SecurityWeek

The security defects allow unauthenticated users to take control of the open source software supply chain.

Over a dozen Klue customers have confirmed that hackers stole data from their Salesforce instances.

The exploit timeline collapsed. Make sure your validation didn't.

Cisco noted that a PoC had been available for CVE-2026-20230 when it announced patches in early June.

Come vulnerabilities were found within hours, but that does not mean the model was able to exploit them within that time, the official said.

Named EmberAI, the new capability is built on Dragos’ massive operational technology cybersecurity dataset.

Attackers could abuse Dify's multi-tenant cloud service to read private chats, preview other tenants' documents, and reach internal APIs.

The high-severity use-after-free vulnerability in Samsung's KNOX security framework affected Android-powered Galaxy devices from the S9 through S25.

Carl Froggett combines CISO and CIO. He currently occupies both positions at Deep Instinct. Before then, he was CISO at Citi for almost 17 years.

26-year-old Abdellah Belmili faces up to 30 years in prison for allegedly operating the marketplaces Market0Day and Spoxy.

Attackers can send crafted media files to execute code in any application that uses FFmpeg’s libavcodec library.

OpenAI has expanded its Daybreak cybersecurity initiative with a new suite of tools and partnerships.

Using a custom sniffer, the threat actor has captured over 110 million credentials since at least February 2026.

Hackers stole customers’ names, addresses, email addresses, phone numbers, and account information.

Federal agencies are required to transition high-value assets and high-impact systems to use PQC by the end of 2030 and 2031.

Threat actors gained access to personal and protected health information that Xsolis received from its clients.

Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability. 

Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data.

A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.

Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage.