SecurityWeek

The 13 websites purported to be affiliated with consulting companies that advertised job openings for current and former holders of security clearances

The security defects could allow attackers to create or modify arbitrary files and access and modify protected resources.

The PoC exploits Microsoft Defender’s offline scan to spawn a SYSTEM shell when rebooting in Recovery Mode.

The ShinyHunters hacker group has taken credit for the attack, leaking more than 450,000 email addresses and other information.

The company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14. 

As attackers increasingly favor stolen credentials over exploits, infostealers have become a primary source of access for ransomware and other cybercrime operations.

Cyera is positioned as one of the most valuable privately held cybersecurity firms in the world with total funding topping $2 billion.

In the post-Mythos era, the company’s platform helps organizations enforce security controls across environments.

Claroty researchers have analyzed the security of Vertiv UPS network cards and the Trane Tracer SC+ HVAC controller.

Learn more about protecting against unmonitored use of generative AI (Shadow AI) in business units and building and enforcing AI governance frameworks.

Exploiting a race condition in Microsoft Defender, the exploit leads to local privilege escalation to SYSTEM.

Security teams need more than visibility into AI applications, they need a repeatable framework for monitoring, investigating, and defending them in production.

The company updated hosted customer instances to patch a security issue it reportedly had known about since April 7.

Two OS command injection flaws can be exploited remotely, without authentication, for arbitrary code execution.

In addition, Rockwell Automation announced some enhancements to its SecureOT cybersecurity solution for OT.

Organizations are advised to apply vendor-supplied mitigations or discontinue the vulnerable devices.

Three of the vulnerabilities fixed with the latest Patch Tuesday updates were publicly disclosed before Microsoft addressed them.

Nearly half of the security holes, most allowing arbitrary code execution, have been fixed in Adobe’s Experience Manager product.

The AI giant also announced that Project Glasswing partners are being given access to the upgraded Mythos 5.

A total of 18 vulnerabilities have been patched in the latest OpenSSL releases, including many that were potentially discovered by AI.