Vulnerabilities
The SharePoint remote code execution vulnerability CVE-2026-20963, which Microsoft patched in January, has been exploited in the wild.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Ransomware
Amazon found evidence that the FMC software vulnerability has been exploited since late January, and found links to Russia.
Artificial Intelligence
With exploitation of vulnerabilities taking just days, preemptive security must be the new model for defenders.
Mobile & Wireless
Targeting six iOS vulnerabilities and leading to full device compromise, the exploit chain is meant for surveillance.
Privacy
Meta does not plan on fixing the vulnerability because it involves the use of a modified client application.
Vulnerabilities
Tracked as CVE-2025-47813, the flaw leads to the disclosure of the full local installation path of the application.
Vulnerabilities
The vulnerability can be exploited remotely, without authentication, to circumvent existing authentication controls.
Vulnerabilities
Google paid over $3.7 million for Chrome vulnerabilities, and more than $3.5 million for cloud security defects.
Vulnerabilities
The flaws can be exploited to manipulate data and bypass security restrictions, potentially leading to code execution.
Vulnerabilities
The issue allows attackers to inject SQL queries and extract sensitive information from the database.
Vulnerabilities
Critical- and high-severity flaws could be exploited to execute arbitrary shell commands or elevate privileges.
Vulnerabilities
The security defects could lead to denial-of-service (DoS) conditions, command execution, or device takeover.
Vulnerabilities
The bugs allowed unauthenticated attackers to execute arbitrary code, steal credentials, and take over servers.
Vulnerabilities
The bugs could lead to arbitrary code execution, privilege escalation, or authentication rate-limit bypass.
Vulnerabilities
Microsoft has fixed a critical vulnerability, but none of the flaws fixed this Patch Tuesday has been exploited in the wild.
Vulnerabilities
Adobe has rolled out patches for 80 vulnerabilities across 8 products, including Commerce, Illustrator, Acrobat Reader, and Premiere Pro.
Vulnerabilities
A code injection bug in FS-QUO and an insecure deserialization flaw in NetWeaver could lead to arbitrary code execution.
Vulnerabilities
CISA has added the high-severity authentication bypass vulnerability to its KEV list, along with SolarWinds and Workspace One bugs.
Vulnerabilities
WatchTowr reports seeing exploitation attempts for CVE-2026-20127 from numerous unique IP addresses.
Vulnerabilities
The nation-state-grade iOS exploit kit targets 23 vulnerabilities affecting iOS 13 to 17.2.1.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)