Vulnerabilities
SAP has released 15 new security notes on the August 2025 Patch Tuesday, including for critical vulnerabilities.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
A researcher has been given the highest reward in Google’s Chrome bug bounty program for a sandbox escape with remote code execution.
Vulnerabilities
A researcher has demonstrated how a platform used by over 1,000 dealerships in the US could have been used to hack cars.
Application Security
Taking place August 12-13, CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured,...
Vulnerabilities
CISA and Microsoft have issued advisories for CVE-2025-53786, a high-severity flaw allowing privilege escalation in cloud environments.
Vulnerabilities
A desync attack method leveraging HTTP/1.1 vulnerabilities impacted many websites and earned researchers more than $200,000 in bug bounties.
Vulnerabilities
Trend Micro has rushed to fix two Apex One zero-days that may have been exploited by Chinese threat actors.
Vulnerabilities
Microsoft handed out $17 million in rewards to 344 security researchers through its bug bounty programs over the past year.
Vulnerabilities
An AI extension to the Ox Security platform automatically generates organization specific code to fix vulnerabilities in the codebase.
Vulnerabilities
Adobe has released urgent security updates to resolve two AEM Forms vulnerabilities for which proof-of-concept (PoC) code exists.
Artificial Intelligence
As AI makes software development accessible to all, security teams face a new challenge: protecting applications built by non-developers at unprecedented speed and scale.
Vulnerabilities
Research demonstrating high-impact cloud and AI security flaws will be rewarded at Microsoft’s Zero Day Quest competition in spring 2026.
Vulnerabilities
Threat actors might be exploiting a zero-day vulnerability in SonicWall firewalls in a fresh wave of ransomware attacks.
Artificial Intelligence
Nvidia has patched over a dozen vulnerabilities in Triton Inference Server, including another set of vulnerabilities that threaten AI systems.
Vulnerabilities
Attackers could silently modify sensitive MCP files to trigger the execution of arbitrary code without requiring user approval.
Vulnerabilities
Valid, complete reports detailing remote code execution or elevation of privilege bugs in .NET qualify for the maximum rewards.
Vulnerabilities
Meta is sponsoring ZDI’s Pwn2Own hacking competition, where participants can earn big prizes for smartphone, WhatsApp and wearable device exploits.
Vulnerabilities
Google Project Zero now publicly shares the discovery of a vulnerability and when its 90-day disclosure deadline expires.
Vulnerabilities
Tracked as CVE-2025-6558, the flaw was found in Chrome’s ANGLE and GPU components and was flagged as exploited by Google TAG.
Vulnerabilities
The TCC bypass could expose information cached by Apple Intelligence, including geolocation and biometric data.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)