ShapedPlugin’s plugin update system was compromised by attackers who pushed malicious code to paying WordPress customers through the company’s verified
Check Point Research exposed a crypto clipper campaign using AI-generated fake reviews on GitHub, YouTube, and VirusTotal comment sections to
CVE-2026-20230, a CVSS 8.6 SSRF flaw in Cisco Unified CM’s WebDialer, is under active exploitation after a PoC dropped June
Anthropic’s Mythos AI found real vulnerabilities in classified US government systems during Project Glasswing testing, prompting federal access restrictions.
Four critical Dify vulnerabilities named DifyTap allow cross-tenant access to private AI chats, uploaded files, and internal APIs. Patched in
Security firm AIR planted a fake AI agent skill that bypassed all scanners and reached 26,000 agents, exposing a supply
JFrog disclosed CVE-2026-8461, a critical heap overflow in FFmpeg’s video decoder enabling remote code execution when processing malicious video files.
Microsoft disclosed AutoJack, a three-part vulnerability chain in AutoGen Studio that lets attackers hijack AI agents and execute arbitrary system
Researchers investigated the TeamPCP threat group that exploited open-source speed culture for years of supply chain access across thousands of
Klue’s OAuth breach enabled the Icarus threat group to extract Salesforce CRM data from cybersecurity companies including Huntress and Recorded
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.