Cloud Security
Snyk discloses information on Leaky Vessels, several potentially serious container escape vulnerabilities affecting Docker and others.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
IoT Security
Apple releases first security update for Vision Pro VR headset as CISA issues warning about exploitation of iOS vulnerability.
Security Architecture
Researchers at Qualys call attention to a vulnerability in Linux’s GNU C Library (glibc) that allows full root access to a system.
Malware & Threats
Ivanti documents a brand-new zero-day and belatedly ships patches; Mandiant is reporting "broad exploitation activity."
Application Security
Over a dozen vulnerabilities discovered in Tor audit, including a high-risk flaw that can be exploited to inject arbitrary bridges.
Vulnerabilities
Shadowserver Foundation has seen 45,000 Jenkins instances affected by CVE-2024-23897, which may already be exploited in attacks.
Vulnerabilities
A high-severity flaw in the J-Web interface of Juniper’s Junos OS could lead to arbitrary command execution, remotely.
Nation-State
Ivanti is struggling to hit its own timeline for the delivery of patches for critical -- and already exploited -- flaws in its flagship...
Vulnerabilities
Two memory safety vulnerabilities in WatchGuard and Panda Security products could lead to code execution with System privileges.
Vulnerabilities
PoC exploit code targeting a critical Jenkins vulnerability patched last week is already publicly available.
Vulnerabilities
A critical vulnerability in Jenkins’ built-in CLI allows remote attackers to obtain cryptographic keys and execute arbitrary code.
IoT Security
Participants have earned more than $1.3 million for hacking Teslas, EV chargers and infotainment systems at Pwn2Own Automotive.
Supply Chain Security
Two new products aim to secure the traditional OSS supply chain, and the new AI model software supply chain.
Vulnerabilities
A critical flaw in Cisco Unified Communications and Contact Center Solutions products could lead to remote code execution.
IoT Security
Over $1 million paid out in the first two days of Pwn2Own Automotive for Tesla, infotainment and EV charger hacks.
Vulnerabilities
Over 5,000 GitLab servers have yet to be patched against CVE-2023-7028, a critical password reset vulnerability.
Vulnerabilities
Updates released for Firefox and Thunderbird resolve 15 vulnerabilities, including five high-severity bugs.
IoT Security
On the first day of Pwn2Own Automotive participants earned over $700,000 for hacking Tesla, EV chargers and infotainment systems.
Cloud Security
Attackers could take over a Kubernetes cluster if access privileges are granted to all authenticated users in Google Kubernetes Engine.
Vulnerabilities
PoC code exploiting a critical Fortra GoAnywhere MFT vulnerability gets published one day after public disclosure.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)