1,167 articles
Threat IntelAnthropic and open-source MCP maintainers resolve CVE-2026-49110, an indirect prompt injection vulnerability allowing unauthorized tool execution in agentic pipelines.
MicrosoftMicrosoft MSRC releases critical patch for CVE-2026-47182 in Azure Kubernetes Service, resolving an eBPF verifier flaw in Cilium enabling pod escape to host kernel.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-46210 in IAM Identity Center where cached SCIM bearer tokens allowed cross-directory role synchronization bypass.
Deep DiveThe European Union's NIS2 Directive enforces strict 24-hour early warning notifications and executive liability for critical entities facing major cyber incidents.
GoogleGoogle Cloud releases emergency advisory for CVE-2026-45129, resolving an internal metadata server proxy flaw in Cloud Run allowing cross-container token leakage.
VulnerabilityDefense aerospace contractor files SEC Form 8-K disclosing a material cyber incident involving compromised enterprise OAuth application tokens and telemetry theft.
Threat IntelA critical flaw in vLLM distributed inference engine (CVE-2026-43109) allows unauthenticated network actors to poison PagedAttention KV caches and hijack model outputs.
Deep DivePCI DSS v4.0.1 Requirement 6.4.3 and 11.6.1 enforcement mandates strict browser script inventory and tamper detection on all payment checkout pages.
Threat IntelGitHub Security Advisory documents an unauthenticated command injection defect in LlamaIndex Workflows agent tool calling pipelines.
VulnerabilitySEC Form 8-K disclosure details a major semiconductor intellectual property theft incident initiated via corporate SSO session token hijacking.
Threat IntelCloudflare security advisory details a rule engine normalization defect enabling request smuggling and WAF inspection bypass.
Gov / DefenseCERT-In security advisory mandates multi-cloud redundancy, immutable backup vaults, and 6-hour incident disclosure across Indian financial institutions.
Threat IntelNVIDIA Product Security advisory addresses a critical memory corruption defect in Triton Inference Server enabling code execution across enterprise AI clusters.
GoogleGoogle Cloud security bulletin resolves a filter evasion flaw in Vertex AI Prompt Armor allowing jailbreak payload delivery to enterprise RAG agents.
Deep DiveEuropean Supervisory Authorities operationalize DORA TLPT frameworks, requiring banks and critical ICT providers to undergo advanced red-team audits.
Deep DiveContinuous zero-days in Citrix, Fortinet, and enterprise gateways demonstrate that reactive patching is failing. Only hardware MTE and Rust re-architectures offer an exit.
Deep DiveIndia activates Phase 2 of the Digital Personal Data Protection Act, introducing DPBI enforcement inquiries and penalties up to ₹250 Crore.
AWS CloudSEC Form 8-K disclosures reveal a surge in material cyber incidents driven by cloud identity theft and automated data lake exfiltration.
AWS CloudAWS Security Bulletin details an authorization validation defect in S3 Multi-Region Access Point endpoints permitting IAM privilege escalation.
Deep DiveDisparate incident reporting windows across the SEC, EU DORA, and India's RBI create a legal hazard for CISOs. Here is how enterprise response playbooks must adapt.
Agentic AIRecent CVEs in Ollama and AWS MCP reveal that semantic prompt filters cannot prevent tool injection. Engineering teams must isolate agent tools in ephemeral microVMs.
MicrosoftMicrosoft MSRC advisory documents a critical model-context-protocol tool injection flaw in Azure AI Foundry enabling indirect agentic tool hijacking.
Data BreachThe exfiltration of 8.8M Danish CPR records exposes the systemic risk of partner API queries. Security leaders must replace static trust with verifiable credentials.
AWS CloudAWS resolved a fail-open defect in Python Lambda Powertools data masking (CVE-2026-104002) that emitted unmasked sensitive records to logs during masking errors.