ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
CISA added a critical SD-WAN vulnerability to its exploited flaws catalog after threat actors began weaponizing it in real-world attacks. The flaw enables unauthorized network access, lateral movement into core infrastructure, data exfiltration, and persistent compromises of branch office and cloud-
Mature SOCs respond to threats faster by centralizing threat context, not through superior tools or staff. This structural advantage cuts MTTR significantly, reducing incident damage, compliance risk, and team burnout.
Ofcom is investigating Telegram for failing to prevent child sexual abuse material distribution. The inquiry reflects growing pressure on platforms to balance privacy with child safety obligations.
Google patched a critical prompt injection vulnerability in Antigravity IDE that allowed arbitrary code execution through insufficient input sanitization. The flaw exploited file-creation capabilities, potentially compromising developer systems.
6,400+ Apache ActiveMQ servers face active code injection exploits despite patches, enabling remote code execution. Threat actors are weaponizing the critical flaw in the wild.
** CISA added 8 actively exploited vulnerabilities to its KEV catalog, including three critical Cisco SD-WAN Manager flaws and PaperCut CVE-2023-27351. Federal agencies face April-May 2026 patching de
A sophisticated scam deployed 26 counterfeit cryptocurrency wallet apps on Apple's China App Store, impersonating MetaMask, Coinbase, and Trust Wallet to deceive users into revealing seed phrases. These cryptographic recovery keys grant attackers complete access to stolen digital assets.
CISA cataloged eight actively exploited vulnerabilities in print, CI/CD, CMS, and SD-WAN systems. They enable privilege escalation and auth bypass. Federal agencies must remediate per BOD 22-01.
Serial-to-IP converters connecting legacy systems to networks harbor thousands of vulnerabilities—hard-coded credentials, unencrypted protocols, and unpatched firmware—creating a critical but historically overlooked attack surface.
** SGLang CVE-2026-5760 (CVSS 9.8) lets attackers achieve RCE via malicious GGUF model files. Patch immediately, verify model provenance, and isolate inference workloads.
Senate extended Section 702 FISA surveillance powers through April 30 after chaotic House votes nearly let them expire. The narrow vote reflects ongoing tension between national security and privacy advocates over warrant-free intelligence collection.
The Coast Guard requires cybersecurity controls for maritime vessels and ports, including vulnerability scanning and incident response. This regulatory framework provides critical infrastructure lessons for enterprise security leaders navigating evolving threat landscapes.
** Researchers disclosed a design-level flaw in Anthropic's Model Context Protocol that enables remote code execution via malicious or poisoned MCP servers, threatening the broader AI supply chain. Sa
Microsoft rolled back a faulty service update that disabled Teams for enterprises, causing widespread launch failures and authentication errors. The company identified and restored service within 48 hours after impact to thousands of organizations during peak business hours.
Microsoft is boosting File Explorer performance in Windows 11 through Insider testing, focusing on faster launch times and smoother file operations before wider release. The updates address responsiveness during navigation, reduce resource consumption, and improve handling of large directories and n
Despite a year-long exploitation campaign against TP-Link routers, attackers failed to achieve payload execution in the wild, revealing the significant gap between theoretical vulnerability and practical attack success. The research underscores how technical barriers can prevent weaponization even w
Attackers weaponize Apple's own notification system by triggering account changes, then embedding phishing links in the resulting emails from Apple's servers. These fraudulent iPhone purchase alerts bypass security filters since they originate from legitimate Apple infrastructure.
A bug in Microsoft Edge disables right-click paste in Teams, disrupting workflow for enterprise users. Keyboard shortcuts still work, but Microsoft has issued an urgent advisory as affected organizations seek workarounds.
A critical remote code execution flaw in protobuf.js enables unauthenticated attackers to execute arbitrary code via malicious protobuf messages. With public exploit code now available, millions of JavaScript applications processing untrusted serialized data face immediate exploitation risk.
** A new Mirai variant called Nexcorium is exploiting CVE-2024-3721 in TBK DVRs and EoL TP-Link routers to build a DDoS botnet, with peak attacks hitting 1.2 Tbps. Patch, segment, or replace affected
Tycoon phishers abandoned traditional 2FA interception for device code phishing, tricking victims into authorizing attackers' devices instead. This approach exploits legitimate auth flows designed for browserless devices, completely bypassing 2FA protections.
NIST is reducing its CVE data enrichment responsibilities due to resource constraints and scalability challenges, shifting from a centralized model to a distributed ecosystem. Industry coalitions must now fill the gap in providing vulnerability context, severity ratings, and impact assessments that
CoChat tackles "shadow AI"—employees using unauthorized AI tools without oversight, exposing sensitive data. The governance platform provides visibility and control over AI adoption across enterprises.
Legacy vulnerabilities are now critical threats as AI automates their identification and exploitation at scale. What organizations once safely deprioritized is now weaponized across thousands of systems simultaneously.
Apache ActiveMQ has a CVSS 10.0 RCE vulnerability being actively exploited without authentication via OpenWire protocol. Arbitrary code execution is possible on affected versions. Immediate patching is required.
NIST is revamping the CVE framework to prioritize real-world impact over volume, tackling alert fatigue from 25,000+ annual CVEs. The shift aims to reduce triage burden and improve security outcomes.
The Coast Guard introduced cybersecurity mandates for maritime infrastructure covering asset management, network segmentation, and incident reporting. This framework provides enterprise security leaders a governance blueprint for protecting operational technology while managing modern threats.
** Musician G. Love lost his crypto savings to a fake wallet app on Apple's App Store that harvested his seed phrase. Counterfeit wallets routinely bypass app review — never enter a seed into a newly
** Threat actors are actively exploiting three Microsoft Defender zero-days — BlueHammer, RedSun, and UnDefend — for local privilege escalation to SYSTEM. Two remain unpatched; defenders should layer
** Modern phishing bypasses MFA via session-token theft, and MSPs are prime targets. Providers must fuse prevention with tested, immutable recovery — treating resilience as one discipline, not two.