ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
The cybersecurity market saw 26 major M&A deals in May 2026, with leaders like Akamai, Check Point, and Cisco consolidating to expand threat prevention, cloud security, and OT protection capabilities. This wave reflects renewed investor confidence and a strategic pivot toward building comprehensive
Generative AI enables attackers to scale personalized phishing campaigns faster than SOCs can triage them. Tier 1 teams drown in plausible alerts, missing critical threats amid the noise.
Check Point patched a critical VPN zero-day exploited by Qilin ransomware gang. The vulnerability in Remote Access and Mobile Access products was actively exploited before a patch became available.
Traditional SIEMs burden SOCs with alert fatigue and infrastructure maintenance. Wazuh Cloud provides a managed alternative, shifting operational responsibility away from security teams so they can focus on actual threat detection rather than system administration.
Critical RCE in Everest Forms Pro (100K+ WordPress sites) allows unauthenticated attackers to inject malicious PHP via the Complex Calculation feature. Active exploitation began in April 2026.
OpenAI launches Lockdown Mode, Active Sessions, and passwordless authentication for ChatGPT to defend against emerging threats including prompt injection attacks, data theft, and account takeovers targeting users and organizations.
SolarWinds Serv-U has a critical DoS vulnerability actively exploited in the wild. Unauthenticated attackers can crash the service via HTTP POST requests with no credentials needed.
Microsoft's Intelligent Terminal integrates AI assistants (Claude, Copilot, Gemini) directly into Windows Terminal, letting developers get command-line help without alt-tabbing. It auto-detects errors and suggests fixes while maintaining session context.
Everest Forms Pro vulnerability CVE-2026-3300 enables unauthenticated code injection to seize WordPress sites. Attackers create hidden admin accounts and persistent webshells for durable access. 29,300+ attacks blocked since April 13, 2026.
**Opal Security raised $23M Series B to manage identity and access for AI agents at scale.** Traditional IAM tools can't handle the millisecond-speed decisions autonomous agents need.
**Summary:** CISA flagged an actively exploited DoS vulnerability (CVE-2026-28318) in SolarWinds Serv-U with a June 19 federal patch deadline. The flaw crashes the service without requiring authentication, affecting organizations relying on the file transfer platform.
Smart TV users unknowingly became proxies in Bright Data's scraping network, consuming up to 200 GB monthly and risking ISP throttling and legal liability without meaningful consent.
An AI agent uncovered 21 zero-day vulnerabilities in FFmpeg (used by browsers and streaming platforms), while Google released Chrome 149 with 429 patches—highlighting AI's advantage in discovering security flaws traditional analysis misses.
Critical command injection in Cisco SD-WAN Manager (CVE-2026-20245) is actively exploited. Attackers chain it with prior authentication bypasses to gain unauthenticated root access to entire SD-WAN networks, compromising centralized control of edge devices globally.
Toshiba, Samsung, and other retailers face fake login prompts from polyfill.io—a compromised domain from a 2024 supply-chain attack. Poor website cleanup practices expose millions to credential theft.
CISA warns of active SolarWinds Serv-U vulnerability exploitation allowing unauthenticated denial-of-service attacks. Threat actors crash servers with HTTP requests, disrupting operations.
OWASP's CVE Lite CLI enables developers to catch vulnerable dependencies early instead of slow CI/CD pipelines. Modern projects contain thousands of unvetted packages that SBOMs alone can't validate.
Drug trafficker Darren Hughes received 26+ years for distributing fentanyl and meth via Nemesis Market. He was arrested after sending samples and conducting transactions with an undercover agent.
Researchers warn of AI-powered worms capable of autonomously discovering vulnerabilities and adapting tactics across networks. Unlike traditional malware, these threats could rival NotPetya's scale.
Anthropic identifies emerging AI-specific threats including model extraction and jailbreak attacks. Organizations meanwhile grapple with unpatched vulnerabilities and shifting cybersecurity priorities.
Browsers are now attackers' primary target in 40%+ of credential breaches. Phishing, malicious extensions, and AI-powered threats are outpacing traditional security defenses.
**Summary:** Trump's voluntary 30-day AI vetting program lets federal agencies assess frontier models before release, but security experts doubt whether voluntary participation can effectively address emerging AI risks.
Chrome 149 patches a record 429 vulnerabilities, with over 100 rated critical or high-severity. The most dangerous flaw, CVE-2026-10881 (CVSS 9.6), is a sandbox escape in the ANGLE graphics engine enabling remote code execution—Google's largest single-release security update ever.
Everest Forms Pro (CVE-2026-3300) has a critical RCE flaw enabling unauthenticated code execution via forms. Actively exploited since April 2026, it has compromised thousands of WordPress sites.
Cisco disclosed CVE-2026-20245, a critical SD-WAN vulnerability allowing authenticated attackers root command execution. The 7th zero-day in 2026, it remains unpatched with active exploitation.
PCPJack hijacked 230 cloud servers across AWS, Google Cloud, and Azure to create an SMTP relay network for phishing campaigns, using automated systems to maintain a constantly refreshed proxy list.
Unpatched zero-day CVE-2026-20245 in Cisco Catalyst SD-WAN Manager enables root escalation and is actively exploited. Attackers chain it with other Cisco flaws to compromise networks.
TA4922, a Chinese cybercrime group, expanded from Japan-focused phishing to global campaigns across Asia, Europe, and Africa. It's now one of the most versatile threat actors tracked.
IronWorm malware harvests developer credentials to hijack npm packages and spread malicious updates. Compromising 36+ packages with 32,000+ monthly downloads, it demonstrates the escalating threat to open source supply chains.
Hitachi Energy RTU500 devices controlling power grids and water systems globally contain seven critical vulnerabilities enabling denial-of-service attacks. Firmware versions 12.7.1–13.8.1 require immediate patching to prevent cascading infrastructure failures.