Malware & Threats
Russian military intelligence hackers intensify targeting of Western logistics and technology companies moving supplies into Ukraine.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Wiz warns that threat actors are chaining two recent Ivanti vulnerabilities to achieve unauthenticated remote code execution.
Email Security
An OpenPGP.js vulnerability tracked as CVE-2025-47934 allows message signature verification to be spoofed.
Cloud Security
VMware patches flaws that expose users to data leakage, command execution and denial-of-service attacks. No temporary workarounds available.
Vulnerabilities
The Likely Exploited Vulnerabilities (LEV) equations can help augment KEV- and EPSS-based remediation prioritization.
Vulnerabilities
Pwn2Own participants demonstrated exploits against VMs, AI, browsers, servers, containers, and operating systems.
Vulnerabilities
Pwn2Own participants have earned tens of thousands of dollars for Red Hat, Windows, Oracle VirtualBox, Docker Desktop, and AI exploits.
Vulnerabilities
Google has rolled out a Chrome 136 update that resolves a high-severity vulnerability for which a public exploit exists.
Vulnerabilities
Experts say the European Vulnerability Database, or EUVD, should be a good resource, but only if ENISA manages to maintain it properly.
Vulnerabilities
Juniper Networks, VMware, and Zoom have announced patches for dozens of vulnerabilities across their products.
Vulnerabilities
Fortinet has patched a dozen vulnerabilities, including a critical flaw exploited in the wild against FortiVoice instances.
Vulnerabilities
Ivanti has released patches for two EPMM vulnerabilities that have been chained in the wild for remote code execution.
Incident Response
Adobe Patch Tuesday headlined by a major Adobe ColdFusion update patching a wide swatch of code execution and privilege escalation attacks.
Malware & Threats
Patch Tuesday: Microsoft patches at least 70 security bugs and flagged five zero-days in the “exploitation detected” category.
Vulnerabilities
SAP has released 16 new security notes on its May 2025 Security Patch Day, including a note dealing with another critical NetWeaver vulnerability exploited...
Vulnerabilities
The Radware Cloud WAF product vulnerabilities disclosed by CERT/CC were addressed two years ago.
Mobile & Wireless
Apple rolls out iOS and macOS platform updates to fix serious security bugs that could be triggered simply by opening an image or video...
Vulnerabilities
Two vulnerabilities in ASUS’s pre-installed software DriverHub can be exploited for remote code execution.
Vulnerabilities
Noteworthy stories that might have slipped under the radar: surge in cyberattacks between India and Pakistan, Radware cloud WAF vulnerabilities, xAI key leak.
Vulnerabilities
Hundreds of SAP NetWeaver instances hacked via a zero-day that allows remote code execution, not only arbitrary file uploads, as initially believed.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)