Vulnerabilities
Within nine hours, a hacker built an exploit from the unauthenticated bug’s advisory and started using it in the wild.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Mobile & Wireless
The security hole affected an EngageLab SDK and it was reported by Microsoft to the vendor one year ago.
Vulnerabilities
The bugs could allow attackers to modify protected resources and escalate their privileges to administrator.
Vulnerabilities
Reputable researcher Haifei Li has come across what appears to be a PDF designed to exploit an unpatched vulnerability.
Data Protection
A total of seven vulnerabilities, most of which can be exploited for DoS attacks, have been patched in OpenSSL.
Vulnerabilities
The vulnerability requires authentication for successful exploitation, but another flaw exposes the Jolokia API without authentication.
Vulnerabilities
The vulnerability allows hackers to upload arbitrary files to a site’s server and achieve remote code execution.
Artificial Intelligence
The improper validation of user-supplied JavaScript code allows attackers to execute arbitrary code and access the file system.
Mobile & Wireless
A critical DoS vulnerability in the Framework component of Android has also been fixed with the latest update.
Endpoint Security
Researchers have demonstrated that GPU Rowhammer attacks can be used to escalate privileges.
Network Security
The improper access control bug in FortiClient EMS allows unauthenticated attackers to execute arbitrary code remotely.
Vulnerabilities
A Chinese threat actor exploited the video conferencing platform to perform reconnaissance, escalate privileges, and execute additional payloads.
Vulnerabilities
The vulnerabilities can be chained together to bypass authentication and upload arbitrary files to the server.
Artificial Intelligence
Within days of each other, Anthropic first leaked the source code to Claude Code, and then a critical vulnerability was found by Adversa AI.
Mobile & Wireless
The DarkSword exploit kit has been used by both state-sponsored hackers and commercial spyware vendors.
Vulnerabilities
The bugs could lead to authentication bypass, remote code execution, information disclosure, and privilege escalation.
Vulnerabilities
Google has announced fixes for CVE-2026-5281, a zero-day affecting Chrome’s Dawn component.
Vulnerabilities
The SQL injection vulnerability allows unauthenticated attackers to execute arbitrary code remotely, via crafted HTTP requests.
Vulnerabilities
Remotely exploitable, the integer underflow vulnerability impacts StrongSwan releases spanning 15 years.
Artificial Intelligence
Researchers found an OpenAI Codex vulnerability that could have been exploited to compromise GitHub tokens.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)