ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Enterprise AI adoption surges while insurers split on coverage, creating protection gaps. Threat actors weaponize AI faster than policies can adapt, driving cyber-insurance claims upward.
ServiceNow traced its June security alert to legitimate bug bounty researchers, not threat actors. The incident demonstrates the challenge of distinguishing responsible security research from actual breaches.
CVE-2026-5027, a path traversal flaw in Langflow, is actively exploited to write files to servers. The unauthenticated vulnerability threatens developers using the popular AI platform.
**Summary:** Nightmare-Eclipse released RoguePlanet, a Windows Defender zero-day exploiting a race condition for SYSTEM privilege escalation. The second monthly exploit reflects an ongoing dispute with Microsoft following their record Patch Tuesday release.
CISA added three actively exploited vulnerabilities to its KEV catalog: Chrome V8 RCE, Cisco SD-WAN Manager privilege escalation, and Arista EOS packet handling flaw. Notably, Arista refuses to release a patch for its vulnerability.
Langflow CVE-2026-5027 allows unauthenticated RCE via path traversal in file uploads. No patch exists; default auto-login leaves thousands of instances vulnerable to active exploitation.
Fortinet, Ivanti, and SAP simultaneously disclosed critical vulnerabilities with CVSS 10.0 scores enabling unauthenticated RCE. Enterprises must urgently patch deployed mission-critical systems. (194 characters, 2 sentences)
Aryon Security raised $29M in Series A to provide a unified security control platform across multi-cloud environments, addressing fragmentation in enterprise cloud security infrastructure.
Cyera raised $600M at a $12B valuation, cementing its billion-dollar unicorn status in data security. The funding reflects strong investor confidence in specialized data protection solutions that help organizations identify and secure sensitive data across hybrid and cloud environments.
Infostealers harvest credentials from millions of compromised devices. Ransomware groups now buy these stolen logins to breach organizations, replacing exploits as the primary attack vector.
Microsoft patched an exploited XSS flaw in Exchange Server allowing attackers to steal credentials via malicious JavaScript injection. The zero-day is actively weaponized, threatening on-premises deployments.
Cyber warfare has become the central modern battlefield, with attacks on hospitals, utilities, and financial systems reshaping global geopolitics. This invisible threat now pervades all connected infrastructure worldwide, demanding urgent focus beyond just IT departments.
Microsoft patched 206 flaws in its largest Patch Tuesday—including 3 zero-days and critical RCEs in Windows kernel and DHCP that need no authentication to exploit, threatening enterprise networks.
Microsoft patched three critical zero-days: GreenPlasma and MiniPlasma enable local privilege escalation to SYSTEM level, while YellowKey bypasses BitLocker encryption with physical access. The flaws, disclosed by researcher "Nightmare Eclipse," escalate tensions between Microsoft and the security c
Microsoft warned of Windows update failures on devices upgraded to 24H2/25H2. A corrupted component store causes errors (0x80073712, 0x800f0993), blocking June 2026 security updates.
Fortinet and Ivanti released patches for zero-auth RCE flaws. Ivanti's CVSS 10.0 vulnerability enables unauthenticated remote code execution. Immediate patching is critical.
Arista Networks won't patch a critical vulnerability in EOS allowing unauthenticated remote code execution on network infrastructure. The actively exploited flaw affects tens of thousands of switches globally, raising concerns about vendor responsibility and network security standards.
ServiceNow disclosed a critical zero-day vulnerability exploited by threat actors to access customer instances without authentication. The flaw affected multiple enterprises across industries and was patched immediately after discovery on June 5, 2026.
Six protobuf.js vulnerabilities enable RCE and DoS via untrusted schemas, threatening Node.js apps and CI/CD systems. The most severe exploits prototype poisoning for arbitrary code execution.
**Microsoft Defender's RoguePlanet flaw enables SYSTEM privilege escalation on patched Windows. The race condition exploit is actively weaponized in the wild after public disclosure.**
Ivanti patched two critical Sentry gateway flaws: unauthenticated RCE as root and admin account takeover. Versions before R10.5.2, R10.6.2, and R10.7.1 are affected.
Critical RADIUS flaw in Schneider Electric's Modicon switches (CVE-2024-3596) enables authentication bypass in industrial networks. Risk applies only if RADIUS Message Authenticator is disabled.
Schneider Electric's industrial gateways vulnerable to default credential attacks (CVE-2026-6866). The flaw exposes critical infrastructure—power grids, manufacturing, energy—when devices reset to factory settings, allowing attackers to bypass authentication and gain unauthorized access.
OpenSSL disclosed 18 vulnerabilities, including CVE-2026-45447—a heap corruption flaw in PKCS#7 found with AI assistance. The use-after-free bug enables remote code execution in email systems.
Anthropic released Claude Fable 5, a safeguarded Mythos variant free until June 22, 2026, balancing AI innovation with security to prevent misuse for hacking or zero-day exploits.
Anthropic released Claude Fable 5 with safety restrictions for high-risk domains like cybersecurity and biology, while trusted partners receive unrestricted Claude Mythos 5. The dual approach balances powerful AI capabilities with safeguards against malicious use.
Microsoft's June Patch Tuesday sets a record with 206 CVEs, driven by AI-accelerated discovery. Three zero-days are being exploited; 32 rank critical. Organizations can't patch fast enough.
Microsoft released patches for 200 vulnerabilities in June 2026—a historic record driven by AI-accelerated discovery. An anonymous researcher is simultaneously releasing exploits for zero-days before patches arrive, escalating the security crisis.
ServiceNow patched a critical API flaw allowing unauthenticated access to customer data (tickets, records, credentials). The June 5 fix addressed an endpoint with disabled authentication requirements.
Microsoft Defender zero-day (RoguePlanet) enables SYSTEM-level privilege escalation on Windows via a race condition in file handling. Released by Nightmare Eclipse with variable reliability across machines.