1,062 articles
Gov / DefenseCISA Advisory ICSA-26-281-01 details a critical heap corruption vulnerability in Honeywell Experion PKS distributed control systems.
Threat IntelCloudflare security advisory details a rule engine normalization defect enabling request smuggling and WAF inspection bypass.
Gov / DefenseCISA Advisory ICSA-26-280-01 details a critical authentication bypass in Rockwell Automation FactoryTalk VantagePoint manufacturing analytics servers.
OT / SCADACISA Advisory ICSA-26-279-01 details a critical denial of service flaw in Siemens SIMATIC S7-1500 and ET 200SP programmable logic controllers.
Threat IntelNVIDIA Product Security advisory addresses a critical memory corruption defect in Triton Inference Server enabling code execution across enterprise AI clusters.
GoogleGoogle Cloud security bulletin resolves a filter evasion flaw in Vertex AI Prompt Armor allowing jailbreak payload delivery to enterprise RAG agents.
Gov / DefenseCISA Advisory ICSA-26-278-02 details a critical memory corruption vulnerability in Schneider Electric Modicon M580 and M340 industrial controllers.
AWS CloudAWS Security Bulletin details an authorization validation defect in S3 Multi-Region Access Point endpoints permitting IAM privilege escalation.
MicrosoftMicrosoft MSRC advisory documents a critical model-context-protocol tool injection flaw in Azure AI Foundry enabling indirect agentic tool hijacking.
Gov / DefenseCISA Advisory ICSA-26-274-05 details a critical authentication bypass flaw in Johnson Controls EasyIO Neo EC and CW series building automation controllers.
Threat IntelA security defect in Ollama experimental agent mode allowed command chaining operators to bypass confirmation gates and execute arbitrary shell commands.
LinuxAttackers are weaponizing an exploit chain in Zammad helpdesk combining session fixation (CVE-2026-102489) with root privilege escalation (CVE-2026-102490).
GoogleGoogle published the Android October 2026 bulletin fixing high-severity System elevation of privilege flaws (CVE-2026-28640) requiring zero user interaction.
GoogleGoogle released Chrome 154.0.8037.97 resolving a critical out-of-bounds write flaw in WebGL (CVE-2026-103628) that exposes memory to arbitrary code execution.
AWS CloudCVE-2026-103956 in AWS Labs Loom (CVSS 10.0) let any network client act as super-admin on IdP-less deployments. Two SSRF flaws leaked tokens. Upgrade to 1.7.0+.
Threat IntelKiteworks fixed a CVSS 10 root code-execution flaw in Email Protection Gateway (CVE-2026-54154) and three 9.8 account takeovers. Upgrade EPG and Core to 9.5.1.
Threat IntelMetaMCP CVE-2026-79538 (9.8) and CVE-2026-79537 (9.1) enable container code execution and cross-tenant MCP tool hijacking. No patch exists; mitigations inside.
KubernetesDell DSA-2026-448 fixes two CVSS 10 missing-authentication flaws in Container Storage Modules that expose storage admin credentials. Upgrade CSM to 1.18.0.
Citrix NetScalerCitrix fixes CVE-2026-88779, a SAML memory overflow that crashes NetScaler ADC and Gateway. Last week's 14.1-73.37 and 13.1-64.23 builds are still vulnerable.
MicrosoftExchange Server CVE-2026-96940 lets authenticated users read other mailboxes. Microsoft rates it Exploitation More Likely. Install the September 2026 v2 SU.
Threat IntelLiteLLM CVE-2026-93355 lets a signed JWT with an unverified email claim seize any account, including proxy_admin. No fix yet; cache-leak and SSRF CVEs patched.
KubernetesSUSE Rancher CVE-2026-88804 (CVSS 9.6) lets unauthenticated attackers rewrite UI settings, plant login-page script and take over managed Kubernetes clusters.
Threat IntelHPE bulletin HPESBNW05150 fixes 18 Instant On AP flaws, including two CVSS 9.8 unauthenticated RCE bugs (CVE-2026-76721, CVE-2026-76722). Update to 3.4.2.0.
Threat IntelA critical heap buffer overflow in Apache Thrift C++ THeaderTransport allows remote adversaries to corrupt memory during ZLIB frame decompression.