1,167 articles
AWS CloudAWS Security Bulletin 2026-121-AWS addresses an argument injection defect in security-agent-mcp-server diff scanning that permits arbitrary file modification.
Threat IntelA security defect in Ollama experimental agent mode allowed command chaining operators to bypass confirmation gates and execute arbitrary shell commands.
LinuxAttackers are weaponizing an exploit chain in Zammad helpdesk combining session fixation (CVE-2026-102489) with root privilege escalation (CVE-2026-102490).
GoogleGoogle published the Android October 2026 bulletin fixing high-severity System elevation of privilege flaws (CVE-2026-28640) requiring zero user interaction.
GoogleGoogle released Chrome 154.0.8037.97 resolving a critical out-of-bounds write flaw in WebGL (CVE-2026-103628) that exposes memory to arbitrary code execution.
AWS CloudCVE-2026-103956 in AWS Labs Loom (CVSS 10.0) let any network client act as super-admin on IdP-less deployments. Two SSRF flaws leaked tokens. Upgrade to 1.7.0+.
Threat IntelKiteworks fixed a CVSS 10 root code-execution flaw in Email Protection Gateway (CVE-2026-54154) and three 9.8 account takeovers. Upgrade EPG and Core to 9.5.1.
Threat IntelMetaMCP CVE-2026-79538 (9.8) and CVE-2026-79537 (9.1) enable container code execution and cross-tenant MCP tool hijacking. No patch exists; mitigations inside.
KubernetesDell DSA-2026-448 fixes two CVSS 10 missing-authentication flaws in Container Storage Modules that expose storage admin credentials. Upgrade CSM to 1.18.0.
Citrix NetScalerCitrix fixes CVE-2026-88779, a SAML memory overflow that crashes NetScaler ADC and Gateway. Last week's 14.1-73.37 and 13.1-64.23 builds are still vulnerable.
MicrosoftExchange Server CVE-2026-96940 lets authenticated users read other mailboxes. Microsoft rates it Exploitation More Likely. Install the September 2026 v2 SU.
Threat IntelLiteLLM CVE-2026-93355 lets a signed JWT with an unverified email claim seize any account, including proxy_admin. No fix yet; cache-leak and SSRF CVEs patched.
KubernetesSUSE Rancher CVE-2026-88804 (CVSS 9.6) lets unauthenticated attackers rewrite UI settings, plant login-page script and take over managed Kubernetes clusters.
Threat IntelHPE bulletin HPESBNW05150 fixes 18 Instant On AP flaws, including two CVSS 9.8 unauthenticated RCE bugs (CVE-2026-76721, CVE-2026-76722). Update to 3.4.2.0.
DevSecOpsJapan, US, Australian and German agencies say DPRK's WaterPlum hit 30,000+ PCs and 7,000+ crypto wallets via fake job tests, npm malware and VS Code tasks.
GoogleGTIG's AI-era report: CVE disclosures doubled in 2026, 141 bugs exploited by August vs 127 in 2025, and 50% of AI-discovered flaws lead to RCE, per Google.
Threat IntelA critical heap buffer overflow in Apache Thrift C++ THeaderTransport allows remote adversaries to corrupt memory during ZLIB frame decompression.
Threat IntelA high-severity identity validation flaw in ProcessOne ejabberd allows authenticated users to impersonate any target user via unvalidated authzid tokens.
Threat IntelA critical stack-based buffer overflow in Fortra Core Privileged Access Manager BoKS autoregistration daemon allows unauthenticated remote code execution.
Threat IntelA critical use-after-free in Apache HTTP Server mod_http2 via shared session bucket brigades enables remote unauthenticated memory corruption.
Citrix NetScalerThreat actors are actively weaponizing memory buffer overflow and command injection flaws in Citrix NetScaler ADC to breach enterprise perimeter gateways.
Deep DiveA critical input validation deficiency in Bouncy Castle C# DHAgreement enables attackers to recover private keys and forge agreed cryptographic values.
Agentic AIOpenAI dismantled a coordinated campaign that weaponized cross-model replay queries across 15,000 accounts to illicitly extract encrypted chain-of-thought traces.
Threat IntelA critical flaw in Discord libdave allowed rogue participants to join end-to-end encrypted voice and video calls without roster verification, compromising media privacy.