ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Chrome 149 patched 429 vulnerabilities, including zero-day CVE-2026-11645 actively exploited in June 2026. Attackers chained this V8 flaw with sandbox escapes for unrestricted code execution.
Critical unauthenticated RCE in Ivanti Sentry allows root-level command execution. Active exploitation detected via honeypots globally. Attackers have complete system control once compromised.
Security experts debate Claude Fable 5's safeguards. While Anthropic implemented tiered access controls, the model's speed and lower cost increase accessibility for both legitimate and malicious uses, raising dual-use concerns despite built-in safety measures.
Self-hosted LangGraph deployments are vulnerable to remote code execution through SQL injection and unsafe deserialization flaws affecting SQLite and Redis checkpoints. The managed LangSmith cloud platform is unaffected. Immediate patching is critical for self-hosted instances.
Agentjacking exploits AI coding agents like Claude Code through malicious Sentry errors, tricking them into executing arbitrary code with full developer privileges. This attack bypasses traditional security entirely by exploiting trust in error-tracking integrations, achieving 85% success in testing
Ivanti Sentry's unauthenticated RCE (CVE-2026-10520) is actively exploited, with backdoors established hours after patching. This critical gateway vulnerability threatens enterprise perimeter access and CISA's 72-hour deadline signals urgent remediation priority.
Google confirmed ShinyHunters actively exploits PeopleSoft zero-day CVE-2026-35273, which Oracle hasn't publicly disclosed. Unknown organizations face compromise with unconfirmed breach scope.
Kyushu Electric lost a backup drive with 10.9M customers' data from a locked server room, signaling a security breach or insider threat. The missing data includes names, addresses, and usage records but excludes financial information.
Two critical authentication flaws in Brickcom cameras expose live feeds and administrative access to unauthenticated attackers worldwide. No patch is available as the vendor ignores CISA coordination requests, leaving critical infrastructure like hospitals and financial institutions vulnerable.
Naxclow IoT devices suffer three critical flaws enabling silent takeover and permanent unauthorized access. The vendor remains unresponsive to disclosure, leaving no patches or timeline for fixes.
ShinyHunters exploited a critical Oracle PeopleSoft zero-day exposing 455,000+ individuals across 100+ organizations, primarily universities. The unauthenticated RCE flaw was patched June 10.
Hard-coded MQTT credentials in Yarbo apps expose thousands of robots to remote command injection attacks. Attackers can monitor and control devices fleet-wide using only a serial number, risking disruption of critical infrastructure operations.
OT networks need more than network segmentation: textbook best practices create false security when implementation and monitoring fall short. Vigilant oversight remains critical.
Critical Ivanti vulnerability enabling unauthenticated RCE was exploited within 24 hours of disclosure. Attackers had pre-reconnaissance on customer networks before patch details were public.
Oracle revealed a critical zero-day in PeopleSoft enabling unauthenticated remote code execution. ShinyHunter is actively exploiting it to steal data from enterprise HR and payroll systems.
GreatXML bypasses BitLocker by exploiting recovery partition XML files, enabling unrestricted decryption without credentials. Released by researcher Chaotic Eclipse, it's the second major bypass in weeks, exposing critical Windows encryption vulnerabilities.
CISA's BOD 26-04 mandates federal agencies patch critical vulnerabilities within 3 days using risk-based timelines instead of general severity scores. Agencies must automate vulnerability reporting, inventory all publicly accessible assets, and comply with strict deadlines or face security posture p
SOCs drown in alerts, mostly false positives. The problem isn't volume but relevance—lack of context to prioritize genuine threats turns protective systems into a security liability.
CISA issued an emergency directive requiring federal agencies to patch critical exploited vulnerabilities within 72 hours or face sanctions. The compressed timeline—far shorter than typical 30-day cycles—reflects severe threats to U.S. government networks and critical infrastructure.
Oracle patched CVE-2026-35273, a critical remote code execution flaw in PeopleSoft that requires no authentication. The zero-day vulnerability was reportedly exploited by the ShinyHunters threat group against enterprise users before the patch became available.
The 2026 Cybersecurity Stars Awards honor 95 categories of invisible defensive work preventing breaches silently. The awards address cybersecurity's recognition gap for unheralded security teams.
AI-driven attacks exploit gaps in fragmented MSP security stacks. These machine-speed threats accelerate reconnaissance across thousands of client networks, making traditional defenses obsolete.
Siemens Desigo CC security patches are incorrectly flagged as malware by antivirus tools, forcing organizations to choose between applying critical updates and avoiding false alerts. The misidentification delays necessary patching while exposing gaps in threat detection accuracy.
CVE-2026-5027 is a high-severity path traversal flaw in Langflow's file upload endpoint being actively exploited for unauthenticated remote code execution. With 7,000+ exposed instances and default unauthenticated auto-login, attackers can traverse directories and execute arbitrary code with a singl
OceanLotus resurfaced with SPECTRALVIPER, targeting Vietnamese infrastructure and stock trading software in coordinated campaigns. The attacks mark a strategic shift toward domestic targets after three years away.
Microsoft fixed a two-month BitLocker bug in Windows Server 2025 that forced recovery key prompts on restart after April patches. The update resolves enterprise operational disruptions.
Microsoft patched zero-day CVE-2026-42897 in Exchange Server enabling unauthenticated code execution. The actively exploited flaw (CVSS 9.8) affects Exchange 2016/2019 and requires urgent patching for enterprises.
CVE-2026-10520 in Ivanti Sentry allows unauthenticated RCE with root privileges. Active exploitation confirmed within 24 hours of patch release, affecting 40,000+ customers globally.
CISA's new BOD 26-04 mandates 3-day patching for critical vulnerabilities, driven by AI accelerating exploitation. Federal agencies must match automated attackers' speed or risk compromise.
North Korean and Chinese cyber groups stole $2.02 billion in cryptocurrency in 2025, representing 6-7% of North Korea's GDP. Six of nine major financial threat groups targeting Asia-Pacific are state-linked, conducting sophisticated data-leak-and-ransom campaigns against financial institutions and e