Priya Raman

Editor-in-Chief

Priya has covered enterprise security for over a decade, with a focus on vulnerability disclosure, incident response and the gap between vendor advisories and what defenders can actually action.

Vulnerability disclosureIncident responseSecurity leadership

Articles by Priya Raman

22 articles

ThreatsTechnology, Cloud & SaaSHigh
Citrix NetScaler Gateway Memory Buffer Overflow Added to CISA Known Exploited Catalog
CISA issued a binding directive on CVE-2026-8452, a high-severity memory buffer vulnerability in Citrix NetScaler ADC and Gateway appliances triggering perimeter denial of service.
Priya Raman15 Sep 2026, 00:15 IST7 min read
ThreatsHealthcare & PharmaBreaking
CISA Warns of Critical RCE Flaws in NextGen Mirth Connect Threatening Hospital HL7 Pipelines
CISA published an urgent medical ICS advisory detailing critical RCE vulnerabilities in NextGen Mirth Connect integration engines routing hospital clinical records.
Priya Raman14 Sep 2026, 19:30 IST8 min read
ThreatsTechnology, Cloud & SaaSCritical
Broadcom Discloses Critical VMware Hypervisor Escape Flaws in Workstation and Fusion
Broadcom issued critical fixes for VMware Workstation and Fusion addressing CVE-2026-59346, an out-of-bounds write flaw in VMXNET3 allowing guest-to-host breakouts.
Priya Raman14 Sep 2026, 17:30 IST8 min read
ThreatsTechnology, Cloud & SaaSBreaking
Ivanti Patches Critical Remote Code Execution Flaw in Neurons for ITSM Infrastructure
Ivanti released emergency security patches addressing CVE-2026-12650, an unauthenticated deserialization RCE vulnerability in Neurons for ITSM on-premise deployments.
Priya Raman14 Sep 2026, 16:45 IST8 min read
NewsGovernment & DefenceHigh
Florida DMV confirms DAVID driver database breach after officer credentials compromised on personal device
Florida’s motor vehicle department confirmed an intrusion into its DAVID database after an officer’s credentials were stolen by infostealers; ShinyHunters claims 200,000+ driver records.
Priya Raman14 Sep 2026, 15:00 IST5 min read
ThreatsRetail & E-commerceBreaking
Adobe warns of exploited Commerce and Magento RCE — patch CVE-2026-75650 now
Adobe says attackers are exploiting a critical, unauthenticated Commerce and Magento flaw. Merchants should apply the vendor hotfix and rotate exposed secrets.
Priya Raman13 Sep 2026, 09:53 IST6 min read
ThreatsTechnology, Cloud & SaaSCritical
Threat actors actively exploit Langflow AI orchestration flaws to steal cloud API keys and deploy miners
Vulnerability researchers observe mass automated scanning and exploitation of Langflow AI visual frameworks, exfiltrating OpenAI and AWS secrets while deploying botnets.
Priya Raman12 Sep 2026, 20:40 IST6 min read
NewsHealthcare & PharmaBreaking
IDScan.net says customer information in cloud accounts may have been accessed
IDScan.net says an unauthorized party may have accessed or copied cloud-account customer information, including names and government ID numbers.
Priya Raman12 Sep 2026, 19:20 IST5 min read
InsightsTechnology, Cloud & SaaSBreaking
OpenAI positions Daybreak as a governed loop for AI-assisted cyber defense
OpenAI says Daybreak combines models, Codex Security and human oversight into a governed loop for inventory, validation, remediation and proof.
Priya Raman12 Sep 2026, 19:00 IST6 min read
ResearchTechnology, Cloud & SaaSCritical
GitSpawn flaws in AI coding agents execute arbitrary code from malicious repository configurations
Manifold Security discovers GitSpawn: eight vulnerabilities across seven AI coding tools (Claude Code, Cursor, Codex) that execute attacker code from repository .git/config.
Priya Raman12 Sep 2026, 16:00 IST7 min read
ThreatsIndustrial, OT & IoTBreaking
Two 9.8 Check Point VPN flaws put the perimeter back on the emergency patch queue
Two CVSS 9.8 Check Point VPN certificate flaws can enable unauthenticated RCE. Identify exposed gateways, apply hotfixes and review the perimeter now.
Priya Raman12 Sep 2026, 14:00 IST5 min read
ThreatsTechnology, Cloud & SaaSBreaking
GitLab fixes maximum-severity CVSS 10.0 file-read flaw as in-the-wild exploitation begins
GitLab pushed emergency patches for CVE-2026-85706, an unauthenticated CVSS 10.0 path traversal flaw in the repository commits API that allows remote file extraction.
Priya Raman12 Sep 2026, 13:30 IST6 min read
InsightsGovernment & Defence
CISA BOD 26-04 ends CVSS-ordered patching: the four questions that replace it
CISA's Binding Operational Directive 26-04 drops CVSS from federal patch prioritisation, replacing it with four yes/no questions and a sixteen-row deadline table.
Priya Raman11 Sep 2026, 13:45 IST7 min read
ThreatsTechnology, Cloud & SaaSCritical
FortiClient EMS CVE-2026-35616: the hotfix window was not the dangerous part
Fortinet's emergency hotfix for CVE-2026-35616 blocked the attack path without fixing the flaw, and the complete patch that followed needed its own re-release.
Priya Raman10 Sep 2026, 21:50 IST6 min read
InsightsTechnology, Cloud & SaaSHigh
SharePoint 2016/2019 is unpatchable now. Exchange has until 31 October.
SharePoint Server 2016 and 2019 lost support on 14 July 2026 with no paid ESU on offer. Exchange 2016/2019 has until 31 October. Here is how to contain both.
Priya Raman10 Sep 2026, 15:00 IST6 min read
InsightsTechnology, Cloud & SaaSHigh
The agentic AI security gap: 83% are deploying, 29% feel ready
Prompt injection is now OWASP’s top LLM risk with reported success rates of 50–84%. Organisations are shipping agents into production well ahead of their controls.
Priya Raman10 Sep 2026, 13:00 IST8 min read
GuidesTechnology, Cloud & SaaS
Playbook: surviving a 900-CVE Patch Tuesday without breaking your change process
A repeatable triage model for very large monthly releases — what to expedite, what to schedule, and how to prove coverage afterwards.
Priya Raman10 Sep 2026, 01:30 IST8 min read
ThreatsTechnology, Cloud & SaaSBreaking
Microsoft ships 973 fixes in September Patch Tuesday, two flaws already exploited
Microsoft’s September 2026 rollup addresses 973 CVEs, including two elevation-of-privilege bugs — in the Windows Update Stack and ALPC — confirmed under active attack.
Priya Raman10 Sep 2026, 00:00 IST7 min read
ThreatsTechnology, Cloud & SaaSCritical
SAP OVERPASS: CVSS 10.0 Kernel Flaw Enables Pre-Auth Remote Code Execution
SAP and Onapsis disclosed OVERPASS (CVE-2026-44756), a maximum-severity kernel flaw in Extended Passport processing enabling unauthenticated root RCE on enterprise ERP hosts.
Priya Raman9 Sep 2026, 20:00 IST6 min read
InsightsTechnology, Cloud & SaaSHigh
88% Had an AI Agent Incident. 82% Believe Their Policy Covers It.
Gravitee says 88% of organisations had a confirmed or suspected AI agent incident, while 82% of executives trust their policy. Both figures, one population.
Priya Raman9 Sep 2026, 15:50 IST6 min read
ResearchEducation & Academia
Breakout time falls to 72 minutes — and most SOCs are not built for it
The 2026 benchmark from foothold to active exfiltration is 72 minutes, a fourfold reduction. Human-paced triage no longer fits inside the window.
Priya Raman5 Sep 2026, 21:30 IST7 min read
ThreatsTechnology, Cloud & SaaSHigh
Enterprise app CVE roundup: PeopleSoft, cPanel, Artifactory and Switchvox all need attention
Four high-severity vulnerabilities in widely deployed enterprise software — including a build-artefact repository that sits directly in the software supply chain.
Priya Raman4 Sep 2026, 16:00 IST6 min read