Archive
All articles, newest first. Page 65.
Microsoft Patched a Critical SharePoint RCE but Omitted the CVE from Official Documentation
CVE-2026-45659, a CVSS 8.8 SharePoint Server RCE, was missing from Microsoft’s May 2026 security update list. While the patch was dist…
CERT-In Mandates 12-Hour Patching Window to Combat AI-Driven Exploits
India’s national cyber agency, CERT-In, has established a new 12-hour remediation standard for internet-facing and 'crown jewel' syste…
Poisoned AI Chatbots: A New Vector for High-Performance GPU Cryptojacking
Microsoft has identified an active campaign that manipulates AI chatbot recommendations to distribute GPU-based cryptojacking malware…
Critical Flowise RCE: Exploit Code Released for CVSS 9.9 Vulnerability
Obsidian Security has published proof-of-concept exploit code for CVE-2026-40933, a critical RCE vulnerability in Flowise. The flaw le…
CIFSwitch: Linux Kernel Bug Grants Root Access on CentOS and Rocky Linux
CIFSwitch enables local privilege escalation to root across multiple Linux distributions. While a public PoC is available and an upstr…
Cyber May: AI Attacks Emerge, but Basic Vectors Remain the Primary Threat
In ESET’s May roundup, Tony Anscombe documents critical infrastructure breaches in Poland, Mexico’s first 'AI-directed' attack, and Go…
AI-Directed Attacks and ICS Vulnerabilities: ESET’s Tony Anscombe on DynoWiper and the First AI Zero-Day
In his May 2026 security review, ESET’s Tony Anscombe analyzes a landscape of extremes: from the first AI-generated zero-day and 'AI-d…
CVE-2026-0257: Active Exploitation Confirmed for GlobalProtect Authentication Bypass
Palo Alto Networks has confirmed active exploitation of CVE-2026-0257 affecting PAN-OS GlobalProtect. CISA has added the vulnerability…
World Cup 2026: A Cyber-Physical Attack Surface Spanning Three Nations
Unit 42 maps the sprawling perimeter of the USA-Mexico-Canada World Cup, identifying critical OT/IT interdependencies across 16 host c…
California AG Sues 23andMe Over Alleged Ransom Negotiations and Deception in 6.9M Record Breach
Attorney General Rob Bonta alleges the company engaged in undisclosed ransom negotiations while publicly downplaying a 2023 credential…
ChatGPhish: ChatGPT Summaries Weaponized as Phishing Traps
The ChatGPhish vulnerability exploits ChatGPT's renderer to inject malicious links and QR codes during web page summarization. OpenAI…
Cyber Brief: Trump Mobile Breach, FIFA Phishing Surge, and CISA Supply Chain Alerts
Three major security incidents converge ahead of the 2026 World Cup: Trump Mobile confirms a third-party data breach, Group-IB uncover…
LLM Agent Conducts Autonomous Post-Exploitation via Marimo RCE
Sysdig documents the first case of an LLM agent completely replacing a human operator in post-exploitation following a critical RCE on…
Dutch Authorities Dismantle Massive 17-Million Device Botnet
Dutch police and the NCSC-NL have seized over 200 servers and neutralized a botnet comprising 17 million infected devices. While autho…
Chrome 148: Google Patches 151 Vulnerabilities, Including 22 Critical Flaws
Google has released Chrome 148, addressing 151 security vulnerabilities with 22 rated at maximum criticality. The update includes over…
Carnival Confirms Social Engineering Breach Impacting 6 Million People
Carnival Corporation has confirmed a data breach affecting 5.99 million individuals following a social engineering attack on an employ…
FortiClient EMS: EKZ Infostealer May Target VPN Management Channels
CVE-2026-35616 (CVSS 9.8): Compromised FortiClient EMS platforms could be transformed into malware delivery vehicles. Attacks in May 2…
Trojan Detection: 33 Behavioral Signals May Challenge Complex Machine Learning Models
A new framework utilizing 33 refined behavioral features aims to detect Windows Trojans with competitive performance on standard enter…
JINX-0164: Potential macOS Malware Campaigns Targeting Crypto Developers via LinkedIn
Threat actor JINX-0164 may be targeting cryptocurrency developers through LinkedIn social engineering, potentially utilizing the AUDIO…
BTMOB: The Malware-as-a-Service Erasing Technical Barriers to Android Takeover
ESET researchers have detailed BTMOB, an Android RAT sold as a service featuring a no-code builder. For a $5,000 lifetime fee, even lo…
TrendAI Vision One TOCTOU Flaw Could Grant SYSTEM Privileges via Real-Time Scan Service
TrendAI has patched a high-severity race condition (CVE-2026-45208) in its Apex One NT RealTime Scan service. The TOCTOU vulnerability…
Critical Ghost CMS Flaw Exploited: 700+ Sites Compromised by Competing Threat Actors
CVE-2026-26980, a CVSS 9.4 SQL injection vulnerability in Ghost CMS, has led to the compromise of over 700 websites, including platfor…
Qumulo NeuralProtect: AI-Driven Ransomware Defense at the Point of Write
Qumulo has announced NeuralProtect, an AI-powered security layer designed to potentially intercept ransomware at the storage level, fe…
Palo Alto Networks Sets Patch Record as Frontier AI Reshapes Vulnerability Discovery
Palo Alto Networks has released its May 2026 Patch Wednesday, disclosing 26 CVEs across more than 130 products. For the first time, th…