1,437 articles
FortinetFortinet releases emergency fixes for critical CVSS 9.6 flaw CVE-2026-84388 in FortiPAM and its Chrome Extension, allowing remote attackers to hijack administrative sessions.
OT / SCADACISA and Siemens warn of critical CVSS 9.8 flaw in SIMATIC IoT2050 Advanced (ICSA-26-237-03), enabling remote attackers to execute arbitrary code with root privileges.
Threat IntelA critical TOCTOU race condition flaw CVE-2026-87996 in Open WebUI enables attackers to execute DNS rebinding SSRF attacks and harvest cloud metadata and credentials.
Cyber AttackHalliburton files SEC Form 8-K Item 1.05 detailing unauthorized corporate network access that forced critical energy infrastructure systems offline across global operations.
Deep DiveEuropean supervisory authorities enforce EU DORA standards, requiring financial institutions to implement 4-hour major ICT incident disclosure and strict third-party cloud oversight.
MicrosoftMicrosoft discloses critical CVSS 10.0 flaw CVE-2026-69399 in Azure Arc, enabling unauthenticated attackers to exploit confused deputy proxies across hybrid cloud nodes.
Threat IntelA critical integer overflow flaw CVE-2026-86289 in the Ollama GGUF model decoder allows attackers to trigger memory corruption and remote code execution on AI inference clusters.
OT / SCADACISA and Rockwell Automation disclose multiple CIP packet parsing flaws in RSLinx Classic (ICSA-26-244-01), enabling attackers to crash industrial SCADA communication gateways.
Active ExploitAdobe and CISA warn of active exploitation targeting CVE-2026-71362 in Adobe Commerce and Magento, enabling unauthenticated manipulation of checkout orders and customer data.
OT / SCADASiemens fixes critical vulnerabilities in SIMOVE Fleetmanager and SIPLANT, preventing unauthenticated remote threat actors from altering autonomous factory AGV paths.
Deep DiveThe Data Protection Board of India establishes binding procedural codes for DPDP inquiries, mandating independent algorithmic audits and strict breach notification timelines.
Threat IntelWSO2 patches critical path traversal flaw CVE-2026-5430 across API Manager and Gateway platforms, preventing unauthenticated remote extraction of master credentials.
OT / SCADACISA ICS advisory ICSA-26-267-02 warns of critical vulnerabilities in Eufy autonomous commercial cleaning robots, allowing remote RTSP stream hijack and LiDAR map exfiltration.
AWS CloudAWS resolves a container boundary escape flaw in Amazon ECS Container Agent that allowed unprivileged containers to intercept task metadata and assume host IAM roles.
OT / SCADACISA ICS advisory ICSA-26-267-01 details critical flaws in Botslab G980H dashcams, allowing remote attackers to intercept live video and hijack fleet telematics.
Threat IntelHPE resolves critical flaw CVE-2026-38291 in Aruba EdgeConnect SD-WAN Orchestrator, allowing unauthenticated remote attackers to bypass auth and execute arbitrary code.
Deep DiveAn architectural vulnerability in Model Context Protocol (MCP) OAuth token passthrough allows malicious tool servers to impersonate users and hijack enterprise APIs.
OT / SCADAAn engineering deep dive into IEC 62443-3-2 zones and conduits, establishing hardware micro-segmentation and SL-T targets to protect physical industrial processes.
Cyber AttackAdaptHealth Corp files an SEC Form 8-K under Item 1.05 disclosing a cyberattack that disrupted internal systems and resulted in unauthorized patient data exfiltration.
GoogleGoogle Cloud discloses and mitigates a high-severity container escape flaw in GKE node kernels, preventing unprivileged workloads from compromising host nodes.
OT / SCADACISA ICS advisory ICSA-26-265-09 details critical buffer overflow and authentication bypass flaws in OpenPLC Runtime v3, allowing remote process disruption.
Data BreachRBI accelerates enforcement of its IT Governance Master Direction, mandating 6-hour incident reporting and strict third-party cloud outsourcing audits for financial entities.
GoogleGoogle Cloud resolves a privilege escalation flaw in Compute Engine guest-oslogin that allowed users with compute.osLogin IAM permissions to gain root access.
MicrosoftMicrosoft mitigates maximum-severity CVSS 10.0 flaw CVE-2026-70352 in Azure AI Language Authoring, preventing unauthenticated remote tampering with enterprise AI models.