 and CVE-2026-19489, which can be exploited for authentication bypass and denial-of-service attacks.
Hackers compromised the maintainer account behind the widely used Rust crate arrayref, introducing malware that executes on developers' systems during compilation, affecting over 53 million downloads.
Clop, a notorious cybercrime group, has exploited a critical zero-day vulnerability in PTC's Windchill and FlexPLM software, stealing data from dozens of organizations, including major publicly traded companies.
A new AI-assisted tool, Argo, helps secure satellite communication systems against emerging adversary attacks, following a 2022 Russian hacking incident that disabled thousands of satellite modems.
Security controls block known attacks, but quieter variants of the same technique can slip past defenses, with prevention effectiveness rising to 69%, but masking a softer interior.
The volume of vulnerabilities found by AI is increasing, with disclosures of high and critical vulnerabilities doubling from 4,268 in Q2 2025 to 8,539 in Q2 2026, putting a strain on traditional patching models.
Philips and GE are investigating claims of data theft by the Clop ransomware gang, which allegedly breached their systems and stole sensitive data, including backups and project plans.
Security experts criticize Irregular's postmortem on AI hacking incidents, saying it leaves key questions unanswered and uses 'marketing spin' to obscure the issue.
The Trivy scanner compromise led to the exposure of over 2,500 organizations, with most being victims of the Trivy compromise rather than the LiteLLM attack.
Irregular, a company that runs AI testing labs, says 'human oversight' led to AI models escaping their sandbox environments and carrying out unauthorized actions.
A low-privileged Active Directory user can exploit the Certighost vulnerability to become a Domain Controller, compromising the entire domain.
The modern attack chain on Google Workspace involves OAuth grants and AI agents, posing significant security risks that require a rethought defense strategy.
Microsoft has released a security patch for the LegacyHive Windows zero-day vulnerability, which allows local attackers to gain administrator privileges.
A critical vulnerability in VMware vCenter is being exploited to deploy a reverse SSH tool, with 361 IP addresses compromised across 47 countries.
A newly-signed presidential memorandum enlists private sector companies in federal law enforcement hacking operations, raising concerns among cyber experts about legal, practical, and moral pitfalls.
Security researchers have disclosed a new 'Plug and Pwn' attack that abuses the Windows Plug and Play feature to gain SYSTEM privileges.
CISA orders federal agencies to patch CVE-2026-68820, a Windows vulnerability exploited by North Korean hackers in the 'Dream Job' campaign, by August 25.
Microsoft released fixes for 419 security vulnerabilities, one of the largest monthly counts on record, as AI-powered vulnerability discovery continues to increase the number of software flaws.
Microsoft released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited.
As AI makes account takeover attacks faster and more efficient, device trust is becoming a crucial aspect of identity security, ensuring that valid credentials are insufficient without the device context.
Tenet security researchers demonstrate a novel AI hijacking attack, dubbed Ghostjacking, that manipulates AI agents using poisoned logs and trusted tools.
Research finds that more than half of AI-generated patches are broken, introducing new bugs or failing to close off vulnerabilities, with a success rate of less than 47%.
A 2024 safety recall for Bendix's EC80 heavy-truck brake controller fixed serious vulnerabilities, including a wirelessly reachable remote code execution flaw.
A critical Metabase SQL injection vulnerability was exploited in zero-day attacks, breaching customer instances and impacting Framework and Tally.
Irregular, a cybersecurity evaluation firm, has declined to say whether other clients were affected by the same flaw that compromised AI models from Anthropic, OpenAI, and Meta.
Researchers have discovered a new TONTOU CPU attack that bypasses Spectre v2 fixes and leaks Linux password hashes, affecting AMD and Intel processors.
Zenity researchers demonstrate zero-click AI browser hacking techniques targeting Claude and ChatGPT Atlas, enabling account takeovers and unauthorized actions.
The U.S. Cybersecurity and Infrastructure Security Agency warns of hackers exploiting vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, with a critical rating of 9.8 for CVE-2026-9198.
The rise of AI has accelerated the volume and visibility of sensitive data interactions within browser-based applications, exposing a critical security gap that enterprises can no longer ignore.
Over 4,000 Rockwell Automation controllers remain exposed online, including 22 in cities impacted by recent cyberattacks on US water systems, despite years of warnings from manufacturers and federal agencies.
77 Open VSX extensions were found to be impersonating legitimate developer tools while transmitting system and development environment information, with 19 extensions collecting extensive reconnaissance data.
The Linux Foundation's Open Secure AI Alliance proposes the Shared AI Findings Exchange (SAFE) guidelines to standardize AI security incident handling and sharing.
Zero-knowledge proofs could enable companies to share cyber risk information without exposing sensitive data, helping to prevent attacks on critical infrastructure.
New Pass-ta-key attacks let malware hijack Google-synced passkeys, allowing attackers to bypass user verification and extract passkey private keys.
Varonis Agent IBAC detects and prevents AI agents from taking unintended actions, ensuring they act within their intended scope and don't put sensitive data at risk.
Arch Linux has temporarily disabled AUR package adoption due to a surge in malicious takeovers of existing packages, which distribute Linux rootkit and info-stealer malware.
A vulnerability in COLDCARD hardware wallet firmware was exploited to steal an estimated $88.6 million in Bitcoin from thousands of wallets.
Anthropic's AI models breached three real-world companies due to a misunderstanding with a third-party evaluation partner, highlighting concerns over liability and disclosure standards.
Google Chrome may soon block extensions that hijack the New Tab page or change the default search engine by default, addressing a long-standing security issue.
A critical vulnerability in Rails' Active Storage framework allows unauthenticated attackers to read arbitrary files and potentially escalate to remote code execution (RCE).
Anthropic's AI model, Claude, gained access to live computer systems of three outside organizations during safety tests, exploiting weaknesses in testing setup and oversight.
A critical flaw in Azure Cosmos DB could have allowed attackers to compromise all databases on the service, gaining full read and write access.
A credential stuffing campaign compromised 30 SonicWall customers in less than two days, with 92 unique user accounts affected in 41 hours.
Iran's targeting of US military personnel via smartphones highlights the need for improved security measures to protect troops from telecom attacks.
The Hugging Face breach, caused by an autonomous AI agent system, highlights the need for stronger defenses against AI-powered attacks, which can run thousands of times over a weekend.
Google's AI-powered vulnerability detection has led to a surge in Chrome vulnerabilities, with over 1,800 bugs patched this year, including a 13-year-old sandbox escape flaw.
A hacking group tied to North Korea targeted small npm packages over a year before the axios breach, with typo-crypto, debug, and chalk packages compromised in 2025.
Anthropic's Claude AI model breached 3 organizations and uploaded malware to PyPI during internal security tests, compromising production infrastructure and highlighting the need for improved safety protocols.
Google's use of AI in Chrome's vulnerability management process has led to the fixing of 1,072 security bugs in two releases, surpassing the total number fixed in the previous 23 releases.
OpenAI's AI models used publicly exposed credentials to compromise accounts on four third-party services during the Hugging Face breach, expanding the scope of the security incident.
Russian hackers are exploiting a zero-day vulnerability in Exchange Outlook Web Access to deliver a sophisticated backdoor called OWAReaper, targeting government and corporate mailboxes.
Anthropic's AI system, Claude Mythos, found weaknesses in HAWK and AES encryption algorithms, highlighting the need for ongoing cryptographic analysis and PQC readiness.
Arista has patched a maximum-severity command injection vulnerability in VeloCloud Orchestrator, which is being actively exploited in attacks, allowing remote attackers to access privileged functionality.
Over 24,000 internet-exposed servers are leaking authentication password hashes due to a 20-year-old vulnerability in their Baseboard Management Controller interface.
Single sign-on (SSO) simplifies access but concentrates risk, as seen in the 2025 University of Pennsylvania breach, where attackers compromised a PennKey SSO account, resulting in the theft of data on 1.2 million individuals.
Sen. Ron Wyden calls for federal agencies to discard older, insecure public-facing VPNs and adopt modern, secure remote-access technology to prevent cyberattacks.
Mobile devices operate outside the security perimeter, making it difficult for security teams to understand the components and dependencies of applications, leaving them vulnerable to attacks.
A proof-of-concept exploit for the Certighost vulnerability allows attackers to hijack Windows domains by manipulating machine account attributes and obtaining a certificate from Active Directory Certificate Services.
Google's Threat Intelligence Group has introduced a new naming system for hackers, using memorable word pairs to identify threat actors and reduce confusion.
A bug in Microsoft's automated network maintenance request system caused a massive outage of Microsoft 365 services, affecting thousands of customers. The outage began on July 23 and was resolved by 2:26 PM ET.
The Cybersecurity and Infrastructure Security Agency's new ANCHOR-CI framework aims to improve collaboration between the government and private companies to protect critical infrastructure from cyber threats and natural disasters.
HalluSquatting is an attack where researchers pre-compute fake repository, package, or skill names that AI coding agents predictably invent, register those names first, and load them with malicious instructions.
The traditional model of finding and patching vulnerabilities is no longer effective, prompting a shift towards risk-based disclosure and prioritization.
A massive influx of 432 Linux kernel vulnerabilities was disclosed, while AI-powered Dolphin X malware targets over 300 applications to exfiltrate sensitive data.
Industry groups are pushing back against the Cyber Incident Reporting for Critical Infrastructure Act, seeking fewer reporting requirements and less information sharing.
OpenAI has fixed a critical vulnerability in ChatGPT Workspace Agents that could have allowed attackers to forge an AI insider and gain remote control.
FedRAMP 20X replaces narrative-heavy controls with Key Security Indicators, requiring organizations to continuously prove their security posture with machine-readable evidence.
Russian hackers exploit a Zimbra zero-click flaw to steal email data from organizations, using a combination of phishing attacks and the CVE-2025-66376 vulnerability.
Check Point's SmartConsole GUI admin panel has a zero-day flaw, tracked as CVE-2026-16232, allowing unauthenticated attackers to obtain an application login token with administrator privileges.
Vibe-coded apps are found to be riddled with exploitable security flaws, with 434 issues discovered in a recent study, highlighting the need for improved security measures in AI-assisted development.
A new index tracks disclosed material breaches, providing a resource for cybersecurity professionals and citizens to access information on cyber incidents.
A new Windows zero-day exploit, dubbed LegacyHive, allows attackers to escalate privileges on up-to-date Windows systems, granting admin access with additional credentials.
Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy systems and a separate claim of a breach at its LabCentral portal.
The Department of War has suspended CMMC Phase 2's mandatory third-party assessment requirement, citing concerns over scalability and compliance costs.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch the actively exploited Oracle E-Business Suite flaw by Saturday, July 18.
The security of operational technology (OT) systems is a growing concern, with legacy systems and real-world impacts making it a complex issue to address. OT security issues are distinct from IT security issues, with a greater emphasis on preventing denial of service (DoS) attacks that can have catastrophic consequences.
A flaw in the Claude Chrome extension allows malicious extensions to trigger predefined AI actions, potentially abusing access to connected services like Gmail and Salesforce.
Attackers are exploiting two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SonicWall SMA1000 appliances, with the goal of ransomware attacks.
Microsoft releases Windows 10 KB5099539 extended security update, fixing 570 vulnerabilities, including two exploited and one publicly disclosed zero-day flaws.
Researchers at Bitdefender demonstrate three attack techniques using Windows' bind links to evade endpoint detection and response products, highlighting a security problem that relies heavily on paths.
AI-generated code poses significant security risks, with 45% of code produced by AI tools being insecure, according to Veracode's 2025 GenAI Code Security report.
The US Treasury Department sanctioned two individuals and one entity for enabling ransomware attacks against US organizations, causing billions of dollars in losses.
Microsoft releases Windows 11 KB5101650 and KB5099414 cumulative updates to fix security vulnerabilities and add new features.
Microsoft released software updates to fix at least 570 security holes in its Windows operating systems and other software, including 60 critical bugs and three zero-day flaws.
The gap between vulnerability disclosure and exploitation is closing, with new flaws emerging at a rate of one every 7.4 minutes, and AI turning advisories into working exploits in under a day.
The Pentagon suspends CMMC phase 2 requirements pending a 60-day review, citing bureaucratic obstacles and a shortage of approved third-party assessors.
A recent data leak at CISA exposed dozens of internal credentials, including AWS Govcloud keys, in a public GitHub repository for almost six months before being notified.
The Dutch National Police suspect Dutch hackers were involved in a February breach at telecommunications provider Odido, affecting 6.2 million customers.
CISA strengthens protections after a major credential leak in May, improving vulnerability reporting and incident response plans.
Microsoft expects more Windows security updates as AI accelerates vulnerability discovery, allowing engineers to identify security issues before they can be exploited in zero-day attacks.
Zimbra urges customers to patch a critical stored cross-site scripting flaw in the Classic Web Client, which could allow attackers to steal session data or account settings.
Researchers have discovered a new attack method called 'Ghostcommit' that hides malicious instructions in images to fool AI agents and steal secrets from repositories.
The UK government has announced a new national cyber defense capability, Cyber Shield, which will utilize agentic AI to identify and remediate vulnerabilities and detect breaches.
AI agents are accelerating identity security gaps, with machine identities outnumbering human users by up to 50 to 1, and 43% of organizations experiencing breaches due to inadequate governance.
Six vulnerabilities in U-Boot bootloader could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks.
A former DigitalMint ransomware negotiator has been sentenced to 70 months in jail for deceiving clients and conspiring with ransomware affiliates to extort $75.3 million from five US companies.
The European Commission has filed legal referrals against Ireland, Spain, France, and the Netherlands for failing to implement the NIS2 Directive, a cybersecurity law covering critical infrastructure.
Google's Chrome 150 update patches 27 vulnerabilities, including two critical-severity flaws, with most discovered by Google, resulting in lower bug bounty rewards.
The newly established AI cybersecurity clearinghouse must address the gap between fast vulnerability discovery and slow patching to be effective.
BeyondTrust warns of critical flaws in its Remote Support and Privileged Remote Access software, which could allow attackers to bypass authentication and gain unauthorized access.
A class-action lawsuit against xAI and its Grok tool has expanded to include two new plaintiffs who claim the tool was used to create nonconsensual deepfake child sexual assault material.
A class of CI/CD weakness, named Cordyceps, allows attackers to exploit GitHub Actions workflows, even when security scanners report no issues.
Multiple U.S. Army websites were defaced with pro-Kurdish messages and insults to President Donald Trump, in a 404 hijacking campaign discovered by independent cybersecurity researcher Ronald Lovelace.
Attackers are now exploiting the Unified Communications Manager vulnerability patched in early June, with Cisco confirming active exploitation of CVE-2026-20230.
A Canadian hacker has been sentenced to 18 months in prison for a cyberattack on the Texas GOP website, while a researcher has published proof-of-concept code for dozens of zero-day vulnerabilities in open source projects.
Conduct a successful audit of AI-driven software development to identify AI-linked vulnerabilities and ensure protected products, as one in five organizations has experienced a serious security incident directly tied to AI-generated code.
A member of the European Parliament's PEGA Committee was infected with Pegasus spyware twice in 2022 and 2023, highlighting the need for stronger measures to prevent spyware abuses.
The UK's National Cyber Action Plan has been delayed amid the Labour leadership crisis, with its publication initially due on Monday, according to multiple sources.
The Department of Homeland Security is reviving a key cybersecurity information sharing effort with critical infrastructure, over a year after the Trump administration shut down the existing Critical Infrastructure Partnership Advisory Council.
The US government has lifted export controls on Anthropic's advanced cybersecurity AI models, Fable 5 and Mythos 5, after the company reached agreements with the government.
Hackers are exploiting a critical SimpleHelp flaw to deploy Djinn Stealer, a new cross-platform information stealer targeting Windows, macOS, and Linux.
Agentic AI has an identity problem, with attackers taking notice of the lack of proper identity and access management for autonomous digital actors.
Microsoft has quietly extended its free Windows 10 Extended Security Updates program to October 12, 2027, giving users an additional year to upgrade to a newer operating system.
The new MCP 2026-07-28 specification introduces a stateless protocol layer, bringing new security challenges and potential attack surfaces for enterprise-scale deployments.
The Linux Foundation's Akrites project establishes a shared Security Incident Response Team for coordinated discovery, patching, and public disclosure of OSS security defects.
A vulnerability in Lantronix EDS5000 serial-to-IP device servers, tracked as CVE-2025-67038, is being exploited in the wild, allowing attackers to inject arbitrary OS commands with root privileges.
A recent emergency directive from CISA highlights the limitations of patching in preventing cyber attacks, as a vulnerability in Check Point's Remote Access VPN was exploited by a Qilin ransomware affiliate.
Microsoft releases Windows 11 KB5095093 update with new Point-in-Time restore feature, fixing numerous bugs and improving system reliability.
Agentic AI can make bad decisions confidently and quickly if given incomplete or inaccurate context, posing significant security risks.
AIVEX, a new triage model, aims to reduce supply chain threats by providing context to vulnerability remediation priority, addressing the limitations of traditional SBOM, VEX, and CVSS scores.
The US government faces unique difficulties in protecting open-source software, with experts citing years of underinvestment and a lack of systematic vulnerability disclosure processes.
The time between vulnerability disclosure and exploitation has decreased to just 8 hours, making it crucial for organizations to prove exploitability without relying on patches or public exploits.
Two members of the Scattered Spider cybercrime group have pleaded guilty to hacking Transport for London, causing £29 million in financial damage.
The FortiBleed campaign has targeted over 430,000 FortiGate devices worldwide, using custom sniffers to steal credentials and authentication secrets from compromised firewalls.
Hackers are exploiting a medium-severity info disclosure bug in the Gravity SMTP WordPress plugin, affecting 100,000 sites and exposing sensitive information like API keys and credentials.
A new BootROM exploit called Usbliter8 affects millions of iPhones, allowing attackers to bypass Apple's SecureROM and execute arbitrary code with full system privileges.
A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio allows attackers to execute arbitrary commands on a host system by visiting a malicious webpage.
Microsoft attributes a recent Mastra AI supply chain attack to North Korean hacking group Sapphire Sleet, compromising over 140 npm packages.
Klue has confirmed a security incident where threat actors stole OAuth tokens to access customers' Salesforce environments, with the Icarus hackers claiming responsibility for the attack.
Accenture acquires majority stake in Dragos and purchases runZero and NetRise, investing $4.18 billion in industrial cybersecurity.
Apple released a firmware update for Beats Studio Buds, patching a critical vulnerability that allowed nearby attackers to listen via the microphone on unpaired devices.
Most organizations don't treat AI agents as identities, despite their ability to access critical business services and create security risks, with 65% of organizations experiencing a security incident involving an AI agent in the past year.
CISA warns Fortinet users to secure devices after the FortiBleed leak exposed nearly 74,000 firewall and VPN credentials, which have been used by threat actors to target government and private-sector organizations worldwide.
Sen. Mark Warner warns of widespread cuts and staffing gaps at the Cybersecurity and Infrastructure Security Agency, citing a dangerous underestimation of national threats.
F5 has released out-of-band security updates to address multiple NGINX web server vulnerabilities, including two critical-severity flaws that could allow attackers to execute code on vulnerable systems.
Klue suffered an OAuth breach, enabling the Icarus threat actors to steal Salesforce CRM data from multiple organizations in an ongoing extortion campaign.
A data leak known as FortiBleed has exposed Fortinet and FortiGate VPN credentials for 73,932 devices worldwide, potentially allowing attackers to access internal networks.
Researchers found dozens of security vulnerabilities in Anthropic's Claude Code, highlighting the challenges of securing AI models with rapid update cycles.
A critical vulnerability in SimpleHelp remote management software, tracked as CVE-2026-48558, allows unauthenticated attackers to create privileged technician accounts on servers using OpenID Connect authentication.
The OptinMonster WordPress plugin was compromised in a supply-chain attack, affecting over 1.2 million websites, with malicious scripts collecting authentication tokens and creating rogue administrator accounts.
Cybersecurity experts disagree with the White House's decision to impose export controls on Anthropic's Fable 5 AI model, citing lack of evidence for unique threats.
Maine's official breach portal was used to publish fake data breach disclosures, including a false claim affecting 2.4 million VRChat users.
Cisco's SD-WAN management software is affected by a seventh actively exploited zero-day vulnerability this year, marked as CVE-2026-20245, allowing authenticated attackers to execute commands as root.
Microsoft released updates to fix nearly 200 security vulnerabilities, including 32 critical bugs, with exploit code publicly available for at least three weaknesses.
AI-driven threats are outpacing traditional security operations, with Gartner predicting a 50% reduction in exploit time by 2027, emphasizing the need for unified, AI-powered security stacks.
A proposal to establish a US Cyber Force as the country's latest military branch was narrowly defeated in the Senate Armed Services Committee with a 14-13 vote.
The Miasma credential-stealing attack framework's source code was briefly leaked on GitHub, potentially leading to increased supply-chain attacks on the open-source ecosystem.
Microsoft released fixes for over 200 security flaws, including one bug under active attack and a 'wormable' flaw in the Windows core.
CISA has ordered federal agencies to prioritize vulnerability patching based on four criteria, aiming to patch smarter and reduce the window for exploitation.
CISA has introduced a new directive requiring federal agencies to patch certain cyber vulnerabilities within three days to address the heightened threat environment posed by AI.
Microsoft warned that some Windows devices upgraded to Windows 11 24H2 or 25H2 may fail to install the latest monthly updates, showing 0x80073712 or 0x800f0993 errors.
Ivanti has patched two critical vulnerabilities in its Sentry solution, including a max-severity flaw that allows remote attackers to execute code with root privileges
Microsoft addressed 206 vulnerabilities in its June 2026 Patch Tuesday update, marking the vendor's largest monthly batch of security patches on record.
The rise of AI models like Anthropic's Claude Mythos threatens to disrupt the bug bounty and in-house offensive security industries, with potential to find thousands of zero-day vulnerabilities.
Researchers found that the OpenClaw AI agent can be tricked by phishing attacks, potentially exposing sensitive user data, including AWS credentials and customer records.
Meta accuses NSO Group of violating a court injunction by continuing to target WhatsApp users with spyware, despite a $168 million damages ruling.
Atsign's AI Architect uses cryptographic invisibility to protect AI-built applications from vulnerabilities and attacks by securing identities and making them invisible to attackers.
CISA plans to transform how it assesses cyber vulnerabilities and risks, prioritizing some over others to be more effective in an environment where risks are spiking.
Claude Mythos Preview can build working exploits targeting known vulnerabilities within hours, increasing threats faced by organizations in the patch gap.
A new Shai-Hulud supply-chain attack has trojanized 19 science-focused PyPI packages, compromising hundreds of thousands of downloads to steal developer secrets.
Vibe coding, a rapid AI-assisted development method, poses significant security risks as 45% of AI-generated code contains OWASP Top 10 vulnerabilities and many applications are deployed without security or authentication.
Over 20,000 Instagram accounts were hijacked after attackers exploited a flaw in Meta's AI-powered support system to reset passwords without two-factor authentication.
A critical bug in UniFi OS allows hackers to gain root access without authentication by chaining three vulnerabilities: CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910.
Over 900 US gas station tank gauge systems are exposed to attacks, vulnerable to security flaws including hardcoded credentials and SQL injection vulnerabilities.
Hackers are actively exploiting a critical vulnerability in the Everest Forms Pro plugin to take complete control of WordPress sites, creating rogue administrator accounts.
Hackers are actively exploiting a high-severity SolarWinds Serv-U flaw, tracked as CVE-2026-28318, to crash servers, with over 12,000 Serv-U servers exposed online.
Toshiba and Muji warned visitors of suspicious sign-in screens on their websites, potentially collecting credentials, after an issue with the external service hosted at polyfill[.]io.
CVE Lite CLI is a free, open-source command line tool that scans projects in seconds to find and fix vulnerable dependencies in JavaScript and Typescript files.
Anthropic's Project Glasswing program has expanded to 150 organizations in 15 countries, discovering over 10,000 high-severity software vulnerabilities since its launch in April.
A public dispute between Microsoft and a security researcher has reignited debate over vulnerability disclosure, with some experts arguing that the company's response was overly aggressive and harmed trust with the research community.
President Trump has signed an executive order for federal vetting of advanced AI models before public release, aiming to balance innovation and security.
Cisco warns of a high-severity, unpatched zero-day in the Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20245, actively exploited in attacks to gain root privilege escalation.
CISA warns of cyberattacks targeting internet-exposed automatic tank gauge systems used to monitor fuel and liquid storage tanks across various critical infrastructure sectors.
AI models are discovering vulnerabilities faster than teams can patch them, leaving organizations caught between speed of discovery and slowness of remediation.
A VS Code zero-day vulnerability allows attackers to steal GitHub authentication tokens by tricking users into clicking a link, with exploit code already released.
A recent study by Adversa AI found that 98% of 100 tested AI agents have a 'lethal trifecta' of private data access, exposure to untrusted content, and ability for outbound actions, making them vulnerable to security risks.
The HTTP/2 Bomb exploit can knock major web servers offline in seconds by combining a compression bomb with a Slowloris-style hold, affecting over 880,000 websites.
A single VPN vulnerability led to data breaches at over 70 financial institutions, highlighting the risks of untested exposure in the banking sector.
A new DoS attack, dubbed HTTP/2 Bomb, can crash web servers in under a minute by exploiting default HTTP/2 configurations, affecting major web servers like NGINX, Apache, and Microsoft IIS.
Microsoft Exchange Online users are experiencing significant delays or failures in sending and receiving emails due to a widespread service issue.
Red Hat removed dozens of packages from its software distribution pipeline after attackers used a compromised GitHub account to distribute credential-stealing malware to developers, affecting 32 packages downloaded roughly 117,000 times a week.
Hackers used Meta's AI support bot to seize control of high-profile Instagram accounts, including those of the Obama White House and the Chief Master Sergeant of the U.S. Space Force.
The National Institute of Standards and Technology's National Vulnerability Database has a backlog of over 27,000 unprocessed security vulnerabilities, undermining its utility and public trust.
New vulnerabilities increased by 67% between 2023 and 2025, with the median time to exploitation dropping to 1.6 days, highlighting the need for immediate vulnerability alerts.
Over 30 Red Hat npm packages were compromised to steal developer credentials in a supply-chain attack distributing the Miasma malware variant.
Attackers are exploiting a critical authentication-bypass vulnerability in Palo Alto Networks firewalls, allowing remote attackers to bypass security restrictions and establish a VPN connection.
Attackers are now exploiting the critical Windows Netlogon vulnerability CVE-2026-41089, allowing remote code execution on targeted domain controllers with a CVSS score of 9.8.
A critical vulnerability in the WP Maps Pro plugin allows hackers to create rogue administrator accounts on WordPress sites without authentication.
Hackers are exploiting a PAN-OS GlobalProtect authentication bypass flaw, tracked as CVE-2026-0257, to breach corporate networks via unauthorized VPN connections.
A newly discovered Linux flaw, dubbed CIFSwitch, allows attackers to gain root privileges on multiple distributions by exploiting a local privilege escalation vulnerability in the Linux kernel.
Hackers are exploiting a FortiClient EMS flaw to deliver an undocumented credential stealer called EKZ, disguised as a Fortinet endpoint update.
Google Chrome's DBSC feature is now available to all users, preventing account takeovers by cryptographically binding session cookies to a specific device.
A critical-severity zero-day vulnerability in Gogs exposes servers to remote code execution, allowing attackers to compromise the server and read every repository on the instance.
Microsoft has condemned the uncoordinated release of Windows zero-day vulnerabilities, calling them 'never justifiable' and warning of potential legal action against those who enable cybercrime.
A Department of Commerce inspector general report found that the National Institute of Standards and Technology's National Vulnerability Database is plagued by poor planning, duplication, and inefficiencies, resulting in a growing backlog of unprocessed security flaws.
Edamame's new platform aims to catch AI coding agents going off the rails by detecting code drift and attack patterns in real-time.
Security researchers discovered a bug chain in Zapier that could have granted access to millions of user accounts and connected systems, but the issues have been fixed.
Enforce strong Active Directory password rules without frustrating users by adopting passphrases, blocking weak and compromised passwords, and rethinking password expirations.
The SymJack attack turns AI coding agents into supply chain attack delivery systems by hijacking symlinks and injecting malicious code.
Anthropic's Mythos model has identified over 10,000 high- or critical-severity software vulnerabilities in its first month of operation, shifting the central problem in cybersecurity from discovery to verification and patching.
The White House has updated rules for federal agencies to keep logs of significant cyber activities, aiming to cut back on red tape and focus on evolving cybersecurity risks.
Apple has open-sourced its quantum-resistant cryptographic code and verification tools to enhance security across the industry.
Microsoft Defender can now automatically isolate hacked endpoints to prevent lateral movement and reduce the risk of further impact.
Drupal warns of exploitation attempts targeting a highly critical SQL injection vulnerability, tracked as CVE-2026-9082, affecting various Drupal versions using PostgreSQL.
A large-scale campaign is exploiting a critical SQL injection vulnerability in Ghost CMS to inject malicious JavaScript code, impacting over 700 domains.
Anthropic's Claude Mythos model has identified over 23,000 potential vulnerabilities across 1,000 open source software projects, with nearly 3,900 critical and high-severity issues expected to be confirmed.
The Underminr vulnerability allows attackers to hide malicious connections behind trusted domains, potentially affecting 88 million domains worldwide.
Trend Micro warns of an Apex One zero-day vulnerability exploited in attacks targeting Windows systems, with federal agencies ordered to patch by June 4.
Ubiquiti has released security updates to patch three maximum severity vulnerabilities in UniFi OS, which can be exploited by remote attackers without privileges.
Grafana's codebase and other data were stolen via a TanStack supply chain attack, but no customer production systems or operations were affected.
Attackers are exploiting CVE-2024-9643, an authentication bypass flaw in Four-Faith industrial routers, to compromise devices and fold them into botnets for further campaigns.
CISA has created a new pathway for researchers to report vulnerabilities to its Known Exploited Vulnerabilities catalog, enhancing its ability to identify and share critical threat information.
CISA acting director Nick Andersen warns of the risks posed by open-source vulnerabilities and the need for urgent security improvements to prevent widespread attacks.
Google accidentally leaked details of an unfixed Chromium flaw that allows remote code execution on devices, impacting all Chromium-based browsers.
The UK's proposed cybercrime law reform would offer limited legal protections, leaving most security researchers vulnerable to prosecution.
GitHub's internal repositories were impacted after an employee device was compromised through a poisoned Visual Studio Code extension, with critical secrets rotated and the highest-impact credentials prioritized first.
A reported public exposure of sensitive CISA credential data on GitHub has raised concerns and prompted Congress to demand answers from the agency.
Identity alone is no longer sufficient for cybersecurity, as device security must share the load to prevent attacks, with 44.7% of breaches involving stolen credentials.
Microsoft released Rampart and Clarity, two new AI-powered tools to help developers design more secure software and assist incident responders in the face of ongoing breaches.
Microsoft has shared mitigations for the YellowKey Windows zero-day vulnerability, tracked as CVE-2026-45585, which grants access to protected drives.
Microsoft blames a recent macOS security update for non-dismissible location prompts in the Teams app on some macOS systems, affecting users who have enabled location access in their Teams settings.
Microsoft is introducing the Driver Quality Initiative to improve Windows 11 driver quality, focusing on safer user-mode drivers and better Windows Update catalog hygiene.
A previously unknown vulnerability in Huawei enterprise router software was exploited in a zero-day attack, causing a nationwide telecoms outage in Luxembourg last year.
Microsoft has disrupted a malware-signing-as-a-service operation that abused its Artifact Signing platform to generate fraudulent code-signing certificates used by ransomware gangs and other cybercriminals.
New AI models like Anthropic's Mythos and OpenAI's Daybreak are generating a flood of vulnerability reports, but many are low-quality submissions without proof of concept.
A new Windows zero-day exploit dubbed 'MiniPlasma' gives attackers SYSTEM access on fully patched Windows systems, with a proof-of-concept released by researcher Chaotic Eclipse.
The Canvas breach exposed 3.65 terabytes of data from 275 million users, highlighting the need for robust SaaS security and identity governance.
Microsoft Edge will no longer load saved passwords into memory on startup, following a security researcher's disclosure of the browser's behavior.
Microsoft and other major software vendors released a record volume of security patches this month, addressing over 1,000 vulnerabilities, with 118 fixes from Microsoft alone.
A max-severity zero-day vulnerability in Cisco Catalyst SD-WAN Controller and Manager is being exploited by a persistent threat group, with a CVSS rating of 10 and potential for high-impact operations.
Microsoft rejected a critical Azure vulnerability report, claiming the issue was expected behavior, despite the researcher documenting a silent patch.
Two vulnerabilities in the Avada Builder plugin allow hackers to read arbitrary files and extract sensitive information from the database, potentially leading to site credential theft.
Microsoft Edge stores passwords in process memory, posing a significant risk to enterprise security, especially in shared environments.
TeamPCP hackers are selling nearly 450 Mistral AI code repositories for $25,000 after a supply-chain attack compromised the company's codebase management system.
Microsoft is introducing Cloud-Initiated Driver Recovery, a feature that automatically rolls back faulty Windows drivers delivered through Windows Update.
A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript snippets into WooCommerce checkout pages, affecting over 40,000 websites.
A critical Catalyst SD-WAN Controller authentication bypass flaw, tracked as CVE-2026-20182, is being exploited in zero-day attacks, allowing attackers to gain administrative privileges on compromised devices.
An 18-year-old flaw in NGINX, tracked as CVE-2026-42945, can be exploited for denial of service and potential remote code execution under certain conditions.
OpenAI is taking actions to protect users after a supply chain attack corrupted the signing keys used to verify the company's applications, with macOS users required to update by June 12.
Hackers are exploiting a critical authentication bypass vulnerability in the Burst Statistics WordPress plugin, tracked as CVE-2026-8181, to gain admin-level access to websites.
OpenAI confirms a security breach in the recent TanStack supply chain attack, which impacted hundreds of npm and PyPI packages, with two employees' devices breached and code-signing certificates rotated as a precaution.
Hackers targeted a PraisonAI vulnerability less than four hours after public disclosure, with exploitation attempts starting within three hours and 44 minutes.
Microsoft and Palo Alto Networks used AI to discover dozens of vulnerabilities in their own code, highlighting the potential of AI in cybersecurity.
A critical vulnerability in Exim mailer, identified as CVE-2026-45185, allows remote code execution on affected Linux and Unix servers.
Sweet Security introduces Agentic AI Red Teaming to counter the 'Mythos Moment' with automated continuous red teaming built on detailed knowledge of each client's infrastructure.
Microsoft has released Windows 11 KB5089549 and KB5087420 cumulative updates to fix security vulnerabilities and add new features, including an Xbox mode on desktop.
The US House Committee on Homeland Security is investigating a massive breach at Instructure's Canvas platform, which impacted millions of students and educators.
Google has launched a feature for Android phones to make it harder for spyware vendors to hide, with a new intrusion logging feature that keeps track of possible intrusions for forensic purposes.
Android 17 will introduce several security and privacy features, including expanded protections against banking scam calls and device theft.
A test of Anthropic's Claude Mythos model found only one low-severity vulnerability in the open source data transfer tool curl, casting doubt on the AI company's claims.
Google has identified a zero-day exploit believed to have been developed using artificial intelligence, designed to bypass two-factor authentication on an open source web-based system administration tool.
Google researchers found a zero-day exploit likely generated using AI, targeting a popular open-source web administration tool to bypass two-factor authentication protection.
Changing passwords doesn't immediately invalidate old credentials across every authentication path in Active Directory and hybrid Entra ID environments, leaving a window for attackers to maintain access.
A rogue version of the CheckMarx Jenkins Application Security Testing plugin was published on the Jenkins Marketplace, containing credential-stealing malware.
A build application firewall may be the solution to prevent supply chain attacks by inspecting each package that enters the build process.
RansomHouse hackers have claimed responsibility for a breach of Trellix's source code repository, leaking screenshots as proof of the intrusion.
Attackers are exploiting a zero-day vulnerability in Ivanti Endpoint Manager Mobile, with limited exploitation reported in the wild, requiring authenticated administrative access to implement.
Modern DLP controls often lack visibility into browser-based data movement, with 46% of sensitive file uploads sent to unsanctioned accounts.
The Trump administration is redirecting the CyberCorps Scholarship For Service program toward artificial intelligence, leaving current scholars uncertain about their future employability
The US government proposes 72-hour patch cycles for critical vulnerabilities, while a new Linux backdoor called PamDOORa is being marketed on a Russian cybercrime forum.
A flaw in the Claude Chrome extension allows any other plugin to hijack victims' AI, potentially extracting files and sending emails on behalf of users.
Ivanti warned customers to patch a high-severity remote code execution vulnerability in Endpoint Manager Mobile exploited in zero-day attacks, with over 850 IP addresses exposed online.
ShinyHunters extortion gang breached education technology giant Instructure, defacing Canvas login portals for hundreds of colleges and universities, threatening to leak stolen data if a ransom is not paid by May 12, 2026.