Network Security
Citrix urges customers to patch NetScaler after fixing six vulnerabilities, including the HTTP/2 Bomb flaw and a high-severity CitrixBleed-style information disclosure bug.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches.
Vulnerabilities
Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files.
Vulnerabilities
The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance.
Vulnerabilities
Tracked as CVE-2026–59310, the directory traversal bug allows remote attackers to execute arbitrary code.
Vulnerabilities
The updates fix vulnerabilities in WebKit, the kernel, WebRTC, Web Extensions, and other components affecting iPhone, iPad, Mac, and Safari users.
Vulnerabilities
Fifteen of the newly patched flaws have been rated ‘critical’ and 67 have been rated ‘high severity’.
Ransomware
The Microsoft Defender vulnerability CVE-2026-33825 was exploited in the wild as a zero-day before patches were released.
Artificial Intelligence
Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, potentially turning malicious repositories into supply chain attack vectors.
Vulnerabilities
The critical-severity defect allows unauthenticated attackers to take over the E-Business Suite’s Payments product.
Malware & Threats
The threat actor is focused on collecting credentials, SSH keys, cryptocurrency wallets, and development tooling.
ICS/OT
CISA has published an advisory to inform organizations about three vulnerabilities found by a researcher in Daktronics controllers.
Endpoint Security
A variant of DirtyFrag, the flaw allows unprivileged local users to manipulate the Linux page cache and gain root privileges.
Artificial Intelligence
AWS has patched the vulnerability and published its own advisory to inform customers about the potential impact.
ICS/OT
The exploited flaw, CVE-2025-67038, is one of the vulnerabilities disclosed in April as part of the BRIDGE:BREAK research project.
Vulnerabilities
The latest GitLab CE/EE updates address 13 vulnerabilities, including three high-severity defects.
Vulnerabilities
The latest version of the open source data transfer tool resolves 18 medium and low-severity vulnerabilities.
Vulnerabilities
More than half of the bugs are use-after-free defects, which can potentially lead to remote code execution.
Vulnerabilities
CVE-2026-20245, the 7th Cisco SD-WAN vulnerability exploited in 2026, was used for months prior to its disclosure and patching.
Artificial Intelligence
The new framework seeks to help security teams identify which software supply chain vulnerabilities pose the greatest operational, safety, and business risks in AI-driven...
Vulnerabilities
The flaws allow remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands.
Application Security
The security defects allow unauthenticated users to take control of the open source software supply chain.
Vulnerabilities
The exploit timeline collapsed. Make sure your validation didn't.
Network Security
Cisco noted that a PoC had been available for CVE-2026-20230 when it announced patches in early June.
Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)