Network Security
Cisco recently became aware of the exploitation of CVE-2026-20262, a Catalyst SD-WAN Manager zero-day that allows arbitrary file write.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches.
Vulnerabilities
Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files.
Vulnerabilities
The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance.
Vulnerabilities
Tracked as CVE-2026–59310, the directory traversal bug allows remote attackers to execute arbitrary code.
Vulnerabilities
The critical-severity OS command injection vulnerability allows attackers to execute arbitrary code with root privileges.
Vulnerabilities
The browser refresh resolved critical and high-severity security defects, including a dozen use-after-free bugs.
Cybercrime
Oracle has mitigated CVE-2026-35273, but it has not publicly confirmed the vulnerability’s in-the-wild exploitation.
Vulnerabilities
Oracle has released mitigations for CVE-2026-35273, but it has not said whether it’s a zero-day exploited in ShinyHunters attacks.
Government
The new BOD 26-04 requires agencies to review and update vulnerability management policies with a focus on KEV catalog entries.
Vulnerabilities
Disclosed in March, the security defect enables unauthenticated attackers to write files to arbitrary locations on the system.
Vulnerabilities
The security defects could allow attackers to create or modify arbitrary files and access and modify protected resources.
Endpoint Security
The PoC exploits Microsoft Defender’s offline scan to spawn a SYSTEM shell when rebooting in Recovery Mode.
Vulnerabilities
The company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14.
ICS/OT
Claroty researchers have analyzed the security of Vertiv UPS network cards and the Trane Tracer SC+ HVAC controller.
Vulnerabilities
Exploiting a race condition in Microsoft Defender, the exploit leads to local privilege escalation to SYSTEM.
Vulnerabilities
The company updated hosted customer instances to patch a security issue it reportedly had known about since April 7.
Vulnerabilities
Two OS command injection flaws can be exploited remotely, without authentication, for arbitrary code execution.
ICS/OT
In addition, Rockwell Automation announced some enhancements to its SecureOT cybersecurity solution for OT.
Vulnerabilities
Organizations are advised to apply vendor-supplied mitigations or discontinue the vulnerable devices.
Vulnerabilities
Three of the vulnerabilities fixed with the latest Patch Tuesday updates were publicly disclosed before Microsoft addressed them.
Vulnerabilities
Nearly half of the security holes, most allowing arbitrary code execution, have been fixed in Adobe’s Experience Manager product.
Vulnerabilities
A total of 18 vulnerabilities have been patched in the latest OpenSSL releases, including many that were potentially discovered by AI.
Artificial Intelligence
Public LLM models with safeguards turned off can also build working exploits, increasing patch gap risks.
Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)