ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
A five-year firmware bug disabled Coldcard's hardware RNG, forcing it to use a weak PRNG with predictable seeds based only on device identifiers. Attackers exploited this to steal $70.2 million in Bitcoin from 1,196 addresses in 41 minutes without physical device access.
Rails' Active Storage (libvips) lets attackers upload images reading arbitrary files, exposing `secret_key_base`. With this master key, they forge sessions and manipulate data for full server compromise.
CVE-2026-66066 (CVSS 9.5): Rails Active Storage + libvips flaw allows unauthenticated file reads, exposing environment secrets for RCE. Patched this week—rotate all exposed credentials immediately.
OpenAI's cheaper GPT-5.6 pricing lets threat actors affordably scale AI-powered phishing at mass scale. The article warns that technology commoditization—like past GPU and cloud compute drops—benefits attackers faster than defenders adapt.
California's DROP platform consolidates deletion requests across data brokers, eliminating the need to contact dozens individually. But brokers can delay removal, and unregistered brokers remain unregulated—a partial solution to decades of legal surveillance.
Chrome shipped 1,442 patches in three releases, far exceeding normal. The surge may reflect better detection or technical debt; memory safety bugs account for 70% of high-severity vulnerabilities.
Researchers discovered 84 vulnerabilities in open-source 5G/LTE core implementations that exploit "implicit trust errors"—components blindly accept unverified internal messages, enabling attackers to hijack active network sessions without credentials.
Google's AI-driven vulnerability discovery system found 1,800+ Chrome bugs in 2026, including a critical 13-year-old sandbox escape (CVE-2026-3545) that evaded all prior security reviews. The flaw allowed arbitrary local file access via a compromised renderer, demonstrating how AI-powered scanning c
Device code phishing bypasses MFA by exploiting OAuth 2.0, tricking users to authenticate at legitimate Microsoft URLs. The attack evolved from research curiosity to mass commodity threat in months, now generating millions of attacks.
Wiz discovered a Gremlin API vulnerability in Azure Cosmos DB that exploited .NET reflection to escape the sandbox, exposing a master key granting platform-wide database access.
CVE-2026-63077 is an unauthenticated RCE in TeamCity's build agent polling protocol. Attackers can execute code without credentials, risking access to repos, deployment secrets, and signing keys.
RouterOS CVE-2026-14227: Demoted sessions retain old permissions, exposing WireGuard keys. Affects all RouterOS with API; requires prior elevated access.
TeamCity has a 9.8 CVSS auth bypass (CVE-2026-63077) enabling remote command execution via the agent polling protocol. VPN-protected UIs offer false security if build agents are externally reachable.
Schneider Electric IGSS has a critical flaw (CVE-2026-12927) allowing arbitrary code execution through malicious CGF files. It affects engineering workstations with SCADA network access.
CVE-2026-13584 in Mitsubishi CC-Link IE TSN allows network attackers to tamper with or disable industrial controllers. All current firmware is vulnerable; risks include DoS or silent data corruption.
NASA's cFS Health & Safety app has a remote null pointer dereference (CVE-2026-18064) causing DoS via processor reset. An incomplete prior patch left this unfixed. No auth required; CVSS 7.5.
Bank of America is acquiring UK-based MDSec, an offensive security firm specializing in red team work and adversary simulation. The deal signals financial services' strategic shift toward insourcing scarce offensive security talent and deep technical capabilities historically outsourced to external
Claude is hyped for security but can't replace threat intelligence or detection engines. Its main risk: confident-sounding but often inaccurate analysis that could cause missed detections.
AI agents are vulnerable to "confused deputy" attacks where untrusted data in retrieved context or tool outputs tricks the model into unintended actions. The real security risk isn't the AI model itself, but the entire unaudited architecture surrounding it.
VMware patched critical vulnerabilities combining authentication bypass and VM escape—enabling attackers to escalate from unauthenticated network access to complete infrastructure control. This attack chain poses an existential threat to enterprises; patches are urgent for all vSphere deployments.
Russian organizations face a coordinated cybercrime blitz exploiting trust in familiar interfaces: xplogs22 spreads XWorm via phishing, LunaSpy masquerades as antivirus to steal data, and Toy Ghouls deploys GenieLocker ransomware. Social engineering proves far harder to patch than technical exploits
Google's AI discovered a 13-year-old Chrome vulnerability that humans missed. Chrome 149-150 fixed 1,072 bugs—more than the prior 23 releases—using an end-to-end AI pipeline for discovery, triage, and patches.
igloohome's Android app embedded hardcoded credentials, exposing backend lock services to unauthorized access (CVE-2026-16581). The fix involved removing secrets and hardening server authentication.
Researchers exploited .NET reflection in Azure Cosmos DB's Gremlin engine to escape sandboxes and access shared gateways, stealing primary account keys for any customer globally.
Orphaned DNS records pointing to decommissioned resources are exploitable for subdomain takeovers. AI automation could scale this known vulnerability into a widespread national security threat.
Discern Security raised $13M to solve AI agent security risks in enterprises. Agents hold unaudited permissions and actively use them, creating threats beyond traditional identity management.
Cantina, an $8M startup, uses AI agents to automate vulnerability remediation—not just detection. The bet: fix backlogs that pile up faster than teams can clear them.
DataBahn raised $40M to monitor autonomous AI accessing organizational data—a major oversight. Agentic systems dynamically decide what to fetch, creating risks beyond traditional pipeline security.
South Korea's mandatory AnySign4PC banking software contained a zero-day vulnerability that state-sponsored hackers exploited for a year. Users were infected just by visiting normal websites, illustrating how mandated security tools become systemic national vulnerabilities.
AI agents evade firewalls by using ordinary HTTPS traffic with invisible intent. Check Point's 'AI Network Firewall' adds intent-aware enforcement to detect autonomous agent activity.