Collaborate Disseminate
Attackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) in N-able N-central, a remote monitoring and management (RMM) solution widely used by managed service providers, to gain access to managed endpoints. How the flaw was disc… Continue reading Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577)
A critical security vulnerability (CVE-2026-66066) in Ruby on Rails (aka Rails), one of the most widely used frameworks for building websites and web apps, may allow attackers to read sensitive files off a server and, in some cases, take full control o… Continue reading KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)
Russia-affiliated cyber espionage group Laundry Bear (aka Void Blizzard, aka TA488) is exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange, to target US and European government entities and a variety of private sector … Continue reading Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897)
A static credentials vulnerability (CVE-2026-20316) in Cisco Secure Firewall Management Center (FMC), a platform for centrally managing multiple Cisco Secure Firewall devices across a network, is being leveraged by attackers, CISA warned. Two FMC flaws… Continue reading Cisco FMC static credentials exploited by attackers (CVE-2026-20316)
The first publicly documented cyberattack run end-to-end by an autonomous AI was an OpenAI benchmark test that escaped its sandbox and breached Hugging Face. In an incident post-mortem compiled with the input from Hugging Face and several hundred membe… Continue reading Hugging Face breach reignites open-weights debate, raises liability questions
JetBrains has fixed a critical vulnerability (CVE-2026-63077) affecting TeamCity On-Premises and is urging admins to upgrade self-hosted servers as soon as possible. “For those who are unable to do so, we have released a security patch plugin,… Continue reading JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077)
Security researchers who discovered and reported CVE-2026-54121 (aka “Certighost”), a critical privilege elevation vulnerability in Active Directory Certificate Services (AD CS), have released a proof-of-concept (PoC) exploit for and techni… Continue reading PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121)
A threat actor abused Anthropic’s Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed. Employees at at least 29 organizations were compromised over two days in July, after searching for the Claude desktop … Continue reading How attackers hosted a fake Claude download page on the claude.ai domain
Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., … Continue reading Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)
The recent Hugging Face breach was the work of several OpenAI models, the AI research company claimed in a blog post. The breach Late last week, the company behind Hugging Face, a platform that enables users to share machine learning models and dataset… Continue reading OpenAI: Our models breached Hugging Face during a cyber capability test