Cyber Security
AI Security
AI Tool ARTEX Used in Breaches at WorkOS and Chainstack
WorkOS and Chainstack disclosed intrusions tied to the ARTEX AI framework, exposing sales contacts, customer accounts and password hashes at the two firms.
Cybersecurity
mSecure Tells Users to Reset Passwords Without Saying Why
mSecure's developer emailed customers to change passwords, reset 2FA and remove passkeys after suspicious activity, but has not explained what happened.
Application Security
CISA Adds WordPress Core Flaw CVE-2026-119977 to KEV Catalog
CISA lists WordPress race-condition RCE CVE-2026-119977 as actively exploited, and Wordfence reports 12,632 blocked attack attempts in the last 24 hours.
Application Security
Rails Patches 21 Flaws, Including CVSS 9.8 Active Storage Bug
Rails 8.0.5.2 and 8.1.4.1 fix 21 vulnerabilities, including a CVSS 9.8 Active Storage flaw that lets unauthenticated attackers write files via image upload.
Application Security
JPCERT/CC Warns Airbyte CVSS 9.9 Flaw Is Exploited in the Wild
JPCERT/CC warns that a CVSS 9.9 code-execution flaw in self-managed Airbyte before 2.2.0 is being exploited in the wild; Airbyte Cloud users need no action.
Application Security
Public Exploit Released for Puppet Server RCE CVE-2026-115731
A working exploit is public for CVE-2026-115731, a CVSS 9.4 remote code execution flaw in Puppet Server and OpenVox that can hand attackers the CA ...
CVE Vulnerability Alerts
SonicWall Says Retire GMS as Two Critical Flaws Stay Unpatched
SonicWall disclosed CVE-2026-109593 and CVE-2026-109594 in end-of-life GMS 9.5.2 and earlier, offers no patch, and tells administrators to migrate off it.
CVE Vulnerability Alerts
Binarly Finds Zyxel GS1900 Zero-Day That Bypasses Earlier Patch
Binarly found CVE-2026-107441, an exploited out-of-bounds write in Zyxel GS1900 switches that works on firmware already patched for CVE-2026-7273 in June.
CVE Vulnerability Alerts
Barracuda Flaws Chain Into Root Access on Email Security Gateway
Barracuda disclosed CVE-2026-116606 and CVE-2026-111560, two flaws that chain into root access on Email Security Gateway and other Barracuda appliances.
CVE Vulnerability Alerts
Chrome 157 Fixes 213 Security Flaws, Seven Rated Critical
Google's Chrome 157 stable release patches 213 security flaws, including seven critical memory bugs, with 12 found by Anthropic researchers assisted by Claude.
Cybersecurity
Russian Police Arrest Three Suspected VasyGrek Hackers
Russia's interior ministry arrested three suspected VasyGrek members and dismantled the group's infrastructure after years of financially motivated attacks.
Cybersecurity
Europol Raids Seize 100+ Servers in Investment Fraud Network
Europol-backed raids across 17 countries arrested seven people and seized more than 100 servers in a fraud network that targeted victims in over 50 countries.
Cybersecurity
German Officials Among Recipients of Apple Spyware Warnings
Apple sent mercenary-spyware warnings to German officials, lawmakers and journalists, and the BSI told recipients to assume their devices are infected.
AI Security
24,664 Lovable-Built Apps Leak Passports and Chat Messages
Crissy Field found 24,664 Lovable-built apps on Supabase returning database records with no authentication, exposing passports, payments and chat messages.
Cybersecurity
ILC Dover Pays $13M to Settle Cybersecurity Fraud Claims
ILC Dover and ILC Astrospace agreed to pay $13 million to settle False Claims Act allegations that they knowingly failed to meet contract cybersecurity rules.
Cybersecurity
Google Dismantles XCPE Botnet of 1.3 Million Android TV Boxes
Google and partners disrupted the XCPE botnet of 1.3 million Android TV boxes and banned maker Videostrong, which it says built the backdoor into firmware.
Cybersecurity
Refrigeration Attacks Hit Supermarkets in Six European Countries
A second wave of attacks on Danfoss refrigeration controls hit supermarkets in six European countries overnight, spoiling stock and raising set points to 55 C.
Application Security
Attackers Exploit CVSS 10.0 Node-RED Flaw CVE-2026-58115
VulnCheck caught attackers exploiting CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Node-RED, to drop Linux bots on exposed Siemens devices.
Application Security
BTCPay Server Hot Wallets Drained on Outdated Instances
Attackers drained Bitcoin and Litecoin hot wallets on BTCPay Server instances running version 2.4.1 or older, and the project urges updating to 2.4.7.
Cybersecurity
Trigger.dev Breach Exposes Customer Environment Variables
Trigger.dev disclosed that an attacker accessed environment variables belonging to a subset of its cloud customers, which can hold API keys and credentials.
TOP CYBERSECURITY HEADLINES
Application Security
Rails Patches 21 Flaws, Including CVSS 9.8 Active Storage Bug
Application Security
JPCERT/CC Warns Airbyte CVSS 9.9 Flaw Is Exploited in the Wild
Application Security
Public Exploit Released for Puppet Server RCE CVE-2026-115731
CVE Vulnerability Alerts
SonicWall Says Retire GMS as Two Critical Flaws Stay Unpatched
This Week’s Security Spotlight
CVE Vulnerability Alerts
Barracuda Flaws Chain Into Root Access on Email Security Gateway
CVE Vulnerability Alerts
Dell Fixes 44 PowerStore Flaws in DSA-2026-479, Seven Rated 9.8
Cybersecurity
Binance Loses About $6.3 Billion in Record Crypto Heist
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Rails Patches 21 Flaws, Including CVSS 9.8 Active Storage Bug
Rails 8.0.5.2 and 8.1.4.1 fix 21 vulnerabilities, including a CVSS 9.8 Active Storage flaw that lets unauthenticated attackers write files via image upload.
JPCERT/CC Warns Airbyte CVSS 9.9 Flaw Is Exploited in the Wild
JPCERT/CC warns that a CVSS 9.9 code-execution flaw in self-managed Airbyte before 2.2.0 is being exploited in the wild; Airbyte Cloud users need no action.
Public Exploit Released for Puppet Server RCE CVE-2026-115731
A working exploit is public for CVE-2026-115731, a CVSS 9.4 remote code execution flaw in Puppet Server and OpenVox that can hand attackers the CA ...
SonicWall Says Retire GMS as Two Critical Flaws Stay Unpatched
SonicWall disclosed CVE-2026-109593 and CVE-2026-109594 in end-of-life GMS 9.5.2 and earlier, offers no patch, and tells administrators to migrate off it.
Binarly Finds Zyxel GS1900 Zero-Day That Bypasses Earlier Patch
Binarly found CVE-2026-107441, an exploited out-of-bounds write in Zyxel GS1900 switches that works on firmware already patched for CVE-2026-7273 in June.
Barracuda Flaws Chain Into Root Access on Email Security Gateway
Barracuda disclosed CVE-2026-116606 and CVE-2026-111560, two flaws that chain into root access on Email Security Gateway and other Barracuda appliances.
Chrome 157 Fixes 213 Security Flaws, Seven Rated Critical
Google's Chrome 157 stable release patches 213 security flaws, including seven critical memory bugs, with 12 found by Anthropic researchers assisted by Claude.
Russian Police Arrest Three Suspected VasyGrek Hackers
Russia's interior ministry arrested three suspected VasyGrek members and dismantled the group's infrastructure after years of financially motivated attacks.
Europol Raids Seize 100+ Servers in Investment Fraud Network
Europol-backed raids across 17 countries arrested seven people and seized more than 100 servers in a fraud network that targeted victims in over 50 countries.
German Officials Among Recipients of Apple Spyware Warnings
Apple sent mercenary-spyware warnings to German officials, lawmakers and journalists, and the BSI told recipients to assume their devices are infected.
24,664 Lovable-Built Apps Leak Passports and Chat Messages
Crissy Field found 24,664 Lovable-built apps on Supabase returning database records with no authentication, exposing passports, payments and chat messages.
ILC Dover Pays $13M to Settle Cybersecurity Fraud Claims
ILC Dover and ILC Astrospace agreed to pay $13 million to settle False Claims Act allegations that they knowingly failed to meet contract cybersecurity rules.
Google Dismantles XCPE Botnet of 1.3 Million Android TV Boxes
Google and partners disrupted the XCPE botnet of 1.3 million Android TV boxes and banned maker Videostrong, which it says built the backdoor into firmware.
Refrigeration Attacks Hit Supermarkets in Six European Countries
A second wave of attacks on Danfoss refrigeration controls hit supermarkets in six European countries overnight, spoiling stock and raising set points to 55 C.
Attackers Exploit CVSS 10.0 Node-RED Flaw CVE-2026-58115
VulnCheck caught attackers exploiting CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Node-RED, to drop Linux bots on exposed Siemens devices.
BTCPay Server Hot Wallets Drained on Outdated Instances
Attackers drained Bitcoin and Litecoin hot wallets on BTCPay Server instances running version 2.4.1 or older, and the project urges updating to 2.4.7.
Trigger.dev Breach Exposes Customer Environment Variables
Trigger.dev disclosed that an attacker accessed environment variables belonging to a subset of its cloud customers, which can hold API keys and credentials.
cPGuard Update Channel Hijacked to Push Linux Server Backdoor
An attacker used stolen credentials to push a malicious script through OPSSHIELD's cPGuard update channel, installing a backdoor and stealing root SSH keys.
Russian and Ukrainian Emergency Alert Apps Hacked, Fake Warnings Sent
Ukraine's Air Alert app and Russia's Emergency Ministry app were hacked to send fake nuclear, chemical and missile warnings, though national alert systems held.
Unpatched CVSS 10.0 CryptoPayment Gateway Plugin Flaw Under Attack
Attackers are targeting CVE-2026-81648, an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that exposes wallet credentials in cleartext.