1,167 articles
MicrosoftMicrosoft discloses critical CVSS 10.0 flaw CVE-2026-69399 in Azure Arc, enabling unauthenticated attackers to exploit confused deputy proxies across hybrid cloud nodes.
Threat IntelA critical integer overflow flaw CVE-2026-86289 in the Ollama GGUF model decoder allows attackers to trigger memory corruption and remote code execution on AI inference clusters.
Active ExploitAdobe and CISA warn of active exploitation targeting CVE-2026-71362 in Adobe Commerce and Magento, enabling unauthenticated manipulation of checkout orders and customer data.
Deep DiveThe Data Protection Board of India establishes binding procedural codes for DPDP inquiries, mandating independent algorithmic audits and strict breach notification timelines.
Threat IntelWSO2 patches critical path traversal flaw CVE-2026-5430 across API Manager and Gateway platforms, preventing unauthenticated remote extraction of master credentials.
AWS CloudAWS resolves a container boundary escape flaw in Amazon ECS Container Agent that allowed unprivileged containers to intercept task metadata and assume host IAM roles.
Threat IntelHPE resolves critical flaw CVE-2026-38291 in Aruba EdgeConnect SD-WAN Orchestrator, allowing unauthenticated remote attackers to bypass auth and execute arbitrary code.
Deep DiveAn architectural vulnerability in Model Context Protocol (MCP) OAuth token passthrough allows malicious tool servers to impersonate users and hijack enterprise APIs.
GoogleGoogle Cloud discloses and mitigates a high-severity container escape flaw in GKE node kernels, preventing unprivileged workloads from compromising host nodes.
GoogleGoogle Cloud resolves a privilege escalation flaw in Compute Engine guest-oslogin that allowed users with compute.osLogin IAM permissions to gain root access.
MicrosoftMicrosoft mitigates maximum-severity CVSS 10.0 flaw CVE-2026-70352 in Azure AI Language Authoring, preventing unauthenticated remote tampering with enterprise AI models.
AWS CloudAWS publishes Bulletin 2026-094-AWS for high-severity flaw CVE-2026-84851 in Amazon Ion-C library, allowing attackers to exhaust stack memory and crash services.
AWS CloudAWS and OpenSearch release bulletin 2026-092-AWS for high-severity flaw CVE-2026-83497 in the SQL plugin allowing authenticated users to execute code via cursors.
MicrosoftMicrosoft discloses high-severity flaw CVE-2026-85917 in Azure AI Foundry allowing unauthenticated attackers to execute SSRF and elevate privileges over the network.
MicrosoftMicrosoft addresses CVSS 9.6 vulnerability CVE-2026-87701 in Azure Cosmos DB allowing authenticated attackers to execute downstream injection and elevate privileges.
Check PointCheck Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.
LinuxHigh-severity flaw CVE-2026-44222 in vLLM allows remote unauthenticated users to crash distributed GPU inference clusters via crafted multimodal tokens.
Active ExploitArista confirms active in-the-wild exploitation of CVSS 10.0 CVE-2026-93952, allowing unauthenticated attackers to hijack on-prem VeloCloud Orchestrators.
KubernetesA high-severity CVSS 8.8 path traversal vulnerability in oras-go allows malicious OCI container artifacts to escape extraction roots and execute arbitrary code.
Threat IntelF5 confirms active zero-day exploitation of CVE-2026-94127, a critical heap buffer overflow in BIG-IP APM OAuth gateways allowing unauthenticated remote code execution.
MicrosoftGoogle Cloud remediates critical GCP-2026-058 flaw in GKE Multi-Cloud APIs where missing project checks enabled unauthorized cluster registration and IAM impersonation.
MicrosoftSecurity researchers demonstrate BragJack prompt forcing attacks against Chrome and Edge, hijacking agentic AI control planes to exfiltrate files and spy via camera.
Deep DiveThe European Union enacts NIS2 Directive enforcement, establishing mandatory 24-hour incident notifications, personal C-suite liability, and strict supply chain audits.
Threat IntelCloudflare and OpenNext patch high-severity flaw CVE-2026-3125, where path normalization bypasses allow attackers to trigger SSRF and extract private Next.js cache assets.