1,167 articles
GoogleGoogle Cloud Bulletin GCP-2026-057 warns of an Envoy Proxy safe_regex parsing flaw in Cloud Service Mesh causing negative RBAC authorization policies to fail open.
MicrosoftA critical vulnerability in Microsoft Entra ID allows authenticated users to manipulate assumed-immutable directory attributes and achieve Global Admin rights.
Threat IntelCritical authentication bypass and path traversal vulnerabilities in the Atlassian Model Context Protocol server allow unauthenticated attackers to read and exfiltrate host files.
AWS CloudAn out-of-bounds write defect in the AWS SDK for C++ Base64 decoder allows crafted inputs to corrupt heap memory and terminate cloud client processes.
Threat IntelA critical vulnerability in Langflow AI orchestration frameworks allows unauthenticated attackers to execute arbitrary code via insecure component endpoints.
LinuxAn integer overflow flaw in vLLM PagedAttention CUDA kernels allows concurrent inference requests to read sensitive prompt tokens across multi-tenant GPU memory.
AWS CloudA critical server-side request forgery flaw in LiteLLM AI proxies allows remote attackers to bypass egress restrictions and steal cloud instance credentials.
MicrosoftMicrosoft MSRC discloses high-severity 8.8 CVSS RCE flaw CVE-2026-70125 in Microsoft Outlook enabling arbitrary code execution via crafted compound documents.
AWS CloudAWS Security Bulletin 2026-084-AWS warns of authorization flaw CVE-2026-75910 in Athena ClickHouse connector allowing arbitrary Secrets Manager data leakage.
GoogleGoogle Cloud Bulletin GCP-2026-059 details missing authorization flaw CVE-2026-4644 in Integration Connectors enabling project-level privilege escalation.
AWS CloudAWS Security Bulletin 2026-075-AWS discloses critical path traversal flaw CVE-2026-18953 in aws-transform-mcp-server enabling unauthenticated arbitrary file overwrites.
Data BreachCalifornia enacts landmark SB 446 establishing a rigid 30-day consumer breach notice clock and mandatory 15-day Attorney General disclosures for enterprise intrusions.
PostgreSQLAWS Security Bulletin 2026-118-AWS warns of a critical type confusion flaw CVE-2026-96883 in open-source pgcollection enabling RCE in PostgreSQL database hosts.
Data BreachThe Data Protection Board of India issues operational directives detailing tiered penalties up to ₹250 Crore and mandatory personal data breach notification rules.
CMS SecurityWordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Agentic AISecurity researchers disclose CVE-2026-80347 in mcp-fetch, where unbracketed IPv6 parsing allows autonomous AI agents to be manipulated into internal cloud SSRF.
MicrosoftMicrosoft reclassifies CVE-2026-65660 as an 8.8 CVSS RCE flaw after threat actors bypass SharePoint SafeControls filtering to execute arbitrary .NET code.
AWS CloudAWS Security Bulletin 2026-115-AWS warns of a critical authorization flaw in AmazonConnectSalesforceLambda enabling unprivileged IAM users to execute arbitrary AWS APIs.
Threat IntelThreat actors weaponize MikroTik RouterOS flaw CVE-2026-67279 in the "MikroTrick" chain, bypassing SSH authentication to hijack core routing infrastructure.
AWS CloudAWS discloses high-severity SSRF flaw CVE-2026-15643 in the HealthLake MCP server, enabling attackers to leak temporary SigV4 IAM credentials and healthcare FHIR records.
Threat IntelA critical CVSS 9.4 path traversal flaw CVE-2026-41948 in Dify allows unauthenticated attackers to bypass workspace isolation and invoke internal Plugin Daemon APIs.
FortinetFortinet releases emergency fixes for critical CVSS 9.6 flaw CVE-2026-84388 in FortiPAM and its Chrome Extension, allowing remote attackers to hijack administrative sessions.
Threat IntelA critical TOCTOU race condition flaw CVE-2026-87996 in Open WebUI enables attackers to execute DNS rebinding SSRF attacks and harvest cloud metadata and credentials.
Cyber AttackHalliburton files SEC Form 8-K Item 1.05 detailing unauthorized corporate network access that forced critical energy infrastructure systems offline across global operations.