Network Security
Cisco noted that a PoC had been available for CVE-2026-20230 when it announced patches in early June.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Artificial Intelligence
Come vulnerabilities were found within hours, but that does not mean the model was able to exploit them within that time, the official said.
Artificial Intelligence
Attackers could abuse Dify's multi-tenant cloud service to read private chats, preview other tenants' documents, and reach internal APIs.
Mobile & Wireless
The high-severity use-after-free vulnerability in Samsung's KNOX security framework affected Android-powered Galaxy devices from the S9 through S25.
Vulnerabilities
Attackers can send crafted media files to execute code in any application that uses FFmpeg’s libavcodec library.
Data Protection
Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability.
Vulnerabilities
Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data.
Malware & Threats
Other noteworthy stories that might have slipped under the radar: Android TV botnet Popa linked to Israeli firm, Velvet Ant maintained decade-long stealth, unpatched...
Vulnerabilities
CISA has given federal agencies only three days to patch CVE-2026-20253, which can be exploited for unauthenticated remote code execution.
Vulnerabilities
These servers are regularly targeted by China-linked UNC6508 for initial access and backdoor deployment.
Vulnerabilities
Four decades of incident response experience suggest that exploits are often the symptom, not the root cause, of today’s cybersecurity failures.
Vulnerabilities
Splunk patched an OS command injection in AI Toolkit, while Atlassian fixed dozens of flaws in third-party dependencies.
Network Security
Insufficient validation of user input allows an attacker to gain access to the underlying OS and elevate their privileges to root.
Vulnerabilities
Critical flaws in NGINX could allow remote, unauthenticated attackers to cause a restart and potentially execute arbitrary code.
ICS/OT
The industrial automation giant has fixed security holes in Logix, CompactLogix, Flex, RSLinx, and FactoryTalk products.
Vulnerabilities
The public PoC code exploits a race condition in Microsoft Defender to spawn a command prompt with System privileges.
Vulnerabilities
Oracle has released its June 2026 Critical Security Patch Update to fix vulnerabilities in Communications, EBS, Enterprise Manager and other products.
Vulnerabilities
The browser updates address multiple memory safety bugs that could potentially lead to remote code execution.
Vulnerabilities
The flaws allow attackers to execute arbitrary PHP code and gain root privileges on shared hosting servers.
Vulnerabilities
SOCRadar has detected 30,000 compromised Fortinet firewalls that expose networks to hacking.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)