Cyber Security
CVE Vulnerability Alerts
CISA Adds Apple CVE-2024-27834 to KEV After APT29 Phone Attacks
CISA added Apple's CVE-2024-27834 to its KEV catalog after Sekoia tied watering-hole attacks on iPhones and Android phones to Russia's APT29 hacking group.
Application Security
Debian, Ubuntu Patch Critical APT Flaw CVE-2026-109518
Debian and Ubuntu patched CVE-2026-109518, a critical APT flaw that lets a network attacker swap a verified package for malicious code that installs as root.
Cybersecurity
Credit Mutuel Arkea Confirms Attack Tied to $133M Bank Theft
Credit Mutuel Arkea confirmed a sophisticated supplier-linked attack after ZachXBT reported more than $133 million stolen, saying customer accounts are safe.
CVE Vulnerability Alerts
Xen Flaws CVE-2026-102703, CVE-2026-102704 Break VM Isolation
Xen advisory XSA-523 covers two grant copy flaws that let a malicious guest read and write any other VM's memory, including dom0, with no known ...
CVE Vulnerability Alerts
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
Attackers are exploiting GPUStack CVE-2026-102895, a CVSS 9.8 authentication bypass that grants admin access and lets them run reverse shells on AI servers.
Application Security
Ten Control Web Panel Flaws Chain Into Root RCE; PoC Public
VulnCheck disclosed ten Control Web Panel flaws that chain into unauthenticated root code execution, with a public exploit module and fixes in version 1.29.
CVE Vulnerability Alerts
Cisco Patches UCS Central Flaw CVE-2026-76506 and ISE Bugs
Cisco patched UCS Central flaw CVE-2026-76506, an ISE certificate authorization bypass and a Unified CM XSS bug. No workarounds exist and no attacks are known.
CVE Vulnerability Alerts
Citrix Fixes CVSS 9.8 XenServer Flaw and Brotli Bug in Scout
Citrix patched a CVSS 9.8 XenServer race condition, CVE-2026-98432, plus pre-boot and Brotli decoder flaws. The company reports no attacks against customers.
Cybersecurity
NIKKE PC Launcher Scripts Tampered to Spread K2F Malware
Attackers tampered with Goddess of Victory: NIKKE PC launcher scripts on an official CDN to install the K2F remote-access agent and a wallet-stealing DLL.
Cybersecurity
Kyiv Independent Hit by Cyberattack Sending Fake Nuclear Emails
Hackers breached The Kyiv Independent's website and newsletter service, emailing subscribers false claims of a nuclear strike, in a suspected Russian attack.
Cybersecurity
IT Worker Pleads Guilty to Sending Top Secret Files to Ethiopia
Abraham Teklu Lemma, a US government IT worker, pleaded guilty to espionage for sending Top Secret intelligence reports to Ethiopian officials, DOJ said.
Cybersecurity
Canadian Extradited Over Cryptomining Hacks on US Supercomputers
DOJ says Canadian Ryan James Roach was extradited to face charges of hacking US university supercomputers to mine crypto; a co-defendant awaits extradition.
Application Security
Apache Discloses 35 Flaws Across Nine Projects, ZooKeeper Hit
Apache disclosed 35 vulnerabilities across nine projects, 20 rated high, including ZooKeeper, OpenOffice and ActiveMQ. No exploitation has been confirmed.
CVE Vulnerability Alerts
ASUS Patches AiCloud Root Flaw CVE-2026-84730 in Four Alerts
ASUS issued four security advisories, including AiCloud router flaw CVE-2026-84730 that gives an adjacent attacker root shell access, plus two driver bugs.
AI Security
OpenAI AI Pipeline Built 948 Linux Kernel Root Exploits
OpenAI says an agentic pipeline reproduced 1,724 Linux kernel flaws and built 948 working root exploits at about $1,279 each, in a run lasting 30 ...
AI Security
AI Tool ARTEX Used in Breaches at WorkOS and Chainstack
WorkOS and Chainstack disclosed intrusions tied to the ARTEX AI framework, exposing sales contacts, customer accounts and password hashes at the two firms.
Cybersecurity
mSecure Tells Users to Reset Passwords Without Saying Why
mSecure's developer emailed customers to change passwords, reset 2FA and remove passkeys after suspicious activity, but has not explained what happened.
Application Security
CISA Adds WordPress Core Flaw CVE-2026-119977 to KEV Catalog
CISA lists WordPress race-condition RCE CVE-2026-119977 as actively exploited, and Wordfence reports 12,632 blocked attack attempts in the last 24 hours.
Application Security
Rails Patches 21 Flaws, Including CVSS 9.8 Active Storage Bug
Rails 8.0.5.2 and 8.1.4.1 fix 21 vulnerabilities, including a CVSS 9.8 Active Storage flaw that lets unauthenticated attackers write files via image upload.
Application Security
JPCERT/CC Warns Airbyte CVSS 9.9 Flaw Is Exploited in the Wild
JPCERT/CC warns that a CVSS 9.9 code-execution flaw in self-managed Airbyte before 2.2.0 is being exploited in the wild; Airbyte Cloud users need no action.
CVE Vulnerability Alerts
CISA Adds Apple CVE-2024-27834 to KEV After APT29 Phone Attacks
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Xen Flaws CVE-2026-102703, CVE-2026-102704 Break VM Isolation
CVE Vulnerability Alerts
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
Application Security
Ten Control Web Panel Flaws Chain Into Root RCE; PoC Public
CVE Vulnerability Alerts
Cisco Patches UCS Central Flaw CVE-2026-76506 and ISE Bugs
This Week’s Security Spotlight
CVE Vulnerability Alerts
Citrix Fixes CVSS 9.8 XenServer Flaw and Brotli Bug in Scout
CVE Vulnerability Alerts
ASUS Patches AiCloud Root Flaw CVE-2026-84730 in Four Alerts
CVE Vulnerability Alerts
Barracuda Flaws Chain Into Root Access on Email Security Gateway
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Xen Flaws CVE-2026-102703, CVE-2026-102704 Break VM Isolation
Xen advisory XSA-523 covers two grant copy flaws that let a malicious guest read and write any other VM's memory, including dom0, with no known ...
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
Attackers are exploiting GPUStack CVE-2026-102895, a CVSS 9.8 authentication bypass that grants admin access and lets them run reverse shells on AI servers.
Ten Control Web Panel Flaws Chain Into Root RCE; PoC Public
VulnCheck disclosed ten Control Web Panel flaws that chain into unauthenticated root code execution, with a public exploit module and fixes in version 1.29.
Cisco Patches UCS Central Flaw CVE-2026-76506 and ISE Bugs
Cisco patched UCS Central flaw CVE-2026-76506, an ISE certificate authorization bypass and a Unified CM XSS bug. No workarounds exist and no attacks are known.
Citrix Fixes CVSS 9.8 XenServer Flaw and Brotli Bug in Scout
Citrix patched a CVSS 9.8 XenServer race condition, CVE-2026-98432, plus pre-boot and Brotli decoder flaws. The company reports no attacks against customers.
NIKKE PC Launcher Scripts Tampered to Spread K2F Malware
Attackers tampered with Goddess of Victory: NIKKE PC launcher scripts on an official CDN to install the K2F remote-access agent and a wallet-stealing DLL.
Kyiv Independent Hit by Cyberattack Sending Fake Nuclear Emails
Hackers breached The Kyiv Independent's website and newsletter service, emailing subscribers false claims of a nuclear strike, in a suspected Russian attack.
IT Worker Pleads Guilty to Sending Top Secret Files to Ethiopia
Abraham Teklu Lemma, a US government IT worker, pleaded guilty to espionage for sending Top Secret intelligence reports to Ethiopian officials, DOJ said.
Canadian Extradited Over Cryptomining Hacks on US Supercomputers
DOJ says Canadian Ryan James Roach was extradited to face charges of hacking US university supercomputers to mine crypto; a co-defendant awaits extradition.
Apache Discloses 35 Flaws Across Nine Projects, ZooKeeper Hit
Apache disclosed 35 vulnerabilities across nine projects, 20 rated high, including ZooKeeper, OpenOffice and ActiveMQ. No exploitation has been confirmed.
ASUS Patches AiCloud Root Flaw CVE-2026-84730 in Four Alerts
ASUS issued four security advisories, including AiCloud router flaw CVE-2026-84730 that gives an adjacent attacker root shell access, plus two driver bugs.
OpenAI AI Pipeline Built 948 Linux Kernel Root Exploits
OpenAI says an agentic pipeline reproduced 1,724 Linux kernel flaws and built 948 working root exploits at about $1,279 each, in a run lasting 30 ...
AI Tool ARTEX Used in Breaches at WorkOS and Chainstack
WorkOS and Chainstack disclosed intrusions tied to the ARTEX AI framework, exposing sales contacts, customer accounts and password hashes at the two firms.
mSecure Tells Users to Reset Passwords Without Saying Why
mSecure's developer emailed customers to change passwords, reset 2FA and remove passkeys after suspicious activity, but has not explained what happened.
CISA Adds WordPress Core Flaw CVE-2026-119977 to KEV Catalog
CISA lists WordPress race-condition RCE CVE-2026-119977 as actively exploited, and Wordfence reports 12,632 blocked attack attempts in the last 24 hours.
Rails Patches 21 Flaws, Including CVSS 9.8 Active Storage Bug
Rails 8.0.5.2 and 8.1.4.1 fix 21 vulnerabilities, including a CVSS 9.8 Active Storage flaw that lets unauthenticated attackers write files via image upload.
JPCERT/CC Warns Airbyte CVSS 9.9 Flaw Is Exploited in the Wild
JPCERT/CC warns that a CVSS 9.9 code-execution flaw in self-managed Airbyte before 2.2.0 is being exploited in the wild; Airbyte Cloud users need no action.
Public Exploit Released for Puppet Server RCE CVE-2026-115731
A working exploit is public for CVE-2026-115731, a CVSS 9.4 remote code execution flaw in Puppet Server and OpenVox that can hand attackers the CA ...
SonicWall Says Retire GMS as Two Critical Flaws Stay Unpatched
SonicWall disclosed CVE-2026-109593 and CVE-2026-109594 in end-of-life GMS 9.5.2 and earlier, offers no patch, and tells administrators to migrate off it.
Binarly Finds Zyxel GS1900 Zero-Day That Bypasses Earlier Patch
Binarly found CVE-2026-107441, an exploited out-of-bounds write in Zyxel GS1900 switches that works on firmware already patched for CVE-2026-7273 in June.