ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Anthropic announced Project Glasswing with Claude Mythos, an AI that found thousands of zero-day vulnerabilities in weeks. Restricted to 40 organizations with 12 founding partners including Apple, AWS, Google, and Microsoft. Anthropic is committing $100M in usage credits and $4M to open-source secur
Storm-1175 exploits zero-day vulnerabilities to deploy Medusa ransomware in under 24 hours using double-extortion tactics. The financially motivated group represents an escalating threat to enterprise networks.
A critical vulnerability in Ninja Forms File Uploads allows unauthenticated attackers to upload arbitrary files and execute code on WordPress sites, threatening thousands of installations with complete compromise.
Google patched a critical StrongBox vulnerability that could allow attackers to compromise Android's hardware-backed cryptographic keys and bypass device-level security. The flaw highlights the importance of timely security updates for protecting sensitive authentication and encryption data on moder
**Summary:** Flowise, a popular open-source LLM platform, has a critical unauthenticated remote code execution vulnerability being actively exploited in the wild. Attackers can execute arbitrary commands without credentials on exposed instances, particularly threatening organizations running it in c
Trent AI raised $13M to secure autonomous AI agents. As 74% of enterprises plan agentic AI deployment, the startup addresses critical gaps in code generation and tool chain security.
Organizations manipulate security metrics by creatively defining KPIs—inflating detection rates, patch coverage, and compliance claims—masking real vulnerabilities. Without standardized measurement standards like accounting's GAAP, security metrics function as marketing tools rather than reliable sa
Mitsubishi Electric's GENESIS64 and ICONICS Suite store SQL Server credentials in plaintext SQLite caches when local caching is enabled, allowing local attackers to steal credentials and compromise critical manufacturing systems. The flaw (CVE-2025-14815/14816, CVSS 8.8) requires immediate patching
Docker's authorization plugin bypass (CVE-2026-34040, CVSS 8.8) enables privilege escalation through incomplete patching. Attackers can bypass access controls to compromise hosts in multi-tenant environments.
Law enforcement disrupted FrostArmada, an APT28 campaign hijacking routers to steal Microsoft 365 credentials from global organizations, including government and critical infrastructure.
CVE-2025-59528, a critical RCE in Flowise, is actively exploited with no authentication required. Wide adoption of the LLM platform creates a broad attack surface for threat actors targeting AI/ML teams building custom applications.
At RSAC 2026, security leaders debated how to balance autonomous AI's speed in threat response with human oversight, grappling with alert fatigue, control risks, and regulatory accountability.
AI is reshaping cybersecurity faster than organizations can adapt, with threat actors automating attacks at unprecedented scale. Organizations face a 12-18 month adoption gap that threatens security posture.
Automated pentesting efficiently finds known vulnerabilities but misses novel attacks, business logic flaws, and creative exploitation paths requiring human reasoning. Organizations falsely believing automation provides complete security validation leave dangerous blind spots in their defense progra
RSAC 2026 revealed cybersecurity's biggest challenge: workforce sustainability, not technology. The industry faces a talent crisis with 700k+ unfilled positions, driven by burnout, widening skills gaps, and limited diversity.
Medusa ransomware executes complete attacks in 48-72 hours using zero-day exploits. This speed bypasses security detection, enabling rapid extortion and operational disruption.
**Summary:** Despite sophisticated IAM investments, enterprises maintain hundreds of shadow applications disconnected from centralized identity systems, creating vulnerabilities to AI-powered threats. These isolated applications represent a critical security blind spot.
Cambodia sentenced scam compound operators to life imprisonment. While marking rare accountability, experts doubt it will dismantle the decentralized ecosystem victimizing thousands globally.
Storm-1175 combines zero-day and known vulnerabilities to rapidly deploy Medusa ransomware. The dual-vector approach and high-velocity attack patterns pose significant risk to enterprises.
A critical RCE vulnerability (CVE-2025-59528, CVSS 10.0) in Flowise's CustomMCP node allows unauthenticated attackers to execute arbitrary code by exploiting unsanitized user input. Over 12,000 exposed instances are actively under attack, making this one of the most dangerous application-layer vulne
Fortinet released an emergency patch for CVE-2026-35616, a critical authentication bypass in FortiClient (CVSS 9.8) being actively exploited to gain unauthorized access without credentials. The network-based flaw affects millions of enterprise deployments.
Social engineers targeted Axios maintainers to compromise the popular JavaScript library. Though unsuccessful, the attack reveals a broader, industrialized campaign against critical open-source packages.
Google DeepMind exposed how web-based AI agents can be manipulated through malicious content, lacking safeguards against attacks. This creates security risks as autonomous AI deployment accelerates.
A critical React2Shell vulnerability (CVE-2026-14847) enables attackers to execute arbitrary code and steal credentials like API keys and tokens from dev machines. The CredHarvest-2026 campaign exploits this via phishing emails containing malicious React component files, compromising 3,400+ developm
Microsoft patched a critical Classic Outlook bug that caused messages to silently fail delivery—appearing sent but never reaching recipients. The vulnerability affected enterprise users relying on the legacy desktop client.
A disgruntled researcher leaked BlueHammer, a Windows kernel vulnerability enabling privilege escalation. The exploit, affecting Windows 10/11, forced Microsoft into emergency patching.
Iranian state actors coordinated password-spraying attacks on 300+ Israeli organizations with simultaneous missile strikes on the same cities, marking a new hybrid warfare approach using weak credentials and geographically-spoofed VPNs.
CISA ordered federal agencies to patch a critical Fortinet EMS vulnerability by Friday due to active exploitation in production environments. The centralized endpoint management platform is widely deployed across government and enterprise networks.
Microsoft identified Storm-1175, a China-based ransomware gang deploying Medusa ransomware via zero-day exploits. This reflects a troubling trend: cybercriminals are adopting nation-state-level attack capabilities.
Microsoft removed SaRA from Windows on March 10, 2026, shifting diagnostics to cloud-integrated solutions. Organizations must replace the tool's troubleshooting and maintenance functions immediately.