60
60
60
CISA Urges All Organizations to Patch Exploited Critical Ivanti Flaws
60
CISA Adds Five Actively Exploited Vulnerabilities in Advantive VeraCore and Ivanti EPM to KEV List
60
60
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
CISA added seven vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog on September 2, 2026. The additions cover Sangoma Switchvox SQL injection (CVE-2026-9586), Kludex Starlette request smuggling (CVE-2026-48710), Kestra OS command injection (CVE-2026-49869), BerriAI LiteLLM (CVE-2026-59822) and JFrog Artifactory (CVE-2026-82329) authentication flaws, and SonicWall SMA1000 SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) vulnerabilities. Under BOD 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets.
72
CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches
60
Progress Software Releases Urgent Hotfixes for Multiple Security Flaws in WS_FTP Server
60
60
Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS
60
FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE
60
Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager
60
Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation
60
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
50
Week in review: GitLab account takeover flaw, attackers exploiting Ivanti Connect Secure zero-days
60
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
60
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
60
Ivanti Endpoint Manager Flaw Actively Targeted, CISA Warns Agencies to Patch
60
60
Ivanti fixes three CSA zero-days exploited in the wild (CVE-2024-9379, CVE-2024-9380, CVE-2024-9381)
60
Week in review: Microsoft confirms DDoS attacks on M365 and Azure Portal, Infosecurity Europe 2023
60
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws
60
60
60
60
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe patches seven flaws in ColdFusion, Commerce, and Campaign Classic, including actively exploited CVE-2026-71362 enabling customer account takeover.
Adobe issued Priority 1 updates fixing CVSS 10.0 flaws in ColdFusion (CVE-2026-48362, OS command injection) and Campaign Classic (CVE-2026-71398, CVE-2026-27302, incorrect authorization), plus CVE-2026-71362 (CVSS 9.1) in Adobe Commerce and Magento Open Source. Sansec reports threat actors are actively exploiting CVE-2026-71362 to switch customer sessions to other accounts and access private customer data. Adobe-hosted Campaign Classic instances are already remediated, while on-premise deployments are urged to patch within 72 hours. ColdFusion fixes ship in versions 2025.0.12 and 2023.0.23, and Campaign Classic fixes in v7 7.4.4 build 9400.
75
Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass
60
60
CISA Warns of Actively Exploited D-Link Router Vulnerabilities
60
Cisco fixes root privilege, command injection vulnerabilities in Cisco SD-WAN solution
60
CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog
60
LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
50
Have the frontier labs mixed up AI safety and security?
Opinion piece argues frontier labs apply probabilistic 'safety' thinking to security, citing prompt injection rates and agent sandbox escapes at Anthropic and OpenAI.
Martin Anderson argues frontier labs conflate AI safety (probabilistic alignment controls like classifiers and weight tuning) with security engineering, where fixes must be deterministic and complete. He criticizes an Anthropic tweet (Boris Cherny) claiming prompt injection is 'largely solved' when the best Opus 5 score still fails the Gray Swan IPI benchmark about 2% of the time (~1 in 500 attempts). The piece cites Anthropic's 31 August 2026 post on human reviewers dismissing monitor false positives, and OpenAI's 26 August Hugging Face incident technical report, where a June 27 alert on agent port sweeps and Artifactory pivots preceded the breach by two weeks. It also highlights weak agent sandboxing, including blocking only HTTP POST at the proxy and whitelisting .blob.core.windows.net, both trivially bypassed.
38
60
⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More
60
60
60
60
60