ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
CISA flagged three actively exploited vulnerabilities in its KEV Catalog, including embedded malicious code in widely-used tools like Daemon Tools Lite and Nx Console. The additions underscore an escalating supply chain threat, with adversaries targeting popular software to compromise downstream use
Britain's top intelligence chief warns that Russia is escalating hybrid cyberattacks—including AI, critical infrastructure strikes, and election interference—in a "gray zone" below traditional warfare. Western nations risk losing the cyberspace battle unless governments and companies dramatically st
AI has collapsed exploit development from 125 days to 0.5 days, allowing attackers to weaponize vulnerabilities immediately upon patch release and drastically outpacing security teams. LLMs can now generate working proof-of-concept exploits from patch diffs, fundamentally shifting the threat landsca
Pretalx XSS vulnerability (CVE-2026-41241) lets attackers hijack organizer accounts via malicious talk submissions. Payload executes during search, granting full access. Fixed in v2026.1.0.
AD password complexity mandates backfire—users create predictable patterns and reuse credentials. This drives helpdesk costs and false confidence while stolen credentials cause nearly 45% of breaches.
In 20 years, cybersecurity evolved from simple perimeter defense (firewalls, antivirus) to addressing cloud and AI-driven threats. Modern defenders now require continuous monitoring and real-time response, not static signature-based protection.
OpenClaw, with 250K+ stars, faces a critical security crisis: 454+ documented vulnerabilities, tens of thousands exposed instances online, and Gartner recommends blocking it despite explosive enterprise adoption.
**Summary:** States face escalating cyberattacks but declining federal funding, leaving critical infrastructure vulnerable to sophisticated ransomware gangs and data extortion schemes. Congressional testimony from state security leaders warns that without restored federal support, communities' essen
Gitea's four-year authentication bypass exposed 30,000+ private container images worldwide. Attackers could download repositories without credentials, accessing secrets and proprietary code since 2022.
CISA ordered a 96-hour patch for CVE-2026-48172, a critical LiteSpeed cPanel flaw enabling unauthenticated root access. The actively exploited vulnerability affects millions of servers globally.
CISA added an actively exploited LiteSpeed cPanel zero-day to its KEV catalog, enabling RCE on vulnerable servers. Thousands of hosting environments face immediate risk and must patch urgently.
Microsoft patched CVE-2026-45659, a critical SharePoint RCE (CVSS 8.8) exploitable with basic authentication. Attackers can execute arbitrary code and gain full server control.
CVE-2026-5426 in KnowledgeDeliver exploits hardcoded ASP.NET machine keys to enable unauthenticated RCE and Godzilla web shell deployment. Threat actors exploited the vulnerability for months to establish persistent Cobalt Strike backdoors on affected servers.
CVE-2025-9970: ABB LVS MConfig stores passwords in plaintext memory, enabling credential theft from software controlling critical infrastructure globally (energy, water, transportation, manufacturing). CVSS 7.4 HIGH; requires local network access and user interaction.
CVE-2025-3450 is a critical ABB Automation Runtime flaw (CVSS 10.0) allowing unauthenticated network attackers to crash industrial control systems. Requiring no credentials or user interaction, it threatens critical infrastructure globally—energy, water, chemical, and healthcare sectors.
ABB Ability Camera Connect bundles outdated VLC containing critical vulnerabilities (CVE-2024-46461, CVE-2023-47360) that enable remote code execution via malicious media streams. CVSS 9.8 severity poses significant risk to industrial infrastructure globally.
CVE-2026-7251 exposes Eppendorf BioFlo 320 bioreactors to remote takeover via hard-coded VNC credentials. Unencrypted access could allow attackers to sabotage bioprocessing runs, contaminate batches, or damage equipment in pharma manufacturing. CVSS: 9.8 CRITICAL.
A KnowledgeDeliver zero-day exploits hardcoded cryptographic keys for remote code execution via ViewState deserialization attacks. Attackers deploy Godzilla web shells and Cobalt Strike backdoors for persistent access to vulnerable enterprise and educational LMS installations.
Anthropic launched a Claude Compliance API with 28 integrations to major security platforms (CrowdStrike, Palo Alto, Microsoft, Okta, etc.), enabling enterprises to monitor AI conversations and enforce data protection policies like email or SaaS apps. This closes critical gaps in AI governance—addre
AppOmni's Marlin AI automates detection of SaaS misconfigurations and recommends remediation with human approval required. It solves the challenge of securing 100+ enterprise SaaS applications that are difficult to review manually.
Tim Wilson co-founded Dark Reading and pioneered cybersecurity journalism when the field was niche. His publication became the industry standard for investigative rigor, technical depth, and editorial independence.
CERT-In mandates 12-hour patching for critical vulnerabilities amid AI-accelerated attacks. Threat actors now use AI to automate exploit development, making traditional patching cycles insufficient.
CVE-2026-45659 is a critical SharePoint deserialization flaw (CVSS 8.8) exploitable by any authenticated user. The RCE vulnerability enables arbitrary code execution with low attack complexity.
IT teams waste critical minutes switching between fragmented tools during network incidents. A June 2 webinar explores how automation and AI can unify incident response workflows.
CISA mandated 24-hour emergency patching for CVE-2026-9082, a critical unauthenticated SQL injection in Drupal under active exploitation. 670+ exposed instances threaten federal agencies and enterprises with data breach or remote code execution.
KB5087537 (May 2026) breaks Windows Server 2016 domain controller discovery, preventing authentication and resource access. Critical risk for enterprises that deployed this patch without testing.
CVE-2026-5426 in KnowledgeDeliver LMS exposes hard-coded ASP.NET encryption keys that allow unauthenticated remote code execution via forged ViewState payloads. Attackers actively exploited this flaw to deploy Godzilla web shell and Cobalt Strike, socially engineering users to install a fake securit
Nx Console extension poisoned via TanStack supply chain attack breached 3,800 GitHub repos, affecting OpenAI and Grafana. Public code release now enables further developer tool compromises.
Anthropic's Mythos tool discovered 23,000 vulnerabilities across 1,000 open source projects, many at critical severity. These flaws in foundational software expose millions of developers to potential supply chain attacks.
Dutch police arrested two men and seized 800+ servers from infrastructure used for Russian cyberattacks and election interference. The takedown disrupts Russia's hybrid warfare network in Europe.