Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

Search Subscribe

Industry vertical

Technology, Cloud & SaaS, page 7

Software companies, cloud platforms, data centres and managed services.

236 articlesUpdated 28 Sep 2026Page 7 of 10

ThreatsCloud & SaaSCritical
Microsoft ADFS Cloud Identity Privilege Escalation Flaw CVE-2026-56155 Under Active Exploitation
CISA flags Microsoft Active Directory Federation Services vulnerability CVE-2026-56155 (CVSS 9.8) exploited in attacks forging SAML claims across hybrid Azure clouds.
Daniel Okafor16 Sep 202610 min read
InsightsCloud & SaaS
Surge in SEC Form 8-K Cyber Filings: Cloud Storage Exfiltration & Extortion Forensics
Regulatory analysis of recent SEC 8-K Item 1.05 disclosures details how threat actors leverage leaked cloud credentials and misconfigured storage to steal enterprise data.
Priya Raman16 Sep 202612 min read
ThreatsCloud & SaaSCritical
Arista VeloCloud SD-WAN Orchestrator Critical Command Injection Flaw CVE-2026-16812 Exploited in the Wild
CISA adds CVE-2026-16812 to KEV, warning of active exploitation targeting on-premise Arista VeloCloud SD-WAN Orchestrator management appliances.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSCritical
N-able N-central MSP Platform Authentication Bypass Flaw Weaponized in Perimeter Attacks
CISA mandates immediate remediation of CVE-2026-18556, an unauthenticated alternate path bypass in N-able N-central allowing full MSP administrative takeover.
Daniel Okafor16 Sep 20269 min read
ThreatsCloud & SaaSHigh
Fortinet FortiOS SSL-VPN Sensitive Information Disclosure Flaw CVE-2025-68686 Actively Targeted for Initial Access
CISA updates KEV with CVE-2025-68686, a critical information disclosure vulnerability in Fortinet FortiOS exploited to harvest active VPN session tokens.
CST Newsroom16 Sep 20269 min read
ThreatsCloud & SaaSCritical
Cisco Secure Firewall ASA and FTD Critical Heap Inspection Flaw CVE-2026-20349 Weaponized in the Wild
CISA adds CVE-2026-20349 to KEV, warning of active exploitation targeting Cisco Secure Firewall ASA and FTD packet inspection engines.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSHigh
Microsoft Windows WinSock Driver Zero-Day Flaw CVE-2026-68820 Exploited by Ransomware Groups for SYSTEM Takeover
CISA warns of in-the-wild exploitation of CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys) granting SYSTEM privilege.
Daniel Okafor16 Sep 20269 min read
ThreatsCloud & SaaSCritical
Metabase Business Intelligence SQL Injection Flaw Exploited to Breach Analytics Warehouses
CISA alerts enterprises to active exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase analytics dashboards allowing database exfiltration.
CST Newsroom16 Sep 20269 min read
ThreatsCloud & SaaSCritical
JetBrains TeamCity Critical Deserialization Flaw Exploited in Active CI/CD Attacks
CISA orders federal agencies to patch CVE-2026-63077, an unauthenticated Java deserialization flaw enabling complete remote code execution on TeamCity CI/CD servers.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSCritical
IBM Langflow Visual AI Framework Remote Code Injection Vulnerability CVE-2026-9198 Exploited in Production Environments
CISA adds CVE-2026-9198 to KEV, warning of active remote code injection attacks weaponizing visual AI workflow builder IBM Langflow in enterprise environments.
Daniel Okafor15 Sep 20269 min read
ThreatsCloud & SaaSCritical
Progress LoadMaster Critical Root Command Injection Flaw CVE-2026-8037 Exploited for Perimeter Edge Takeover
CISA confirms in-the-wild exploitation of CVE-2026-8037, an unauthenticated command injection flaw granting root shell access on Progress LoadMaster appliances.
CST Newsroom15 Sep 20269 min read
InsightsCloud & SaaS
India DPDP Act Enforcement: Data Protection Board Sets Stringent Breach Notification Protocols and ₹250 Crore Penalty Matrix
The Data Protection Board of India establishes mandatory breach disclosure workflows, Significant Data Fiduciary obligations, and statutory ₹250 Crore penalties.
Daniel Okafor15 Sep 20269 min read
NewsCloud & SaaS
SEC Form 8-K Breach Analysis: Misconfigured Cloud Storage and IAM Role Assumption Fuel Enterprise Data Exfiltration Wave
Forensic examination of SEC Item 1.05 material cyber filings reveals how compromised IAM credentials and public S3/Blob storage enable rapid data exfiltration.
CST Newsroom15 Sep 20269 min read
ThreatsCloud & SaaSCritical
VMware vCenter Server Critical Path Traversal Flaw Exploited in Virtualization Attacks
CISA mandates urgent federal remediation as attackers weaponize CVE-2026-59310, an unauthenticated path traversal flaw granting root code execution on VMware vCenter appliances.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Apple macOS Screen Sharing Authentication Bypass Flaw Weaponized in Active Attacks
CISA confirms active exploitation of CVE-2026-65400, an unauthenticated network authentication bypass in Apple macOS Screen Sharing enabling remote desktop seizure.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Ray Distributed AI Framework Code Injection Flaw Exploited to Compromise AI Clusters
CISA issues an emergency directive on CVE-2025-62593, warning that unauthenticated code injection in Ray AI distributed computing clusters allows adversaries to seize GPU clusters and training models.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Microsoft Windows IKE Protocol Double-Free RCE Flaw Exploited in Active Network Attacks
CISA confirms active in-the-wild exploitation of CVE-2026-33824, an unauthenticated double-free memory corruption flaw in Windows IKE enabling remote root code execution over UDP 500.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
MLflow Open-Source AI Platform SSRF Flaw Weaponized to Exfiltrate Cloud Credentials
CISA issues urgent warning on CVE-2026-64849, a critical SSRF defect in open-source MLflow model registries allowing attackers to steal cloud IAM metadata and poison AI pipelines.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Ajax.NET Professional Object Deserialization Flaw Exploited for Remote Code Execution
Federal agencies and enterprise operators face urgent deadlines as CISA confirms active exploitation of CVE-2021-23758, an unauthenticated deserialization RCE in Ajax.NET Professional.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Oracle WebLogic Server & Proxy Plug-in Flaw Exploited to Bypass Access Controls
CISA adds CVE-2026-21962 to its KEV catalog, warning of active remote exploitation bypassing Oracle HTTP Server reverse proxy rules to seize WebLogic clusters.
Aisha Noor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Critical Zimbra Collaboration Suite OS Command Injection Flaw Exploited in In-the-Wild Attacks
Federal agencies face strict remediation deadlines as CISA confirms active exploitation of CVE-2026-73570, allowing unauthenticated adversaries to execute root shell commands on Zimbra mail servers.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
TrueConf Enterprise Video Server Remote Code Injection Flaw Weaponized in Enterprise Attacks
CISA warns of active exploitation targeting enterprise video conferencing systems via CVE-2026-72530, an unauthenticated remote code injection flaw on TrueConf port 4307.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Cisco Secure Email Gateway Critical SQL Injection Flaw Weaponized in Active Attacks
CISA mandates urgent federal remediation after confirming active exploitation of CVE-2026-76461, an unauthenticated SQL injection flaw granting root shell access on Cisco SEG appliances.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
JFrog Artifactory Path Traversal Flaw Enables Remote Cache Poisoning & Supply Chain Attacks
CISA adds CVE-2026-66384 to its KEV catalog, warning that path traversal in JFrog Artifactory allows remote adversaries to overwrite Docker layers and poison enterprise build pipelines.
Priya Raman15 Sep 20268 min read

Threat scope

DevOps pipelines, cloud IAM, package registries, Kubernetes clusters and zero-day vulnerabilities.

Free newsletter

The Daily Brief

The exploited vulnerabilities, patch priorities and regulatory changes worth acting on, in one short email.

Exploited CVEs, with affected products and patch status
Patch priorities ranked by real-world exploitation
Regulatory changes: CERT-In, RBI, DPDP, DORA, NIS2

FreeOne email per weekdayUnsubscribe anytime

See a sample issue Privacy policy