1,437 articles
AWS CloudAn out-of-bounds write defect in the AWS SDK for C++ Base64 decoder allows crafted inputs to corrupt heap memory and terminate cloud client processes.
OT / SCADACISA ICS Advisory ICSA-26-225-01 warns of an unsafe deserialization flaw in AVEVA Enterprise SCADA systems allowing remote code execution on critical control nodes.
Crypto / Web3Bitcoin Depot filed an SEC Form 8-K disclosing unauthorized access to IT systems and credential theft resulting in the exfiltration of 50.9 Bitcoin.
Threat IntelA critical vulnerability in Langflow AI orchestration frameworks allows unauthenticated attackers to execute arbitrary code via insecure component endpoints.
LinuxAn integer overflow flaw in vLLM PagedAttention CUDA kernels allows concurrent inference requests to read sensitive prompt tokens across multi-tenant GPU memory.
AWS CloudA critical server-side request forgery flaw in LiteLLM AI proxies allows remote attackers to bypass egress restrictions and steal cloud instance credentials.
MicrosoftMicrosoft MSRC discloses high-severity 8.8 CVSS RCE flaw CVE-2026-70125 in Microsoft Outlook enabling arbitrary code execution via crafted compound documents.
AWS CloudAWS Security Bulletin 2026-084-AWS warns of authorization flaw CVE-2026-75910 in Athena ClickHouse connector allowing arbitrary Secrets Manager data leakage.
GoogleGoogle Cloud Bulletin GCP-2026-059 details missing authorization flaw CVE-2026-4644 in Integration Connectors enabling project-level privilege escalation.
AWS CloudAWS Security Bulletin 2026-075-AWS discloses critical path traversal flaw CVE-2026-18953 in aws-transform-mcp-server enabling unauthenticated arbitrary file overwrites.
Data BreachCalifornia enacts landmark SB 446 establishing a rigid 30-day consumer breach notice clock and mandatory 15-day Attorney General disclosures for enterprise intrusions.
PostgreSQLAWS Security Bulletin 2026-118-AWS warns of a critical type confusion flaw CVE-2026-96883 in open-source pgcollection enabling RCE in PostgreSQL database hosts.
Data BreachThe Data Protection Board of India issues operational directives detailing tiered penalties up to ₹250 Crore and mandatory personal data breach notification rules.
Threat IntelCISA issues advisory ICSA-26-267-02 for critical command injection flaw CVE-2026-93289 in Eufy Omni robotic appliances enabling unauthenticated root code execution.
CMS SecurityWordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Agentic AISecurity researchers disclose CVE-2026-80347 in mcp-fetch, where unbracketed IPv6 parsing allows autonomous AI agents to be manipulated into internal cloud SSRF.
OT / SCADACISA issues advisory ICSA-26-258-04 warning of credential protection flaw CVE-2026-81861 in Schneider Electric SCADAPack RTUs managing critical pipeline infrastructure.
MicrosoftMicrosoft reclassifies CVE-2026-65660 as an 8.8 CVSS RCE flaw after threat actors bypass SharePoint SafeControls filtering to execute arbitrary .NET code.
Threat IntelCISA issues advisory ICSA-26-258-02 for critical hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard, allowing remote attackers to hijack navigation systems.
AWS CloudAWS Security Bulletin 2026-115-AWS warns of a critical authorization flaw in AmazonConnectSalesforceLambda enabling unprivileged IAM users to execute arbitrary AWS APIs.
Threat IntelThreat actors weaponize MikroTik RouterOS flaw CVE-2026-67279 in the "MikroTrick" chain, bypassing SSH authentication to hijack core routing infrastructure.
AWS CloudAWS discloses high-severity SSRF flaw CVE-2026-15643 in the HealthLake MCP server, enabling attackers to leak temporary SigV4 IAM credentials and healthcare FHIR records.
Deep DiveThe Reserve Bank of India enforces comprehensive IT outsourcing directives, mandating multi-cloud exit plans, 6-hour incident disclosure, and strict concentration risk controls.
Threat IntelA critical CVSS 9.4 path traversal flaw CVE-2026-41948 in Dify allows unauthenticated attackers to bypass workspace isolation and invoke internal Plugin Daemon APIs.