Vulnerabilities
A desync attack method leveraging HTTP/1.1 vulnerabilities impacted many websites and earned researchers more than $200,000 in bug bounties.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges.
Vulnerabilities
The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild.
Vulnerabilities
Intel has informed customers about several high-severity vulnerabilities that can lead to privilege escalation and even code execution.
Vulnerabilities
The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor.
Vulnerabilities
Trend Micro has rushed to fix two Apex One zero-days that may have been exploited by Chinese threat actors.
Vulnerabilities
Microsoft handed out $17 million in rewards to 344 security researchers through its bug bounty programs over the past year.
Vulnerabilities
An AI extension to the Ox Security platform automatically generates organization specific code to fix vulnerabilities in the codebase.
Vulnerabilities
Adobe has released urgent security updates to resolve two AEM Forms vulnerabilities for which proof-of-concept (PoC) code exists.
Artificial Intelligence
As AI makes software development accessible to all, security teams face a new challenge: protecting applications built by non-developers at unprecedented speed and scale.
Vulnerabilities
Research demonstrating high-impact cloud and AI security flaws will be rewarded at Microsoft’s Zero Day Quest competition in spring 2026.
Vulnerabilities
Threat actors might be exploiting a zero-day vulnerability in SonicWall firewalls in a fresh wave of ransomware attacks.
Artificial Intelligence
Nvidia has patched over a dozen vulnerabilities in Triton Inference Server, including another set of vulnerabilities that threaten AI systems.
Vulnerabilities
Attackers could silently modify sensitive MCP files to trigger the execution of arbitrary code without requiring user approval.
Vulnerabilities
Valid, complete reports detailing remote code execution or elevation of privilege bugs in .NET qualify for the maximum rewards.
Vulnerabilities
Meta is sponsoring ZDI’s Pwn2Own hacking competition, where participants can earn big prizes for smartphone, WhatsApp and wearable device exploits.
Vulnerabilities
Google Project Zero now publicly shares the discovery of a vulnerability and when its 90-day disclosure deadline expires.
Vulnerabilities
Tracked as CVE-2025-6558, the flaw was found in Chrome’s ANGLE and GPU components and was flagged as exploited by Google TAG.
Vulnerabilities
The TCC bypass could expose information cached by Apple Intelligence, including geolocation and biometric data.
Vulnerabilities
Threat actors are exploiting a two-year-old vulnerability in PaperCut that allows them to execute arbitrary code remotely.
Vulnerabilities
The Post SMTP email delivery WordPress plugin is affected by a critical vulnerability and half of websites using it remain unpatched.
Vulnerabilities
An authentication bypass vulnerability in Mitel MiVoice MX-ONE could allow attackers to access user or admin accounts on the system.
Vulnerabilities
LG Innotek LNV5110R security cameras are affected by a vulnerability that can be exploited for unauthenticated remote code execution.
Vulnerabilities
SonicWall advises organizations to patch SMA 100 appliances and look for IoCs associated with Overstep malware attacks.
Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)