Editor-in-Chief
Priya has covered enterprise security for over a decade, with a focus on vulnerability disclosure, incident response and the gap between vendor advisories and what defenders can actually action.
463 articles
Data BreachOncology medical technology leader Novocure files SEC Form 8-K Item 1.05 disclosing an unauthorized intrusion compromising clinical data and IT infrastructure.
OT / SCADASiemens issues advisory SSA-330084 for Desigo CC building management systems where improper input validation in graphics files allows arbitrary script execution.
Cyber AttackBoston Scientific files SEC Form 8-K Item 1.05 disclosing a material cybersecurity incident that caused global manufacturing halts and disrupted medical device supply chains.
Deep DiveCritical OAuth metadata flaw CVE-2026-63127 in rmcp Rust SDK allows rogue Model Context Protocol servers to capture enterprise agent tokens and impersonate identities.
Deep DiveEuropean financial regulators transition DORA enforcement to mandatory Threat-Led Penetration Testing (TLPT) and direct scrutiny of Critical ICT Third-Party Providers.
AWS CloudAWS and OpenSearch release security advisories for high-severity vulnerability CVE-2026-75897 in OpenSearch Dashboards enabling unauthenticated remote denial of service.
MicrosoftMicrosoft patches high-severity vulnerability CVE-2026-32193 in Azure Kubernetes Service allowing container workloads to escape sandboxes via path traversal.
CiscoCisco issues emergency software hardening release for Secure Firewall ASA, FTD, and FMC addressing actively exploited critical vulnerability CVE-2026-20329.
OT / SCADASiemens and CISA issue advisory ICSA-26-258-06 for Mendix SAML module vulnerability CVE-2026-80465 allowing unauthenticated remote attackers to hijack enterprise SSO accounts.
OT / SCADASchneider Electric and CISA warn of improper authentication validation in PowerChute Serial Shutdown allowing unauthorized actors to disrupt critical infrastructure power.
Threat IntelCISA orders emergency patching of PTC Windchill PLM vulnerability CVE-2026-12569 enabling unauthenticated remote code execution and CAD blueprint theft.
Active ExploitCISA orders federal agencies to patch Ubiquiti UniFi OS vulnerability CVE-2026-34909 enabling unauthenticated network configuration extraction and takeover.
Check PointCISA orders emergency patching of Check Point Security Gateway flaw CVE-2026-50751 enabling unauthenticated perimeter VPN bypass and network takeover.
Active ExploitCISA adds Splunk Enterprise vulnerability CVE-2026-20253 (CVSS 9.8) to KEV catalog following active exploitation targeting enterprise SIEM clusters.
MicrosoftCISA orders federal agencies to patch critical Microsoft SharePoint vulnerabilities CVE-2026-58644 and CVE-2026-56164 enabling unauthenticated remote code execution.
Agentic AIAnalysis of emerging frontier AI threat vectors: how indirect prompt injections in untrusted documents hijack tool-calling autonomous LLM agents.
LinuxCISA adds Red Hat ABRT vulnerability CVE-2015-5287 (CVSS 7.8) to KEV catalog following active exploitation against enterprise Linux host infrastructure.
Threat IntelCISA mandates urgent remediation of TrueConf Server vulnerability CVE-2026-72529 (CVSS 9.8) exploited in the wild to bypass administrative access controls.
Active ExploitCISA adds Acronis Backup plugin vulnerability CVE-2026-87886 (CVSS 9.8) to its KEV catalog following active exploitation against cPanel and Plesk hosting infrastructure.
Agentic AIOpenAI releases o1 red-teaming telemetry detailing chain-of-thought safety boundaries, autonomous cyber task planning risks, and the formation of the AI-ISAC.
CiscoCISA orders emergency patching of Cisco Identity Services Engine vulnerability CVE-2026-76460 (CVSS 9.8) enabling unauthenticated remote network policy takeover.
GoogleCISA adds Google Pixel baseband modem flaw CVE-2026-58704 to its KEV catalog following active zero-day exploitation against high-value target devices.
MicrosoftCISA adds Microsoft SharePoint Server deserialization flaw CVE-2026-50522 (CVSS 9.8) to its KEV catalog following active exploitation against enterprise document farms.
Active ExploitCISA adds Oracle E-Business Suite privilege management flaw CVE-2026-46817 (CVSS 9.8) to its KEV catalog following active exploitation against cloud ERP deployments.