Latest from todayExploited JFrog Artifactory bug puts software supply chain on alertThe bug is already being exploited in the wild, allowing attackers to generate admin tokens and gain access to Artifactory, the platform that powers many organization’s software supply chains. By Shweta SharmaSep 2, 20263 minsAccess ControlAuthenticationVulnerabilities How China industrialized the infrastructure behind state hackingBy Cynthia BrumfieldSep 2, 20268 minsAdvanced Persistent ThreatsCyberattacksCybercrime Anthropic makes changes to stop AI agents running amok againBy Taryn PlumbSep 1, 20267 minsArtificial IntelligenceData and Information SecuritySecurityWhat happens when AI models take aim at ICS exploitsBy Lucian Constantin Sep 1, 20266 minsArtificial IntelligenceCritical InfrastructureVulnerabilities CrowdStrike launches cyber frontier AI models, agentic security systemBy Jason Snyder Sep 1, 20263 minsIntrusion Detection SoftwareSecurity Monitoring SoftwareSecurity Operations Center OpenClaw rolls out system-wide overhaul, updates security controls across agent platformBy Gyana Swain Sep 1, 20264 minsArtificial IntelligenceDevelopment ToolsSecurity Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackersBy Shweta Sharma Sep 1, 20263 minsCyberattacksCybercrimeSecurity China-linked hackers turn Cisco routers into covert attack infrastructureBy Prasanth Aby Thomas Sep 1, 20265 minsCyberattacksCybercrimeNetwork Security Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned offBy Evan Schuman Aug 31, 20266 minsAnti MalwareEndpoint ProtectionWindows Security Hackers exploit Vercel’s trust in AI integration Compromised Context.ai integration let attackers inherit Vercel employee access and reach internal systems, exposing a limited set of customer credentials. By Shweta Sharma Apr 20, 2026 4 mins Cyberattacks Cybercrime Data Breach Critical sandbox bypass fixed in popular Thymeleaf Java template engine The 9.1-CVSS vulnerability enables attackers to circumvent RCE protections in the de facto template engine for the Java Spring ecosystem. By Lucian Constantin Apr 17, 2026 3 mins Java Security Vulnerabilities Flawed Cisco update threatens to stop APs from getting further patches Logs in wireless access point flash memory grow by 5MB a day in certain IOS XE devices until space runs out. By Howard Solomon Apr 17, 2026 5 mins Network Security Security Vulnerabilities White House moves to give federal agencies access to Anthropic’s Claude Mythos The move would allow civilian agencies to access a modified version of Anthropic’s powerful vulnerability‑hunting AI, under safeguards designed to limit misuse. By Gyana Swain Apr 17, 2026 4 mins Application Security Security Vulnerabilities Another Microsoft Defender privilege escalation bug emerges days after patch New PoC shows how Microsoft Defender can be tricked into rewriting malicious files into protected locations, enabling SYSTEM-level privilege escalation on fully patched Windows systems. By Shweta Sharma Apr 17, 2026 3 mins Endpoint Protection Security Windows Security Cisco Webex SSO flaw needs manual certificate update to fix The cloud-based Webex service has already been patched, but admins must replace an identity provider certificate in Webex Control Hub to complete the fix. By Howard Solomon Apr 16, 2026 4 mins Identity and Access Management Security Vulnerabilities RCE by design: MCP architectural choice haunts AI agent ecosystem Unsafe defaults in MCP configs open servers to possible remote code execution, as evidenced by several commercial services and open-source projects. By Lucian Constantin Apr 16, 2026 7 mins Application Security Artificial Intelligence Security NIST cuts down CVE analysis amid vulnerability overload The agency will only add enrichment details to CVEs in limited cases going forward, prioritizing known exploited flaws and vaguely defined ‘critical software.’ By Maria Korolov Apr 16, 2026 5 mins Security Threat and Vulnerability Management Vulnerabilities Microsoft’s Windows Recall still allows silent data extraction A cybersecurity researcher says Recall’s redesigned security model does not stop same-user malware from accessing plaintext screenshots and extracted text, without admin rights or exploits. By Gyana Swain Apr 16, 2026 5 mins Endpoint Protection Vulnerabilities Windows Security Behind the Mythos hype, Glasswing has just one confirmed CVE As hype builds around Anthropic’s offensive AI model, VulnCheck’s analysis finds just one confirmed CVE tied directly to Project Glasswing, raising questions about how Mythos’ real-world impact should be measured. By Shweta Sharma Apr 16, 2026 4 mins Artificial Intelligence Security Vulnerabilities Critical nginx UI tool vulnerability opens web servers to full compromise The MCP endpoint authentication weakness has been under active exploitation since March. By John E. Dunn Apr 15, 2026 4 mins Access Control Authentication Identity and Access Management Copilot and Agentforce fall to form-based prompt injection tricks Prompt injection flaws in Microsoft Copilot Studio and Salesforce Agentforce let attackers weaponize form inputs to override agents’ behavior and exfiltrate sensitive customer and business data. By Shweta Sharma Apr 15, 2026 4 mins Artificial Intelligence Security Vulnerabilities Curity looks to reinvent IAM with runtime authorization for AI agents Traditional authentication is incapable of securing AI agents, the company says, as it announces Access Intelligence. By John E. Dunn Apr 14, 2026 4 mins Artificial Intelligence Identity and Access Management Security April Patch Tuesday roundup: Zero day vulnerabilities and critical bugs This month’s threat landscape is ‘defined by immediate, real-world exploitation rather than just theoretical vulnerabilities,’ says an incident response manager. By Howard Solomon Apr 14, 2026 10 mins Security Vulnerabilities Zero-Day Vulnerabilities EU regulators largely denied access to Anthropic Mythos Experts are critical of private companies controlling access to powerful AI vulnerability-hunting technology. By Viktor Eriksson Apr 14, 2026 2 mins Artificial Intelligence Generative AI Security China-linked cloud credential heist runs on typos and SMTP The Linux-based ELF backdoor is targeting cloud workloads across providers, using SMTP-based C2 and typosquatted Alibaba domains to harvest credentials and metadata. By Shweta Sharma Apr 14, 2026 4 mins Cloud Security Identity and Access Management Security Anthropic’s Mythos signals a structural cybersecurity shift Claude Mythos Preview won’t break cybersecurity, but two new analyses shed light on how it is compressing exploit windows and exposing gaps in vulnerability management. CISOs should prepare for what’s ahead. By Cynthia Brumfield Apr 13, 2026 5 mins Artificial Intelligence Security Software Threat and Vulnerability Management Critical flaw in Marimo Python notebook exploited within 10 hours of disclosure A single unauthenticated connection gives attackers a full shell; credential theft observed in under three minutes on honeypot servers. By Gyana Swain Apr 13, 2026 5 mins Security Vulnerabilities Seven IBM WebSphere Liberty flaws can be chained into full takeover A pre‑authentication bug in SAML Web SSO, combined with weak access controls and cryptography, allows attackers to escalate privileges and achieve remote code execution. By Shweta Sharma Apr 13, 2026 4 mins Security Vulnerabilities Google adds end-to-end Gmail encryption to Android, iOS devices for enterprises It’s a valuable addition for organizations with compliance or privacy concerns, but to use the feature, customers must subscribe to the Enterprise Plus with Assured Controls edition of Premium Workspace. By Howard Solomon Apr 10, 2026 5 mins Communications Security Email Security Encryption Old Docker authorization bypass pops up despite previous patch A 10-year-old issue involving Docker Engine and the AuthZ authorization plug-in lives again to enable attackers to gain root-level access to host systems. By Lucian Constantin Apr 10, 2026 4 mins Application Security Security Vulnerabilities Hacker Unknown now known, named on Europol’s most-wanted list Two ransomware criminals are actively sought by German police. By Maxwell Cooter Apr 10, 2026 2 mins Hacker Groups Hacking Ransomware Hungarian government email passwords exposed ahead of election Ahead of Hungary’s parliamentary elections hackers have been stealing passwords, not stealing votes. By Maxwell Cooter Apr 10, 2026 2 mins Access Control Authentication Passwords Claude uncovers a 13‑year‑old ActiveMQ RCE bug within minutes The decade-old ActiveMQ flaw was uncovered and weaponized in minutes, showing AI’s exploit-building potential amid the Mythos hype. By Shweta Sharma Apr 10, 2026 3 mins Artificial Intelligence Security Vulnerabilities The cyber winners and losers in Trump’s 2027 budget The administration’s 2027 civilian agencies budget trims federal cybersecurity spending despite escalating threats, with deep cuts at CISA even as other agencies see boosts. By Cynthia Brumfield Apr 10, 2026 7 mins Budgeting Government Technology Industry Hackers have been exploiting an unpatched Adobe Reader vulnerability for months The exploit has been fingerprinting compromised computers to enable possible future attacks. By Howard Solomon Apr 9, 2026 6 mins Security Vulnerabilities Zero-Day Vulnerabilities Cloudflare ‘actively adjusting’ quantum priorities in wake of Google warning Google’s accelerated post-quantum cryptography (PQC) deadline is spurring other vendors to revise plans. By John Leyden Apr 9, 2026 5 mins Data and Information Security Encryption Technology Industry New ClickFix variant bypasses Apple safeguards with one‑click script execution Jamf finds a ClickFix variant that swaps copy-paste Terminal lures for Script Editor execution, tightening delivery of Atomic Stealer. By Shweta Sharma Apr 9, 2026 3 mins Endpoint Protection MacOS Security Malware Patch windows collapse as time-to-exploit accelerates AI and the industrialization of cybercrime are helping attackers double the number of high- and critical-severity known vulnerabilities they can exploit — in half the time. By John Leyden Apr 9, 2026 5 mins Cyberattacks Cybercrime Patch Management Software Questions raised about how LinkedIn uses the petabytes of data it collects A European company selling browser extensions that leverage LinkedIn data is accusing the Microsoft unit of using its data to identify religious and political beliefs, and selling that info to third-parties. By Evan Schuman Apr 8, 2026 4 mins Data Privacy Privacy Security Hackers exploit a critical Flowise flaw affecting thousands of AI workflows The design flaw in Flowise’s Custom MCP node has allowed attackers to execute arbitrary JavaScript through unvalidated configurations. By Shweta Sharma Apr 8, 2026 3 mins Artificial Intelligence Security Vulnerabilities Iran‑linked PLC attacks cause real‑world disruption at critical US infra sites Operational disruptions and financial losses have already been reported, and six federal agencies say the campaign is ongoing. By Gyana Swain Apr 8, 2026 5 mins Cyberattacks Cybercrime Security Forest Blizzard leverages router compromises to launch AiTM attacks, target Outlook sessions By altering DNS settings on vulnerable devices, Forest Blizzard redirects users to malicious infrastructure to capture credentials and session data, says Microsoft Threat Intelligence. By Nidhi Singal Apr 8, 2026 5 mins Cyberattacks Cybercrime Security Microsoft’s new Agent Governance Toolkit targets top OWASP risks for AI agents The open-source project maps directly to OWASP’s top 10 agentic AI threats, aiming to curb issues like prompt injection, rogue agents, and tool misuse at runtime. By Anirban Ghoshal Apr 8, 2026 3 mins Artificial Intelligence Risk Management Security What Anthropic Glasswing reveals about the future of vulnerability discovery A closed consortium including tech giants and top security vendors gets early access to a model Anthropic says can autonomously discover software vulnerabilities at scale. The implications for cybersecurity’s future could be significant. By Cynthia Brumfield Apr 7, 2026 5 mins Application Security DevSecOps Technology Industry Fortinet releases emergency hotfix for FortiClient EMS zero-day flaw Exploited in the wild prior to Fortinet’s advisory, the vulnerability allows unauthenticated attackers to remotely execute arbitrary code. By Lucian Constantin Apr 7, 2026 3 mins Network Security Security Vulnerabilities Zero‑click Grafana AI attack can enable enterprise data exfiltration By combining indirect prompt injection with client-side bypasses, attackers can force Grafana to leak sensitive data through routine image requests. By Shweta Sharma Apr 7, 2026 4 mins Artificial Intelligence Security Vulnerabilities Microsoft says Medusa-linked Storm-1175 is speeding ransomware attacks The group has moved from initial access to ransomware deployment within 24 hours, highlighting how exposed web-facing systems and shrinking patch windows raise enterprise risk. By Prasanth Aby Thomas Apr 7, 2026 4 mins Cybercrime Malware Ransomware North Korean hackers abuse LNKs and GitHub repos in ongoing campaign The multi-stage campaign targeting South Korea uses weaponized Windows shortcuts and GitHub-based command-and-control to evade detection. By Shweta Sharma Apr 6, 2026 4 mins Cyberattacks Cybercrime Security Security lapse lets researchers view React2Shell hackers’ dashboard The campaign is stealing credentials from unpatched servers at scale, due to “neglect and efficiency,” says analyst, and the damage ‘could be absolute.’ By Howard Solomon Apr 3, 2026 5 mins Cybercrime Malware Security A core infrastructure engineer pleads guilty to federal charges in insider attack Analysts say CISOs and IT leaders can do a better job of preventing such attacks via what should be standard security procedures. By Evan Schuman Apr 3, 2026 3 mins Cyberattacks Cybercrime Legal Google patches fourth Chrome zero-day so far this year At least it has some AI-powered tools to help it find and patch the bugs. By Maxwell Cooter Apr 3, 2026 2 mins Browser Security Endpoint Protection Vulnerabilities Internet Bug Bounty program hits pause on payouts HackerOne is the latest organization to struggle with AI submissions. By Maxwell Cooter Apr 3, 2026 2 mins Bugs Open Source Vulnerabilities Claude Code is still vulnerable to an attack Anthropic has already fixed Anthropic’s source code leak revealed a new way to get Claude Code to do things it doesn’t want to. By Maxwell Cooter Apr 3, 2026 2 mins Code Security Development Tools Vulnerabilities CERT-EU blames Trivy supply chain attack for Europa.eu data breach Attackers exploited a vulnerability scanner to steal 350GB of data that they then leaked on the dark web. By John E. Dunn Apr 3, 2026 4 mins Cloud Security Code Security Security Cloudflare’s new CMS is not a WordPress killer, it’s a WordPress alternative WordPress’s massive installed base isn’t going anywhere, but many developers and AI agents are not opting for the product for new sites. Will they go for Cloudflare instead? By Evan Schuman Apr 2, 2026 7 mins Business Enterprise Internet Security Cisco fixes critical IMC auth bypass present in many products The Integrated Management Controller (IMC) flaw gives attackers admin access and remote control over servers even when main OS is shut down. By Lucian Constantin Apr 2, 2026 4 mins Network Security Security Vulnerabilities EvilTokens abuses Microsoft device code flow for account takeovers The phishing-as-a-service toolkit leverages legitimate authentication to capture tokens and access Microsoft 365 services. By Shweta Sharma Apr 2, 2026 4 mins Phishing Security Social Engineering Vim and GNU Emacs: Claude Code helpfully found zero-day exploits for both A simple prompt sent Claude Code on a mission that uncovered major security vulnerabilities in popular text editors — and then suggested ways to exploit them. By John E. Dunn Apr 1, 2026 4 mins Code Editors Development Tools Vulnerabilities WhatsApp malware campaign uses malicious VBS files to gain persistent access The attack chain relies on delayed execution, trusted Windows utilities, and legitimate hosting services to maintain persistence and evade detection. By Shweta Sharma Apr 1, 2026 3 mins Cybercrime Malware Security 1…67891011121314…433 Show me morePopularArticlesPodcastsVideos news Google makes Gemini 4 AI model available to a trusted few By Nidhi SingalOct 1, 20265 mins Artificial IntelligenceSecurity news Cisco SD-WAN Manager hit by zero-day admin access attack By Shweta SharmaOct 1, 20264 mins Network SecurityVulnerabilitiesZero-Day Vulnerabilities opinion Why AI agents are like the dog that pushed kids into the Seine By Etay MaorOct 1, 20266 mins Access ControlData and Information SecurityIT Governance podcast Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security podcast The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO podcast Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cybercrime video Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security video The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO video Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cyberattacks
