Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

Search Subscribe

Industry vertical

Technology, Cloud & SaaS, page 3

Software companies, cloud platforms, data centres and managed services.

236 articlesUpdated 28 Sep 2026Page 3 of 10

ThreatsCloud & SaaSCritical
Critical F5 BIG-IP APM Heap Overflow Weaponized to Hijack Enterprise Gateway Data Planes CVE-2026-94127
F5 confirms active zero-day exploitation of CVE-2026-94127, a critical heap buffer overflow in BIG-IP APM OAuth gateways allowing unauthenticated remote code execution.
CST Newsroom23 Sep 202617 min read
ThreatsCloud & SaaSCritical
Google Cloud Patches Critical GKE Multi-Cloud Flaw Enabling Cross-Project Cluster Hijack and Service Account Impersonation
Google Cloud remediates critical GCP-2026-058 flaw in GKE Multi-Cloud APIs where missing project checks enabled unauthorized cluster registration and IAM impersonation.
CST Newsroom23 Sep 202616 min read
ThreatsCloud & SaaSHigh
BragJack Prompt Forcing Flaws in Chrome and Edge Allow Malicious Extensions to Seize Agentic Browser Control Planes
Security researchers demonstrate BragJack prompt forcing attacks against Chrome and Edge, hijacking agentic AI control planes to exfiltrate files and spy via camera.
Mei-Lin Chen23 Sep 202617 min read
InsightsGov & Defence
EU NIS2 Directive Enforcement Mandates 24-Hour Incident Reporting and C-Suite Liability Across 18 Critical Sectors
The European Union enacts NIS2 Directive enforcement, establishing mandatory 24-hour incident notifications, personal C-suite liability, and strict supply chain audits.
CST Newsroom22 Sep 202617 min read
ThreatsCloud & SaaSHigh
OpenNext Cloudflare Adapter Flaw Enables Server-Side Request Forgery and Private Cache Disclosure CVE-2026-3125
Cloudflare and OpenNext patch high-severity flaw CVE-2026-3125, where path normalization bypasses allow attackers to trigger SSRF and extract private Next.js cache assets.
CST Newsroom22 Sep 202615 min read
ThreatsCloud & SaaSHigh
Strands Agents Tools HTTP Request Authorization Flaw Enables Indirect Prompt Injection Credential Theft CVE-2026-18394
AWS resolves high-severity vulnerability CVE-2026-18394 in Strands Agents Tools, where indirect prompt injection forces AI agents to exfiltrate bearer credentials via malicious proxy parameters.
CST Newsroom22 Sep 202615 min read
NewsHealthcare & Pharma
Amgen Discloses Unauthorized Cloud Data Exfiltration and Patient PHI Theft in SEC Form 8-K Filing
Biotechnology giant Amgen files SEC Form 8-K Item 1.05 after unauthorized actors infiltrated third-party cloud environments and exfiltrated sensitive patient PHI and clinical research data.
CST Newsroom22 Sep 202616 min read
ThreatsCloud & SaaSHigh
AWS SDK for Go v2 Event Stream Header Decoder Flaw Triggers Remote Denial of Service Panic CVE-2026-89090
AWS patches medium-severity flaw CVE-2026-89090 in AWS SDK for Go v2, where malformed event stream response frames trigger unrecovered runtime panics and service crashes.
CST Newsroom22 Sep 202614 min read
ThreatsCloud & SaaSHigh
Zyxel GS1900 Smart Managed Switches Exploited in the Wild via CGI Stack Buffer Overflow Flaw CVE-2026-7273
Zyxel patches actively exploited stack buffer overflow flaw CVE-2026-7273 in GS1900 smart switches, enabling unauthenticated LAN attackers to execute arbitrary code.
Daniel Okafor22 Sep 202615 min read
ThreatsCloud & SaaSHigh
CrewAI Multi-Agent Framework Flaw CVE-2026-37007 Allows Remote Code Execution via Path Traversal Tool Poisoning
Critical path traversal vulnerability CVE-2026-37007 in CrewAI FileWriterTool allows autonomous agents to be manipulated into executing arbitrary code on host systems.
Mei-Lin Chen22 Sep 202616 min read
ThreatsCloud & SaaSCritical
Critical Oracle WebLogic Server Flaw CVE-2026-83021 Allows Unauthenticated Remote Code Execution Across Enterprise Java Clusters
Oracle's Critical Security Patch Update fixes maximum-severity CVSS 10.0 flaw CVE-2026-83021 in WebLogic Server Core enabling unauthenticated remote takeover.
Priya Raman22 Sep 202617 min read
ThreatsCloud & SaaSHigh
Microsoft Azure CLI Command Injection Vulnerability CVE-2026-83948 Exposes Cloud CI/CD Automation Runners
Microsoft patches important command injection flaw CVE-2026-83948 in Azure CLI, requiring customer updates to prevent remote code execution in CI/CD pipelines.
Aisha Noor22 Sep 202614 min read
ThreatsCloud & SaaSHigh
TASK#STOMP Malware Campaign Deploys Living-off-the-Land PowerShell Backdoor with Timestomping and Redundant Task Scheduler Persistence
Securonix uncovers TASK#STOMP campaign leveraging Living-off-the-Land VBScript stagers, masqueraded Scheduled Tasks, and resilient dual-PowerShell backdoors.
Daniel Okafor21 Sep 202615 min read
ThreatsCloud & SaaSCritical
Langflow Custom Component Code Validator Flaw CVE-2026-0768 Weaponized for Remote Code Execution Across AI Pipelines
Critical code validation bypass flaw CVE-2026-0768 in Langflow AI orchestration platform allows unauthenticated remote attackers to execute arbitrary system commands.
Mei-Lin Chen21 Sep 202616 min read
ThreatsCloud & SaaSHigh
containerd CRI Checkpoint Flaw CVE-2026-50195 Enables Local Node Image Cache Poisoning Across Kubernetes Clusters
High-severity vulnerability CVE-2026-50195 in containerd allows privileged containers to poison the host image cache via CRI Checkpoint API tar archive injection.
Aisha Noor21 Sep 202615 min read
ThreatsCloud & SaaSHigh
AWS Security Agent and MCP Server Flaws CVE-2026-87912 and CVE-2026-87913 Allow S3 Bucket Squatting to Intercept Private Source Code
AWS patches vulnerabilities CVE-2026-87912 and CVE-2026-87913 in DevSecOps security agents and Model Context Protocol servers where predictable bucket names permit source code theft.
Aisha Noor21 Sep 202614 min read
ThreatsCloud & SaaSCritical
vLLM Inference Server Authentication Bypass Flaw CVE-2026-48746 Exposes Enterprise Model Endpoints Without API Keys
Critical CVSS 9.1 flaw CVE-2026-48746 in vLLM allows unauthenticated remote attackers to bypass API key verification and access model completions due to URL normalization defects.
Mei-Lin Chen21 Sep 202614 min read
ThreatsCloud & SaaSHigh
LMDeploy Vision-Language Model Flaw CVE-2026-33626 Exploited in the Wild to Breach Internal Cloud Networks
Threat actors actively weaponize high-severity flaw CVE-2026-33626 in LMDeploy within hours of release, using multimodal image loaders as SSRF proxies into cloud metadata.
Mei-Lin Chen21 Sep 202614 min read
ThreatsCloud & SaaSHigh
Google Cloud Gemini Agent App Builder Flaw CVE-2026-19486 Leaks Compute Engine Service Account Tokens
Google Cloud resolves high-severity SSRF vulnerability CVE-2026-19486 in Gemini Enterprise Agent Platform App Builder allowing attackers to harvest GCP IAM service account tokens.
Aisha Noor21 Sep 202615 min read
ThreatsCloud & SaaSCritical
LiteLLM MCP Server Creation Flaw CVE-2026-30623 Enables Remote Code Execution via Malicious Tool Configurations
Critical CVSS 9.8 flaw CVE-2026-30623 in LiteLLM allows remote attackers to execute arbitrary operating system commands via unvalidated Model Context Protocol server parameters.
Mei-Lin Chen21 Sep 202614 min read
ThreatsCloud & SaaSCritical
Azure HorizonDB Critical Flaw CVE-2026-48567 Allows Complete Authentication Bypass via Token Spoofing
Microsoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-48567 in Azure HorizonDB allowing network attackers to bypass authentication and seize cluster control.
Aisha Noor21 Sep 202615 min read
ThreatsCloud & SaaSHigh
Amazon ECS Agent Flaw CVE-2026-7461 Permits Command Injection and Host Takeover on Windows Clusters
AWS patches high-severity flaw CVE-2026-7461 in Amazon ECS Agent for Windows allowing container escape and SYSTEM command injection via FSx volume mounts.
Mei-Lin Chen21 Sep 202613 min read
ThreatsCloud & SaaSCritical
Critical Ollama GGUF Loader Flaw CVE-2026-7482 Leaks API Keys and Enterprise Inference Memory
Security researchers uncover critical flaw CVE-2026-7482 (Bleeding Llama) in Ollama GGUF model loader allowing remote memory exfiltration and credential leaks.
CST Newsroom21 Sep 202613 min read
ThreatsCloud & SaaSCritical
Security Researchers Leverage Claude Opus 5 to Defeat ASLR in libheif RCE and Infiltrate OpenAI Perimeter
Hacktron AI researchers demonstrate how Claude Opus 5 synthesized an ASLR-bypassing libheif exploit to breach OpenAI forum and pivot to internal repos.
CST Newsroom21 Sep 202614 min read

Threat scope

DevOps pipelines, cloud IAM, package registries, Kubernetes clusters and zero-day vulnerabilities.

Free newsletter

The Daily Brief

The exploited vulnerabilities, patch priorities and regulatory changes worth acting on, in one short email.

Exploited CVEs, with affected products and patch status
Patch priorities ranked by real-world exploitation
Regulatory changes: CERT-In, RBI, DPDP, DORA, NIS2

FreeOne email per weekdayUnsubscribe anytime

See a sample issue Privacy policy