1,437 articles
Threat IntelA critical vulnerability in the Langflow AI visual agent framework allows remote unauthenticated attackers to escape execution sandboxes and execute arbitrary Python code.
OT / SCADASiemens ProductCERT discloses a critical authentication bypass vulnerability in SIMATIC WinCC Open Architecture SCADA web interfaces affecting critical infrastructure.
Deep DiveThe European Union Cyber Resilience Act enters critical enforcement phases, requiring hardware OEMs and software vendors to maintain machine-readable SBOMs and report actively exploited flaws within 24 hours.
Threat IntelHashiCorp releases critical security bulletin for CVE-2026-50123 in Vault Enterprise, resolving a memory leak flaw in the Transit secrets engine exposing cryptographic keys.
OT / SCADACISA and Schneider Electric issue critical advisory for CVE-2026-50891 in EcoStruxure Geo SCADA Expert servers permitting unauthenticated remote root code execution.
Data BreachGlobal pharmaceutical enterprise files SEC Form 8-K disclosing a material cyber incident involving unauthorized exfiltration of proprietary Phase 3 clinical trial datasets.
Threat IntelAnthropic and open-source MCP maintainers resolve CVE-2026-49110, an indirect prompt injection vulnerability allowing unauthorized tool execution in agentic pipelines.
OT / SCADACISA industrial advisory ICSA-26-288-03 details high-severity flaw CVE-2026-49821 in Rockwell Automation ControlLogix 5580 controllers causing unrecoverable CPU hangs.
Deep DiveReserve Bank of India issues Master Direction mandating scheduled banks and payment operators to deploy automated mule account detection and 2-hour fraud holds.
MicrosoftMicrosoft MSRC releases critical patch for CVE-2026-47182 in Azure Kubernetes Service, resolving an eBPF verifier flaw in Cilium enabling pod escape to host kernel.
OT / SCADACISA issues industrial advisory ICSA-26-285-01 for Phoenix Contact FL SWITCH managed industrial network switches resolving critical firmware RCE CVE-2026-48192.
RansomwareGlobal maritime shipping conglomerate files SEC Form 8-K disclosing a material ransomware intrusion freezing container terminal logistics across international ports.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-46210 in IAM Identity Center where cached SCIM bearer tokens allowed cross-directory role synchronization bypass.
OT / SCADACISA and Emerson release urgent industrial advisory ICSA-26-283-02 for CVE-2026-46801, a critical authentication bypass in DeltaV DCS operator workstations.
Deep DiveThe European Union's NIS2 Directive enforces strict 24-hour early warning notifications and executive liability for critical entities facing major cyber incidents.
GoogleGoogle Cloud releases emergency advisory for CVE-2026-45129, resolving an internal metadata server proxy flaw in Cloud Run allowing cross-container token leakage.
OT / SCADACISA industrial advisory ICSA-26-278-02 discloses a critical stack-based buffer overflow (CVE-2026-43890) in Yokogawa CENTUM VP Human Interface Stations.
VulnerabilityDefense aerospace contractor files SEC Form 8-K disclosing a material cyber incident involving compromised enterprise OAuth application tokens and telemetry theft.
Threat IntelA critical flaw in vLLM distributed inference engine (CVE-2026-43109) allows unauthenticated network actors to poison PagedAttention KV caches and hijack model outputs.
OT / SCADACISA and ABB have issued an emergency industrial advisory for CVE-2026-42918, a critical remote code execution vulnerability in ABB Ability System 800xA controllers.
Deep DivePCI DSS v4.0.1 Requirement 6.4.3 and 11.6.1 enforcement mandates strict browser script inventory and tamper detection on all payment checkout pages.
Threat IntelGitHub Security Advisory documents an unauthenticated command injection defect in LlamaIndex Workflows agent tool calling pipelines.
Gov / DefenseCISA Advisory ICSA-26-281-01 details a critical heap corruption vulnerability in Honeywell Experion PKS distributed control systems.
VulnerabilitySEC Form 8-K disclosure details a major semiconductor intellectual property theft incident initiated via corporate SSO session token hijacking.