1,167 articles
AWS CloudAWS resolves high-severity vulnerability CVE-2026-18394 in Strands Agents Tools, where indirect prompt injection forces AI agents to exfiltrate bearer credentials via malicious proxy parameters.
Cyber AttackBiotechnology giant Amgen files SEC Form 8-K Item 1.05 after unauthorized actors infiltrated third-party cloud environments and exfiltrated sensitive patient PHI and clinical research data.
AWS CloudAWS patches medium-severity flaw CVE-2026-89090 in AWS SDK for Go v2, where malformed event stream response frames trigger unrecovered runtime panics and service crashes.
Active ExploitZyxel patches actively exploited stack buffer overflow flaw CVE-2026-7273 in GS1900 smart switches, enabling unauthenticated LAN attackers to execute arbitrary code.
Threat IntelCritical path traversal vulnerability CVE-2026-37007 in CrewAI FileWriterTool allows autonomous agents to be manipulated into executing arbitrary code on host systems.
Threat IntelOracle's Critical Security Patch Update fixes maximum-severity CVSS 10.0 flaw CVE-2026-83021 in WebLogic Server Core enabling unauthenticated remote takeover.
MicrosoftMicrosoft patches important command injection flaw CVE-2026-83948 in Azure CLI, requiring customer updates to prevent remote code execution in CI/CD pipelines.
Threat IntelSecuronix uncovers TASK#STOMP campaign leveraging Living-off-the-Land VBScript stagers, masqueraded Scheduled Tasks, and resilient dual-PowerShell backdoors.
Threat IntelCritical code validation bypass flaw CVE-2026-0768 in Langflow AI orchestration platform allows unauthenticated remote attackers to execute arbitrary system commands.
Check PointHigh-severity vulnerability CVE-2026-50195 in containerd allows privileged containers to poison the host image cache via CRI Checkpoint API tar archive injection.
AWS CloudAWS patches vulnerabilities CVE-2026-87912 and CVE-2026-87913 in DevSecOps security agents and Model Context Protocol servers where predictable bucket names permit source code theft.
Threat IntelCritical CVSS 9.1 flaw CVE-2026-48746 in vLLM allows unauthenticated remote attackers to bypass API key verification and access model completions due to URL normalization defects.
Active ExploitThreat actors actively weaponize high-severity flaw CVE-2026-33626 in LMDeploy within hours of release, using multimodal image loaders as SSRF proxies into cloud metadata.
GoogleGoogle Cloud resolves high-severity SSRF vulnerability CVE-2026-19486 in Gemini Enterprise Agent Platform App Builder allowing attackers to harvest GCP IAM service account tokens.
Threat IntelCritical CVSS 9.8 flaw CVE-2026-30623 in LiteLLM allows remote attackers to execute arbitrary operating system commands via unvalidated Model Context Protocol server parameters.
MicrosoftMicrosoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-48567 in Azure HorizonDB allowing network attackers to bypass authentication and seize cluster control.
MicrosoftAWS patches high-severity flaw CVE-2026-7461 in Amazon ECS Agent for Windows allowing container escape and SYSTEM command injection via FSx volume mounts.
Threat IntelSecurity researchers uncover critical flaw CVE-2026-7482 (Bleeding Llama) in Ollama GGUF model loader allowing remote memory exfiltration and credential leaks.
Agentic AIHacktron AI researchers demonstrate how Claude Opus 5 synthesized an ASLR-bypassing libheif exploit to breach OpenAI forum and pivot to internal repos.
MicrosoftMicrosoft patches high-severity flaw CVE-2026-47632 in Azure Connected Machine Agent allowing local privilege escalation on Azure Arc hybrid endpoints.
Threat IntelCrewAI maintainers resolve vulnerability CVE-2026-2275 in CodeInterpreter tool allowing arbitrary host command execution via malicious Python payloads.
GoogleGoogle Cloud resolves critical flaw CVE-2026-12710 in Application Integration QueryEngineTask allowing cross-tenant authorization bypass and IAM escalation.
Agentic AIOpen WebUI security release patches high-severity vulnerability CVE-2026-45672 allowing sandbox escapes and arbitrary host execution via crafted pipeline code.
Threat IntelHPE Aruba Networking resolves maximum-severity CVSS 9.8 flaw CVE-2026-63455 in EdgeConnect SD-WAN Orchestrator allowing unauthenticated network takeover.