Collaborate Disseminate
Hidden text on a web page was enough to make Kiro, AWS’s agentic coding IDE, rewrite its own configuration file and run an attacker’s code on a developer’s machine, with no approval step able to stop it.
Intezer, in research with Kodem Security, found… Continue reading AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
Google’s DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber, a specialized artificial intelligence (AI) model built atop 3.5 Flash that’s designed to discover, validate, and patch vulnerabilities quickly and efficiently.
According to … Continue reading Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities
A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr.
The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of u… Continue reading Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments.
Arctic Wolf Labs said it investigated multiple intrusions… Continue reading Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component.
As many as nine security vulnerabilities have been patched in Zimbra 10… Continue reading Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities
An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent.
… Continue reading Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs
Every patch is a confession.
The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn that diff back into a working exploit, and you can hit every system tha… Continue reading N-day is Becoming N-Hour. Patching Faster Won’t Save You.
A cloud tenant using nothing but ordinary GPU access can push a data center’s power draw up and down fast enough to threaten the grid it runs on, with no exploit and no break-in.
That is the claim behind Bit2Watt, described by three Zhejiang Universit… Continue reading New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.
The two security flaws, tracked as CVE-2026-6303… Continue reading WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month.
The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware d… Continue reading New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack