Collaborate Disseminate
On Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and four allied cyber authorities published a guide telling software vendors how to build a coordinated vulnerability disclosure (CVD) program. Six days earlier, CISA publis… Continue reading CISA folds its own hard-won lessons into coordinated vulnerability disclosure guidance
Romania’s National Agency for Cadastre and Land Registration (ANCPI) suffered a major disruption on Tuesday, July 14, when its e-Terra cadastre and land registry app became unavailable to users. What was first declared to be a “major techni… Continue reading Romania’s land registry hit by cyber attack, data allegedly for sale
A financially motivated threat actor is impersonating hundreds of brands on GitHub and pushing a smash-and-grab infostealer masquerading as legitimate downloads of popular software, Arctic Wolf threat researchers have warned. “The 292 impersonate… Continue reading Threat actor impersonated hundreds of brands on GitHub to push infostealer malware
Microsoft has released patches for 570+ vulnerabilities on July 2026 Patch Tuesday, including two that are being leveraged by attackers (CVE-2026-56155 and CVE-2026-56164), and one that was previouly disclosed (CVE-2026-50661). The release was once aga… Continue reading AI-driven bug hunting fuels record Microsoft Patch Tuesday
SonicWall has fixed two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) affecting its Secure Mobile Access (SMA) 1000 Series appliances, and is urging customer organizations to upgrade to a fixed firmare version and search for evide… Continue reading SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)
A new approach tried out by Tracebit researchers has proven very effective at stopping AI agents from fully compromising targeted environments. What makes it notable isn’t the technique – prompt injection is old news – but the directi… Continue reading “Context bombs” can frustrate AI-driven attacks, researchers found
A “credible external security threat” targeting Progress Software’s ShareFile Storage Zone Controllers (SZC) – the on-premises, customer-managed server components where organizations store files shared via this popular enterpris… Continue reading Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers
The Pink cyber extortion crew is tricking employees into giving them access to their Microsoft 365 accounts by faking Entra passkey enrollment requests. The attack The attack starts with a vishing call to an employee. The caller poses as IT and says it… Continue reading Extortion crew hijacks Microsoft 365 accounts via fake passkey setup
Microsoft has finally released a security update for its Microsoft Malware Protection Engine, which fixes CVE-2026-50656, the Windows Defender local privilege escalation vulnerability triggered by the RoguePlanet exploit. The vulnerability and the fix … Continue reading Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)
The US Cybersecurity and Infrastructure Security Agency (CISA) is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild. The flaw was added to the agency’s Known Exploited Vulnerabilities catalog on … Continue reading Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)