Section

Threats, page 4

Vulnerability intelligence, exploited CVEs, malware families and live campaigns — with the detection guidance and mitigations defenders need first.

231 articlesUpdated 28 Sep 2026Page 4 of 10

ThreatsIndustrial & OTHigh
Rockwell Automation Logix Controllers Flaw CVE-2026-9637 Triggers Fatal Faults via Malicious CIP Message Frames
CISA and Rockwell Automation issue advisory ICSA-26-244-03 for ControlLogix and CompactLogix PLCs where CIP message parsing flaws trigger fatal controller crashes.
Daniel Okafor22 Sep 202616 min read
ThreatsCloud & SaaSHigh
TASK#STOMP Malware Campaign Deploys Living-off-the-Land PowerShell Backdoor with Timestomping and Redundant Task Scheduler Persistence
Securonix uncovers TASK#STOMP campaign leveraging Living-off-the-Land VBScript stagers, masqueraded Scheduled Tasks, and resilient dual-PowerShell backdoors.
Daniel Okafor21 Sep 202615 min read
ThreatsCloud & SaaSCritical
Langflow Custom Component Code Validator Flaw CVE-2026-0768 Weaponized for Remote Code Execution Across AI Pipelines
Critical code validation bypass flaw CVE-2026-0768 in Langflow AI orchestration platform allows unauthenticated remote attackers to execute arbitrary system commands.
Mei-Lin Chen21 Sep 202616 min read
ThreatsCloud & SaaSHigh
containerd CRI Checkpoint Flaw CVE-2026-50195 Enables Local Node Image Cache Poisoning Across Kubernetes Clusters
High-severity vulnerability CVE-2026-50195 in containerd allows privileged containers to poison the host image cache via CRI Checkpoint API tar archive injection.
Aisha Noor21 Sep 202615 min read
ThreatsIndustrial & OTHigh
Siemens Desigo CC Building Automation Platform Flaw CVE-2026-34223 Exposes Supervisory Workstations to Arbitrary Script Execution
Siemens issues advisory SSA-330084 for Desigo CC building management systems where improper input validation in graphics files allows arbitrary script execution.
Priya Raman21 Sep 202614 min read
ThreatsCloud & SaaSHigh
AWS Security Agent and MCP Server Flaws CVE-2026-87912 and CVE-2026-87913 Allow S3 Bucket Squatting to Intercept Private Source Code
AWS patches vulnerabilities CVE-2026-87912 and CVE-2026-87913 in DevSecOps security agents and Model Context Protocol servers where predictable bucket names permit source code theft.
Aisha Noor21 Sep 202614 min read
ThreatsCloud & SaaSCritical
vLLM Inference Server Authentication Bypass Flaw CVE-2026-48746 Exposes Enterprise Model Endpoints Without API Keys
Critical CVSS 9.1 flaw CVE-2026-48746 in vLLM allows unauthenticated remote attackers to bypass API key verification and access model completions due to URL normalization defects.
Mei-Lin Chen21 Sep 202614 min read
ThreatsCloud & SaaSHigh
LMDeploy Vision-Language Model Flaw CVE-2026-33626 Exploited in the Wild to Breach Internal Cloud Networks
Threat actors actively weaponize high-severity flaw CVE-2026-33626 in LMDeploy within hours of release, using multimodal image loaders as SSRF proxies into cloud metadata.
Mei-Lin Chen21 Sep 202614 min read
ThreatsCloud & SaaSHigh
Google Cloud Gemini Agent App Builder Flaw CVE-2026-19486 Leaks Compute Engine Service Account Tokens
Google Cloud resolves high-severity SSRF vulnerability CVE-2026-19486 in Gemini Enterprise Agent Platform App Builder allowing attackers to harvest GCP IAM service account tokens.
Aisha Noor21 Sep 202615 min read
ThreatsIndustrial & OTCritical
Siemens Industrial Edge Management Flaw CVE-2026-18963 Enables Remote Takeover of Factory Control Systems
Siemens ProductCERT issues advisory SSA-503852 for critical CVSS 9.1 flaw CVE-2026-18963 in Industrial Edge Management allowing unauthenticated attackers to seize administrative accounts.
Daniel Okafor21 Sep 202615 min read
ThreatsCloud & SaaSCritical
LiteLLM MCP Server Creation Flaw CVE-2026-30623 Enables Remote Code Execution via Malicious Tool Configurations
Critical CVSS 9.8 flaw CVE-2026-30623 in LiteLLM allows remote attackers to execute arbitrary operating system commands via unvalidated Model Context Protocol server parameters.
Mei-Lin Chen21 Sep 202614 min read
ThreatsCloud & SaaSCritical
Azure HorizonDB Critical Flaw CVE-2026-48567 Allows Complete Authentication Bypass via Token Spoofing
Microsoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-48567 in Azure HorizonDB allowing network attackers to bypass authentication and seize cluster control.
Aisha Noor21 Sep 202615 min read
ThreatsIndustrial & OTHigh
Schneider Electric Modicon M340 PLCs and Ethernet Modules Vulnerable to Remote Denial of Service via FTP Flaw CVE-2025-6625
CISA and Schneider Electric issue advisory for CVE-2025-6625 in Modicon M340 PLCs and BMX communication modules, where malformed FTP commands halt controller operations.
Daniel Okafor21 Sep 202614 min read
ThreatsCloud & SaaSHigh
Amazon ECS Agent Flaw CVE-2026-7461 Permits Command Injection and Host Takeover on Windows Clusters
AWS patches high-severity flaw CVE-2026-7461 in Amazon ECS Agent for Windows allowing container escape and SYSTEM command injection via FSx volume mounts.
Mei-Lin Chen21 Sep 202613 min read
ThreatsCloud & SaaSCritical
Critical Ollama GGUF Loader Flaw CVE-2026-7482 Leaks API Keys and Enterprise Inference Memory
Security researchers uncover critical flaw CVE-2026-7482 (Bleeding Llama) in Ollama GGUF model loader allowing remote memory exfiltration and credential leaks.
CST Newsroom21 Sep 202613 min read
ThreatsIndustrial & OTHigh
Rockwell Automation Redundancy Tool Flaws Permit Local Privilege Escalation on Industrial Control Workstations
Rockwell Automation and CISA issue advisory ICSA-26-244-02 detailing privilege escalation flaws CVE-2026-9634 in Redundancy Module Configuration Tool.
CST Newsroom21 Sep 202612 min read
ThreatsCloud & SaaSCritical
Security Researchers Leverage Claude Opus 5 to Defeat ASLR in libheif RCE and Infiltrate OpenAI Perimeter
Hacktron AI researchers demonstrate how Claude Opus 5 synthesized an ASLR-bypassing libheif exploit to breach OpenAI forum and pivot to internal repos.
CST Newsroom21 Sep 202614 min read
ThreatsIndustrial & OTCritical
Hitachi Energy FACTS Control Platform Flaws Permit Remote Code Injection Across Electric Transmission Grids
Hitachi Energy notification 8DBD000229 details critical CVSS 9.9 flaws in FACTS Control Platform GWS enabling remote code injection in power grid SCADA.
CST Newsroom21 Sep 202614 min read
ThreatsCloud & SaaSHigh
Azure Connected Machine Agent Flaw CVE-2026-47632 Enables Local Privilege Escalation Across Hybrid Server Workloads
Microsoft patches high-severity flaw CVE-2026-47632 in Azure Connected Machine Agent allowing local privilege escalation on Azure Arc hybrid endpoints.
Mei-Lin Chen21 Sep 202613 min read
ThreatsCloud & SaaSHigh
CrewAI CodeInterpreter Sandbox Escape Vulnerability CVE-2026-2275 Enables Remote Command Injection in Multi-Agent Pipelines
CrewAI maintainers resolve vulnerability CVE-2026-2275 in CodeInterpreter tool allowing arbitrary host command execution via malicious Python payloads.
CST Newsroom21 Sep 202612 min read
ThreatsCloud & SaaSCritical
Google Cloud Application Integration QueryEngineTask Flaw Permits Cross-Project Authorization Bypass
Google Cloud resolves critical flaw CVE-2026-12710 in Application Integration QueryEngineTask allowing cross-tenant authorization bypass and IAM escalation.
Mei-Lin Chen20 Sep 202613 min read
ThreatsCloud & SaaSHigh
Open WebUI Code Execution Guardrail Bypass Enables Remote Command Injection in Enterprise LLM Workspaces
Open WebUI security release patches high-severity vulnerability CVE-2026-45672 allowing sandbox escapes and arbitrary host execution via crafted pipeline code.
CST Newsroom20 Sep 202612 min read
ThreatsIndustrial & OTHigh
Schneider Electric EcoStruxure IT Data Center Expert Flaw Exposes Critical Infrastructure Telemetry to XXE Attacks
Schneider Electric advisory SEVD-2026-160-01 details high-severity XXE flaw CVE-2026-8045 in EcoStruxure IT Data Center Expert enabling data exfiltration.
CST Newsroom20 Sep 202613 min read
ThreatsCloud & SaaSCritical
Critical HPE EdgeConnect SD-WAN Orchestrator Authentication Bypass Exposes Enterprise Network Fabrics
HPE Aruba Networking resolves maximum-severity CVSS 9.8 flaw CVE-2026-63455 in EdgeConnect SD-WAN Orchestrator allowing unauthenticated network takeover.
Mei-Lin Chen20 Sep 202614 min read