Vulnerabilities
SonicWall patches three SMA 100 vulnerabilities, including a potential zero-day, that could be chained to execute arbitrary code remotely.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
The patches for an exploited Samsung MagicINFO vulnerability are ineffective and a Mirai botnet has started targeting it.
Vulnerabilities
Cisco releases patches for 26 vulnerabilities in IOS and IOS XE software, including 17 critical- and high-severity bugs.
Vulnerabilities
SysAid patches IT service management software vulnerabilities that can be chained for unauthenticated remote command execution.
Vulnerabilities
Threat actors are targeting a critical-severity vulnerability in the OttoKit WordPress plugin to gain administrative privileges.
Vulnerabilities
Threat actors are revisiting SAP NetWeaver instances to leverage webshells deployed via a recent zero-day vulnerability.
IoT Security
Threat actors started exploiting a vulnerability in Samsung MagicINFO only days after a PoC exploit was published.
Vulnerabilities
CISA has flagged a critical-severity Commvault vulnerability as exploited one week after technical details were released.
Vulnerabilities
PoC code targeting two exploited SonicWall flaws was published just CISA added them to the KEV catalog.
Artificial Intelligence
Year of the Twin Dragons: Developers Must Slay the Complexity and Security Issues of AI Coding Tools
The advantages AI tools deliver in speed and efficiency are impossible for developers to resist. But the complexity and risk created by AI-generated code...
Vulnerabilities
Commvault provides indicators of compromise and mitigation guidance after a zero-day exploit targeting its Azure environment lands in CISA’s KEV catalog.
Vulnerabilities
SonicWall has updated the advisories for two vulnerabilities to warn that they are being exploited in the wild.
Management & Strategy
The OpenEoX model proposes a shared data format that can be integrated into SBOMs, security advisories, and other ecosystem tools.
Vulnerabilities
Chrome 136 and Firefox 138 were released in the stable channel with patches for multiple high-severity vulnerabilities.
Vulnerabilities
The number of exploited zero-days seen by Google in 2024 dropped to 75, from 98 observed in the previous year.
Vulnerabilities
More than 400 SAP NetWeaver servers are impacted by CVE-2025-31324, an exploited remote code execution vulnerability.
Vulnerabilities
CISA urges immediate patching for recently disclosed Broadcom, Commvault, and Qualitia vulnerabilities exploited in the wild.
Vulnerabilities
Threat actors have exploited a zero-day vulnerability in Craft CMS to execute PHP code on hundreds of websites.
Vulnerabilities
A zero-day vulnerability in SAP NetWeaver potentially affects more than 10,000 internet-facing applications.
Vulnerabilities
Cisco is investigating the impact of the Erlang/OTP remote code execution vulnerability CVE-2025-32433 on its products.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)