Main Menu

Application Security

Application Security
Google Patches 5th Chrome Zero-Day; V8 Flaw Chains for OS Access
June 10, 2026
Google patched CVE-2026-11645, a V8 out-of-bounds flaw being chained with a sandbox escape to achieve OS code execution. The fifth Chrome zero-day of 2026.
Application Security
LiteLLM CVE-2026-42271 Added to CISA KEV: AI API Keys at Risk
June 10, 2026
CISA added BerriAI LiteLLM CVE-2026-42271 to the KEV catalog. The command injection flaw enables OS access and theft of all configured AI provider API keys.
Application Security
SAP Patches CVSS 9.9 SAML Flaw and ABAP Memory Corruption
June 10, 2026
SAP's June 2026 Patch Day addressed 15 security notes including CVE-2026-44748, a CVSS 9.9 XML Signature Wrapping flaw in NetWeaver SAML authentication.
Application Security
Apache HTTP Server 2.4.68 Patches 13 CVEs Including HTTP/2 DoS
June 10, 2026
Apache HTTP Server 2.4.68 patches 13 vulnerabilities including CVE-2026-49975, the HTTP/2 bomb denial-of-service flaw affecting nginx, Envoy, and Cloudflare.
Application Security
Veeam CVE-2026-44963 Exposes Backup Servers to Low-Privilege RCE
June 10, 2026
Veeam patched CVE-2026-44963, a CVSS 9.4 RCE flaw letting any domain user execute code on backup servers across its 550,000-customer install base.
Application Security
Fortinet FortiSandbox CVE-2026-25089 Allows Unauthenticated RCE
June 10, 2026
Fortinet patched CVE-2026-25089, a CVSS 9.1 OS command injection in FortiSandbox's Web UI exploitable by unauthenticated attackers via crafted HTTP requests.
Application Security
OpenSSL Patches 16 Flaws Including Heap Use-After-Free RCE Risk
June 10, 2026
OpenSSL released 16 security fixes, led by CVE-2026-45447, a HIGH severity heap use-after-free in PKCS7_verify() that may enable RCE via crafted S/MIME messages.
Application Security
Shai-Hulud Hades Wave Poisons 29 Bioinformatics PyPI Packages
June 10, 2026
The Shai-Hulud Hades variant targeted ~29 bioinformatics and ML PyPI packages in a second wave, introducing a loader-payload split and bringing the campaign past 100 ...
Application Security
Microsoft Patches Exploited Exchange XSS as Secure Boot Deadline Looms
June 9, 2026
Microsoft's June Patch Tuesday closes the actively exploited Exchange Server CVE-2026-42897 and sets a 17-day countdown to a critical Secure Boot deadline.
Application Security
WhatsApp Files Contempt Motion Over New NSO Group Spyware Activity
June 9, 2026
WhatsApp detected new NSO Group activity violating a permanent court injunction and filed a federal contempt motion against the Israeli surveillance firm.
Load More
Trending
Open Server Exposes Three Concurrent Evilginx M365 Operations
SCMBANKER Targets Mexican Banking With AI-Written PowerShell
Helix Group Uses Vishing and Device Code Flow to Steal SharePoint Data
Forg365 PhaaS Combines AiTM and Device Code Flow to Target M365
Operation DragonReturn: DcRAT Targets India Tax Professionals
Unit 42 Exposes EtherRAT: Teams Calls Deliver Blockchain-Backed RAT
UNK_MassTraction Exploits Roundcube XSS to Hit US Physics Departments
Fake Job Interview Phishing Hits Marketing Pros Across 30 Brand Lures
90-Domain SEO Campaign Abuses ScreenConnect to Deploy AsyncRAT
Unit 42 Confirms 13,000 Malicious Phantom Squatting Sites

Daily Briefing Newsletter

Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.