Collaborate Disseminate
GitHub has announced what it said are “breaking changes” coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats.
The changes aim to combat attack techniques that abuse the “npm install” comm… Continue reading GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
GitHub has announced what it said are “breaking changes” coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats.
The changes aim to combat attack techniques that abuse the “npm install” comm… Continue reading GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
Cybersecurity researchers have warned of a “resurgence and expansion” of JDY, a covert network associated with China-nexus state-sponsored threat actors.
“The JDY botnet comprises over 1,500 SOHO [small office and home office] and IoT devices and oper… Continue reading China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance
Fortinet, Ivanti, and SAP have released security updates to address multiple critical security vulnerabilities that could result in arbitrary code execution and information disclosure.
The security flaw patched by Fortinet relates to a command injecti… Continue reading Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities
A high-severity unpatched security flaw in Langflow, an open-source low-code platform to build artificial intelligence (AI) applications, has come under active exploitation in the wild, according to findings from VulnCheck.
The vulnerability in questi… Continue reading Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.
The list of vulnerabilities is as follows –
… Continue reading CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
Your pentest report looks clean. That might be the problem.
Run automated pentesting long enough, and the new findings start to dry up. By the third or fourth run, fewer issues appear. The report looks stable. Leadership reads “stable” as “secure.” It… Continue reading Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar
Microsoft on Tuesday released fixes for a record 206 security vulnerabilities impacting its software portfolio, including three flaws that have been publicly disclosed at the time of release.
Of the 206 flaws, 39 are rated Critical, and 167 are rated … Continue reading Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs
On June 9, Anthropic released Claude Fable 5, the most capable model it has ever made, generally available. It also did something unusual: it shipped one model as two products, split not by capability but by a layer of safety classifiers.
Fable 5 goes… Continue reading Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards
ServiceNow has warned about a security incident in which unknown threat actors exploited a flaw to obtain deeper unauthorized access to susceptible instances.
“On June 5, 2026, ServiceNow applied a security update to hosted customer instances,” the co… Continue reading ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances