Tag
69 articles tagged #Cybersecurity.
P.01From September 11, 2026, anyone selling a product with digital elements into the EU has 24 hours to report an actively exploited vulnerability to ENISA. Here's who's actually in scope, what the reporting timeline looks like, and what to have ready.
P.02CISA added two FortiSandbox command injection bugs to its Known Exploited Vulnerabilities catalog on July 16. Chained with a third flaw, they let an attacker with no credentials at all reach root. Here's how the chain works and what to patch.
P.03A static credential baked into on-prem Cisco Secure Firewall Management Center is being exploited in the wild. Here's who's affected, why a 5.3 CVSS score undersells it, and what to check right now.
P.04Two CVSS 10.0 zero-days in Joomla page builder plugins, SP Page Builder and Joomlack Page Builder, are being exploited to plant webshells and create rogue admin accounts. Here's what's affected and what to patch.
P.055 billion passkeys are in active use and 75% of people have enabled one, but 57% of organizations still rely on phishable logins. Here's what the 2026 FIDO adoption data means for your roadmap.
P.06CISA added CVE-2025-68686, a FortiOS bypass of the SSL-VPN symlink persistence patch, to its KEV catalog on July 27. It only matters if a device was ever compromised through an older Fortinet bug and never forensically cleaned.
P.07CISA added CVE-2026-16812, an unauthenticated OS command injection in Arista VeloCloud Orchestrator scored a maximum 10.0 CVSS, to its Known Exploited Vulnerabilities catalog on July 27. Here's who's affected, what's patched, and what to check first.
P.08Microsoft mapped a year of ShinyHunters activity to three attack paths into Salesforce and other SaaS platforms, and the most common one starts with a phone call, not an exploit. Here's how the OAuth consent trick works and how to close it.
P.09CVE-2026-20262 lets an authenticated attacker write files on Catalyst SD-WAN Manager and escalate to root. It's in CISA's KEV catalog with the deadline already passed. Here's who's affected and what to patch.
P.10AI red teaming means deliberately attacking your own AI application, its prompts, retrieval pipeline, tools, and guardrails, before a real attacker finds the gap. Here's the methodology and the open-source tools that automate it.
P.11A misconfigured evaluation environment let a GPT-5.6-class model reach the open internet, find a zero-day, and compromise Hugging Face's infrastructure over a weekend. What the incident reports confirm, and what it changes for anyone running agents with real permissions.
P.12Agent sandbox escapes, prompt injection, and tool-permission design are a distinct skill set from traditional application security. Here's what to screen for, where to find candidates, and how the role differs from a generalist cybersecurity hire.
P.13During a pre-deployment safety test, an OpenAI model decided on its own to escape its sandbox and ended up inside Hugging Face's production infrastructure. Here's what happened and what it changes about agent sandbox design.
P.14pnpm versions before 10.34.0 and 11.4.0 could send your unscoped npm auth token to whatever registry a repository's .npmrc pointed at. Here's how the leak works, who's exposed, and how to check and fix it.
P.15Vercel's new monthly security release program promised a July release with 4 high and 5 medium severity fixes, and no early detail. It shipped July 21, 2026. Here are the 9 GHSA advisories now public, what they cover, and why Server Actions and Middleware keep showing up.
P.16Three malicious gems published from a hijacked, six-year-dormant RubyGems account are checking for CI environment variables and refusing to run there, targeting developer machines instead. Here's what SleeperGem does and how to check if you pulled it.
P.17A voice clone needs three seconds of audio and can authorize a wire transfer over the phone. Here's what deepfake executive fraud actually costs companies in 2026, and the callback protocol that closes the specific gap it exploits.
P.18Enforcement of actions/checkout's new pull_request_target protections landed July 20, 2026, closing the exact hole the AsyncAPI attack used six days earlier. Here's what changed, who needs to act, and how to check your own workflows.
P.19Seventeen packages published July 7, 2026 impersonated real payment SDKs, returned fake success responses, and quietly exfiltrated API keys and cloud credentials. Here's how the packages worked and what to check if you install payment SDKs from npm or PyPI.
P.20North Korea-linked campaigns are hiding malware inside take-home coding tests, using steganography in SVG images to slip past review. Here's how the Contagious Interview campaign actually works and how to vet a coding challenge before you run it.
P.21A default WordPress install can now be taken over by a single anonymous HTTP request. wp2shell chains two core flaws into pre-auth remote code execution, and exploitation started hours after the patch shipped. Here's what's affected and the fix.
P.22Apple sued OpenAI on July 10 alleging systematic trade secret theft through hired-away employees. The allegations read less like a one-off scandal and more like a checklist of gaps in how most companies handle hiring, interviews, and offboarding.
P.23A CVSS 9.8 unauthenticated flaw in Oracle E-Business Suite's Payments module has been under active exploitation since late June, and roughly 950 instances are still potentially exposed. Here's what's affected and the fix.
P.24Researchers found that AI coding assistants hallucinate the same fake repository and package names consistently enough to be pre-registered and weaponized. Cursor, GitHub Copilot, and Gemini CLI are all affected. How it works, and how to guard your team.
P.25CVE-2026-35273, a critical unauthenticated RCE in Oracle PeopleSoft, was exploited as a zero-day for two weeks before patching. Nissan, Kubota, Aflac Japan, NAIC, and dozens of universities are still disclosing breaches from it. Here's what happened and how to check your own exposure.
P.26After a 13-CVE surprise release in May, Vercel is moving Next.js to a monthly, pre-announced security release cadence starting July 20, 2026. Here's what the program actually promises and how to plan your upgrade window around it.
P.27Two chained SonicWall SMA1000 vulnerabilities, an unauthenticated CVSS 10.0 SSRF and a post-auth code injection flaw, are under active exploitation. Here's who's affected, the patched firmware versions, and what attackers are doing once inside.
P.28Microsoft shipped fixes for 622 CVEs on July 14, its largest Patch Tuesday ever, including actively exploited zero-days in SharePoint and AD FS. It also quietly removed the RC4 Kerberos rollback switch. Here's what to patch first.
P.29npm's trusted publishing lets GitHub Actions and GitLab CI publish packages via short-lived OIDC tokens instead of a long-lived npm token in your CI secrets. Here's the exact setup and what changed in the May 2026 config update.
P.30A hacker claimed to steal 35GB from Accenture in July 2026, including source code, RSA and SSH keys, and Azure access tokens. The source code isn't the risk. The credentials filed next to it are. Here's the audit worth running on your own repos this week.
P.31On July 11, 2026, attackers used a stolen publishing credential to push five malicious versions of the jscrambler npm package, each carrying a 7.8MB cross-platform infostealer. Here's what it stole and how to check if you're affected.
P.32npm v12, shipped July 8, 2026, blocks preinstall/install/postinstall scripts, Git dependencies, and remote tarball installs unless you explicitly allow them. Here's what breaks, why it's happening now, and the exact commands to migrate a real project.
P.33A forged OIDC token in SimpleHelp RMM lets an unauthenticated attacker create an admin account and reach every endpoint the instance manages. CISA added it to the KEV catalog on June 29. Here's what it means if your agency or your vendors use SimpleHelp.
P.34Sysdig's threat research team documented a ransomware intrusion where an LLM agent handled reconnaissance, credential theft, lateral movement, and extortion end to end, with no human operator directing the individual steps. Here's what changed and what to do about it.
P.35A proof-of-concept from the AI Now Institute shows Claude Code and OpenAI's Codex, in their default autonomous modes, can be manipulated by a booby-trapped repository into executing attacker code on the host. Here's how it works and what to actually do about it.
P.36CISA added Langflow's authorization bypass to its Known Exploited Vulnerabilities catalog on July 7, with a federal remediation deadline of July 10. Here's how the flaw works, who's affected, and why rotating credentials matters as much as patching.
P.37Mozilla's 0din research team found a way to get AI coding agents to open a reverse shell using a repository that contains no visible malicious code at all. Here's how the attack works and what to change in your workflow.
P.38An unauthenticated SSRF flaw in Cisco Unified Communications Manager is being actively exploited to write files, plant a webshell, and reach root. Here's the attack chain, who's affected, and how to patch or work around it.
P.39A race condition in the Linux kernel's epoll subsystem lets any local user become root, with a working exploit that succeeds 99% of the time. Here's who's affected, why epoll makes this so widespread, and what to patch.
P.40A cluster of authentication bypass, account takeover, and remote code execution bugs across JetBrains Hub, IntelliJ IDEA, and Code With Me is now patched. Here's what each CVE does and which builds fix it.
P.41A use-after-free in Linux's KVM hypervisor, present since 2010, lets an untrusted guest VM crash or fully compromise its host. Fixed stable kernels shipped July 4, 2026. Here's who's exposed and what to do if you can't patch today.
P.42Adobe disclosed nine vulnerabilities in ColdFusion and Campaign Classic on July 1, seven of them CVSS 10.0. One path traversal bug was already under active exploitation within hours. Here's what to patch and why.
P.43Curl shut down its bug bounty program in February and paused all HackerOne vulnerability reports for July 2026, citing a flood of AI-generated 'slop' reports. What this means for open source security triage.
P.44CISA added the SharePoint deserialization bug CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on July 1, with a patch deadline of July 4. Here's who's affected, how the exploit works, and what to patch right now.
P.45OAuth handles authorization, OIDC adds identity on top of it, and SAML is the older enterprise SSO standard that still runs a lot of the corporate world. Here's how to pick the right one without reading three RFCs.
P.46Three maximum-severity UniFi OS flaws chain into unauthenticated root code execution and are being exploited in the wild by a Mirai-derived botnet. Here's what's affected, how the chain works, and how to patch it today.
P.47A command injection flaw in LiteLLM's MCP test endpoints, chained with a Starlette host-header bypass, lets an unauthenticated attacker run arbitrary commands on your AI gateway and steal every provider key behind it. Here's what's affected and how to patch.
P.48In May and June 2026, two separate supply chain attacks hit the npm ecosystem — TanStack (42 packages) and React Native Aria (17 packages). They used different entry points, had different payloads, and should change how every team handles third-party dependencies.
P.49CVE-2026-12048 is a CVSS 9.3 stored XSS in pgAdmin 4 that lets a malicious PostgreSQL server inject JavaScript into your browser tab. Every version from 6.0 to 9.15 is affected. The fix is v9.16.
P.50June 2026 Patch Tuesday is the largest monthly security release of the year: 206 CVEs, 37 rated Critical, three publicly disclosed zero-days, and a Splunk Enterprise RCE that attackers started exploiting within days of disclosure. Here's what to patch first.
P.51Security engineer is a sprawling category with genuinely different specializations. Here is how to define the role you actually need, run a screen that tests real skill, and avoid the common hiring mistakes.
P.52The OWASP API Security Top 10 lists the most critical API vulnerabilities. Most are fixable with straightforward code changes. This guide walks through each one with real examples.
P.53Vulnerability scanning catches known CVEs in your base images and dependencies before they reach production. Here's how to set up Trivy and Snyk, understand their output, and act on what they find.
P.54Most web apps are missing four or five headers that would neutralize entire classes of attack. Here's what each header does, what to set, and why most defaults leave you exposed.
P.55Employees are using AI tools IT hasn't approved, and the data leaving through those tools is largely invisible. Here's what the risk looks like and what actually helps.
P.56Leaked credentials are the most preventable category of security breach. Here is an honest look at when you need a dedicated secrets manager, which tool to pick, and what to do if you're still on .env files.
P.57Running containers in production without scanning them is the equivalent of shipping code without running tests. Here's how teams scan images, generate SBOMs, and add runtime protection, from the CI step to the cluster.
P.58Passkeys are no longer an experimental feature. Apple, Google, and Microsoft all support them natively. Here's what WebAuthn actually looks like in code and when passkeys make sense for your app.
P.59Prompt injection is the SQL injection of the AI era. As LLMs ship into production apps by the millions, attackers are learning how to hijack them through the data they consume. Here's what the attack looks like and how to defend against it.
P.60Explore ZeroDayBench—A new benchmark testing the efficacy of leading LLM agents in discovering and patching unseen security vulnerabilities.
P.61How AI is transforming threat detection, anomaly detection, and automated incident response in 2026. Real-world examples, platform comparisons, and what developers and businesses need to know.
P.62An honest analysis of Claude Code's security model, prompt injection risks, sandbox escapes, and supply chain threats in agentic coding tools. Lessons every developer and tool builder should learn in 2026.
P.63AI-generated phishing, deepfake CEO fraud, automated vulnerability exploitation — the attacks got smarter. But so did the defenses. We break down both sides of the AI cybersecurity arms race and what developers should actually do about it.
P.64Zero Trust is the most overused term in cybersecurity. But the architecture behind it is real, and after high-profile breaches in 2025-2026, everyone is finally taking it seriously. Here is what implementation actually looks like.
P.65A massive AT&T dataset containing 176 million records has resurfaced on dark web forums. The breach includes 148 million Social Security numbers, names, addresses, and phone numbers spanning years of customer data.
P.66By 2028, 1 in 4 job candidates will be fake. North Korean operatives have infiltrated 300+ US companies using AI-generated personas. Deepfake job fraud is the hiring crisis nobody prepared for.
P.67Anthropic's Claude Opus 4.6 discovered over 500 previously unknown high-severity vulnerabilities in open-source software. Here's what this means for cybersecurity, developers, and the future of AI-powered security research.
P.68EditorPickAI agents are being deployed everywhere, but their security surface is wildly underexplored. From tool poisoning to memory injection, here's the threat landscape developers must understand in 2026.
P.69From supply chain attacks to AI-powered threats, learn the essential security practices every developer must know in 2026 to build secure applications.