Email Security
Patched in December 2025, the exploited flaw leads to XSS attacks via the animate tags in SVG documents.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Vulnerabilities
The flaw tracked as CVE-2026-2329 can be exploited without authentication for remote code execution with root privileges.
Ransomware
CISA has updated its KEV entry for CVE-2026-1731 to alert organizations of exploitation in ransomware attacks.
Malware & Threats
Security researchers have seen the vulnerabilities being exploited to deliver shells, conduct reconnaissance, and download malware.
Vulnerabilities
Novee researchers discovered 16 vulnerabilities in Foxit and Apryse PDF tools that could have been exploited via malicious documents or URLs.
Vulnerabilities
The vulnerability added to CISA’s KEV catalog affects ThreatSonar Anti-Ransomware and it was patched in 2024.
Malware & Threats
GTIG and Mandiant said the zero-day tracked as CVE-2026-22769 has been exploited by UNC6201 since at least 2024.
Application Security
New research shows attackers increasingly abusing APIs at machine speed as AI-driven systems widen exposure and amplify impact.
Vulnerabilities
A Chrome 145 update fixes CVE-2026-2441, a vulnerability that can likely be exploited for arbitrary code execution.
Vulnerabilities
Exploitation attempts target CVE-2026-1731, a critical unauthenticated remote code execution flaw in BeyondTrust Remote Support.
Vulnerabilities
Disclosed at the end of January, the SolarWinds vulnerability was likely exploited as a zero-day since December 2025.
Vulnerabilities
Three of the security defects are high-severity flaws, two of which were found and reported by Google.
Government
Rewards for exploits are reportedly much smaller than in the contest’s glory days.
Artificial Intelligence
Developers must view AI as a collaborator to be closely monitored, rather than an autonomous entity to be unleashed. Without such a mindset, crippling...
Vulnerabilities
Impacting the ‘dyld’ system component, the memory corruption issue can be exploited for arbitrary code execution.
Vulnerabilities
It also fixed a high-severity authentication bypass that could be exploited remotely without authentication to obtain credentials.
Endpoint Security
More than two dozen advisories have been published by the chip giants for vulnerabilities found recently in their products.
Vulnerabilities
The bugs could be exploited without authentication for command execution and authentication bypass.
Cloud Security
Dozens of vulnerabilities, bugs, and potential improvements have been identified by the tech giants’ security teams.
ICS/OT
Several vulnerabilities have been patched and mitigated across the industrial giants’ products.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)