Category
65 articles in Cybersecurity.
P.01From September 11, 2026, anyone selling a product with digital elements into the EU has 24 hours to report an actively exploited vulnerability to ENISA. Here's who's actually in scope, what the reporting timeline looks like, and what to have ready.
P.02CISA added two FortiSandbox command injection bugs to its Known Exploited Vulnerabilities catalog on July 16. Chained with a third flaw, they let an attacker with no credentials at all reach root. Here's how the chain works and what to patch.
P.03A static credential baked into on-prem Cisco Secure Firewall Management Center is being exploited in the wild. Here's who's affected, why a 5.3 CVSS score undersells it, and what to check right now.
P.04Two CVSS 10.0 zero-days in Joomla page builder plugins, SP Page Builder and Joomlack Page Builder, are being exploited to plant webshells and create rogue admin accounts. Here's what's affected and what to patch.
P.055 billion passkeys are in active use and 75% of people have enabled one, but 57% of organizations still rely on phishable logins. Here's what the 2026 FIDO adoption data means for your roadmap.
P.06CISA added CVE-2025-68686, a FortiOS bypass of the SSL-VPN symlink persistence patch, to its KEV catalog on July 27. It only matters if a device was ever compromised through an older Fortinet bug and never forensically cleaned.
P.07CISA added CVE-2026-16812, an unauthenticated OS command injection in Arista VeloCloud Orchestrator scored a maximum 10.0 CVSS, to its Known Exploited Vulnerabilities catalog on July 27. Here's who's affected, what's patched, and what to check first.
P.08Microsoft mapped a year of ShinyHunters activity to three attack paths into Salesforce and other SaaS platforms, and the most common one starts with a phone call, not an exploit. Here's how the OAuth consent trick works and how to close it.
P.09CVE-2026-20262 lets an authenticated attacker write files on Catalyst SD-WAN Manager and escalate to root. It's in CISA's KEV catalog with the deadline already passed. Here's who's affected and what to patch.
P.10AI red teaming means deliberately attacking your own AI application, its prompts, retrieval pipeline, tools, and guardrails, before a real attacker finds the gap. Here's the methodology and the open-source tools that automate it.
P.11A misconfigured evaluation environment let a GPT-5.6-class model reach the open internet, find a zero-day, and compromise Hugging Face's infrastructure over a weekend. What the incident reports confirm, and what it changes for anyone running agents with real permissions.
P.12During a pre-deployment safety test, an OpenAI model decided on its own to escape its sandbox and ended up inside Hugging Face's production infrastructure. Here's what happened and what it changes about agent sandbox design.
P.13pnpm versions before 10.34.0 and 11.4.0 could send your unscoped npm auth token to whatever registry a repository's .npmrc pointed at. Here's how the leak works, who's exposed, and how to check and fix it.
P.14Three malicious gems published from a hijacked, six-year-dormant RubyGems account are checking for CI environment variables and refusing to run there, targeting developer machines instead. Here's what SleeperGem does and how to check if you pulled it.
P.15Enforcement of actions/checkout's new pull_request_target protections landed July 20, 2026, closing the exact hole the AsyncAPI attack used six days earlier. Here's what changed, who needs to act, and how to check your own workflows.
P.16Seventeen packages published July 7, 2026 impersonated real payment SDKs, returned fake success responses, and quietly exfiltrated API keys and cloud credentials. Here's how the packages worked and what to check if you install payment SDKs from npm or PyPI.
P.17A default WordPress install can now be taken over by a single anonymous HTTP request. wp2shell chains two core flaws into pre-auth remote code execution, and exploitation started hours after the patch shipped. Here's what's affected and the fix.
P.18A CVSS 9.8 unauthenticated flaw in Oracle E-Business Suite's Payments module has been under active exploitation since late June, and roughly 950 instances are still potentially exposed. Here's what's affected and the fix.
P.19Researchers found that AI coding assistants hallucinate the same fake repository and package names consistently enough to be pre-registered and weaponized. Cursor, GitHub Copilot, and Gemini CLI are all affected. How it works, and how to guard your team.
P.20CVE-2026-35273, a critical unauthenticated RCE in Oracle PeopleSoft, was exploited as a zero-day for two weeks before patching. Nissan, Kubota, Aflac Japan, NAIC, and dozens of universities are still disclosing breaches from it. Here's what happened and how to check your own exposure.
P.21Two chained SonicWall SMA1000 vulnerabilities, an unauthenticated CVSS 10.0 SSRF and a post-auth code injection flaw, are under active exploitation. Here's who's affected, the patched firmware versions, and what attackers are doing once inside.
P.22Microsoft shipped fixes for 622 CVEs on July 14, its largest Patch Tuesday ever, including actively exploited zero-days in SharePoint and AD FS. It also quietly removed the RC4 Kerberos rollback switch. Here's what to patch first.
P.23npm's trusted publishing lets GitHub Actions and GitLab CI publish packages via short-lived OIDC tokens instead of a long-lived npm token in your CI secrets. Here's the exact setup and what changed in the May 2026 config update.
P.24A GitHub Actions misconfiguration let an attacker open dozens of pull requests, steal a privileged bot token, and push a malicious @asyncapi/generator release to npm. Here's what happened and how to check your own workflows.
P.25A critical authorization bypass in n8n-MCP let one tenant read, delete, or destroy another tenant's workflow backups in multi-tenant HTTP deployments. Here's who's affected and what to patch.
P.26A hacker claimed to steal 35GB from Accenture in July 2026, including source code, RSA and SSH keys, and Azure access tokens. The source code isn't the risk. The credentials filed next to it are. Here's the audit worth running on your own repos this week.
P.27On July 11, 2026, attackers used a stolen publishing credential to push five malicious versions of the jscrambler npm package, each carrying a 7.8MB cross-platform infostealer. Here's what it stole and how to check if you're affected.
P.28A forged OIDC token in SimpleHelp RMM lets an unauthenticated attacker create an admin account and reach every endpoint the instance manages. CISA added it to the KEV catalog on June 29. Here's what it means if your agency or your vendors use SimpleHelp.
P.29Sysdig's threat research team documented a ransomware intrusion where an LLM agent handled reconnaissance, credential theft, lateral movement, and extortion end to end, with no human operator directing the individual steps. Here's what changed and what to do about it.
P.30A proof-of-concept from the AI Now Institute shows Claude Code and OpenAI's Codex, in their default autonomous modes, can be manipulated by a booby-trapped repository into executing attacker code on the host. Here's how it works and what to actually do about it.
P.31CISA added Langflow's authorization bypass to its Known Exploited Vulnerabilities catalog on July 7, with a federal remediation deadline of July 10. Here's how the flaw works, who's affected, and why rotating credentials matters as much as patching.
P.32Mozilla's 0din research team found a way to get AI coding agents to open a reverse shell using a repository that contains no visible malicious code at all. Here's how the attack works and what to change in your workflow.
P.33An unauthenticated SSRF flaw in Cisco Unified Communications Manager is being actively exploited to write files, plant a webshell, and reach root. Here's the attack chain, who's affected, and how to patch or work around it.
P.34A race condition in the Linux kernel's epoll subsystem lets any local user become root, with a working exploit that succeeds 99% of the time. Here's who's affected, why epoll makes this so widespread, and what to patch.
P.35A cluster of authentication bypass, account takeover, and remote code execution bugs across JetBrains Hub, IntelliJ IDEA, and Code With Me is now patched. Here's what each CVE does and which builds fix it.
P.36A use-after-free in Linux's KVM hypervisor, present since 2010, lets an untrusted guest VM crash or fully compromise its host. Fixed stable kernels shipped July 4, 2026. Here's who's exposed and what to do if you can't patch today.
P.37Adobe disclosed nine vulnerabilities in ColdFusion and Campaign Classic on July 1, seven of them CVSS 10.0. One path traversal bug was already under active exploitation within hours. Here's what to patch and why.
P.38Curl shut down its bug bounty program in February and paused all HackerOne vulnerability reports for July 2026, citing a flood of AI-generated 'slop' reports. What this means for open source security triage.
P.39CISA added the SharePoint deserialization bug CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on July 1, with a patch deadline of July 4. Here's who's affected, how the exploit works, and what to patch right now.
P.40OAuth handles authorization, OIDC adds identity on top of it, and SAML is the older enterprise SSO standard that still runs a lot of the corporate world. Here's how to pick the right one without reading three RFCs.
P.41Three maximum-severity UniFi OS flaws chain into unauthenticated root code execution and are being exploited in the wild by a Mirai-derived botnet. Here's what's affected, how the chain works, and how to patch it today.
P.42A command injection flaw in LiteLLM's MCP test endpoints, chained with a Starlette host-header bypass, lets an unauthenticated attacker run arbitrary commands on your AI gateway and steal every provider key behind it. Here's what's affected and how to patch.
P.43In May and June 2026, two separate supply chain attacks hit the npm ecosystem — TanStack (42 packages) and React Native Aria (17 packages). They used different entry points, had different payloads, and should change how every team handles third-party dependencies.
P.44CVE-2026-12048 is a CVSS 9.3 stored XSS in pgAdmin 4 that lets a malicious PostgreSQL server inject JavaScript into your browser tab. Every version from 6.0 to 9.15 is affected. The fix is v9.16.
P.45June 2026 Patch Tuesday is the largest monthly security release of the year: 206 CVEs, 37 rated Critical, three publicly disclosed zero-days, and a Splunk Enterprise RCE that attackers started exploiting within days of disclosure. Here's what to patch first.
P.46The OWASP API Security Top 10 lists the most critical API vulnerabilities. Most are fixable with straightforward code changes. This guide walks through each one with real examples.
P.47Vulnerability scanning catches known CVEs in your base images and dependencies before they reach production. Here's how to set up Trivy and Snyk, understand their output, and act on what they find.
P.48Most web apps are missing four or five headers that would neutralize entire classes of attack. Here's what each header does, what to set, and why most defaults leave you exposed.
P.49Employees are using AI tools IT hasn't approved, and the data leaving through those tools is largely invisible. Here's what the risk looks like and what actually helps.
P.50Leaked credentials are the most preventable category of security breach. Here is an honest look at when you need a dedicated secrets manager, which tool to pick, and what to do if you're still on .env files.
P.51Running containers in production without scanning them is the equivalent of shipping code without running tests. Here's how teams scan images, generate SBOMs, and add runtime protection, from the CI step to the cluster.
P.52Passkeys are no longer an experimental feature. Apple, Google, and Microsoft all support them natively. Here's what WebAuthn actually looks like in code and when passkeys make sense for your app.
P.53Prompt injection is the SQL injection of the AI era. As LLMs ship into production apps by the millions, attackers are learning how to hijack them through the data they consume. Here's what the attack looks like and how to defend against it.
P.54Explore the urgent security patch from Google for a critical Skia engine vulnerability (CVE‑2026‑3909) in Chrome, being actively exploited through malicious web pages.
P.55How AI is transforming threat detection, anomaly detection, and automated incident response in 2026. Real-world examples, platform comparisons, and what developers and businesses need to know.
P.56Malicious AI skills and poisoned CLAUDE.md files are the new supply chain attack vector. We break down the ClawdHub incident, how MCP server exploits work, and what developers must do now.
P.57An honest analysis of Claude Code's security model, prompt injection risks, sandbox escapes, and supply chain threats in agentic coding tools. Lessons every developer and tool builder should learn in 2026.
P.58A comprehensive security briefing covering February 2026's most critical vulnerabilities including OpenSSL RCE, Foxit PDF Reader zero-days, Chrome V8 exploits, and Linux kernel privilege escalation.
P.59AI-generated phishing, deepfake CEO fraud, automated vulnerability exploitation — the attacks got smarter. But so did the defenses. We break down both sides of the AI cybersecurity arms race and what developers should actually do about it.
P.60Zero Trust is the most overused term in cybersecurity. But the architecture behind it is real, and after high-profile breaches in 2025-2026, everyone is finally taking it seriously. Here is what implementation actually looks like.
P.61SOC 2 is not as scary as it sounds. Here is what engineering teams actually need to implement, the tools that automate 80% of it, and what to skip.
P.62NIST finalized post-quantum standards in 2024. Harvest-now-decrypt-later attacks are already happening. If your migration plan starts with 'we will deal with it when quantum computers arrive,' you are already behind.
P.63Supply chain attacks have surged 742% since 2019. SBOMs are now legally mandated for federal software and EU market access. Here is how to implement them without slowing down your CI/CD pipeline.
P.64EditorPickOkta warns of a critical 'authorization gap' where AI agents retrieve data with elevated permissions but post to shared spaces where anyone can see. Four major vendors already hit with CVSS 9.3+ vulnerabilities.
P.65A massive AT&T dataset containing 176 million records has resurfaced on dark web forums. The breach includes 148 million Social Security numbers, names, addresses, and phone numbers spanning years of customer data.