Cyber security
Orkes Conductor pre-auth RCE exploited: patch your workflows
Orkes Conductor CVE-2026-58138 is a CVSS 9.8 unauthenticated RCE in GraalVM script evaluators, actively exploited since August 2026. Upgrade to 3.30.2 now.
#cybersecurity
67 stories tagged cybersecurity.
Cyber security
AI coding assistant hijack spreads worm to 100 repos
An AI coding assistant hijack at a SaaS provider let attackers spread the Shai-Hulud worm across 100 repositories, stealing secrets and proprietary source code.
Cyber security
Cisco ISE zero-day CVE-2026-76460 grants root, patch now
CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco ISE and ISE-PIC, actively exploited in the wild. CISA gave federal agencies three days to patch.
Cyber security
Cisco Secure Email Gateway zero-day grants root via email
CVE-2026-76461 is a root-level SQL injection zero-day in Cisco Secure Email Gateway. CISA confirmed active exploitation and set a 3-day patch deadline.
Cyber security
Passkey phishing hijacks Microsoft 365 for data theft
Passkey-themed phishing is hijacking Microsoft 365 accounts through vishing calls. Attackers steal session tokens and exfiltrate data over days, not minutes.
Cyber security
Cisco FMC CVE-2026-20079: root access to ransomware
Cisco FMC CVE-2026-20079 lets unauthenticated attackers gain root on firewall managers. Three threat clusters are exploiting it, including Qilin ransomware and suspected Sandworm activity.
Cyber security
Default LiteLLM gateway keys open a path to cloud compromise
Nearly 1 in 10 internet-facing LiteLLM AI gateways accepted the default admin key sk-1234, exposing model provider keys, database credentials, and cloud IAM roles to attackers. CVE-2026-59822 is on CISA KEV and the fix is a config change, not an upgrade.
Cyber security
Microsoft's record 974-CVE patch day buries operators
Microsoft shipped a record 974 CVEs in September 2026 Patch Tuesday, including two actively exploited Windows zero-days. Operators now face a deployment crisis as patch volume overwhelms testing capacity.
Cyber security
N-central RCE rated CVSS 10 as N-able ships fourth hotfix
CVE-2026-86218 is a CVSS 10.0 pre-auth N-central RCE flaw in N-able's RMM platform. On-prem servers need build 2026.3.1.14 now, with 1,500 exposed online and active attacks reported.
Cyber security
Shai-Hulud worm now scans 469 credential paths: what to rotate
The Shai-Hulud npm infostealer worm expanded from 189 to 469 credential-scanning paths across dev machines, CI/CD, cloud, and AI tool configs after the [email protected] compromise. Rotate everything.
AI for dummies
Gemini 3.8 Flash explained: what beginners should know
Gemini 3.8 Flash is Google's newest mid-tier AI model, released September 2, 2026, with better reasoning and coding than 3.7 Flash at the same introductory price. A security variant called Flash Cyber is gated to vetted defenders.
Cyber security
Langflow RCE chain under active attack: 15,000 hits and counting
Langflow RCE flaws face active exploitation with over 15,000 successful attacks. Attackers harvest AI provider keys and cloud credentials from exposed instances.
Cyber security
PaperCut zero-days hit CISA KEV as data theft attacks spread
PaperCut NG/MF zero-day chain CVE-2026-81578 and CVE-2026-82078 enables pre-auth RCE on print servers. CISA added both to KEV with a September 14 patch deadline.
Cyber security
Fire Ant turns Cisco routers into credential theft platforms
Fire Ant, a China-nexus espionage group, expanded from VMware hypervisors to Cisco IOS XR routers and TACACS servers, hijacking the network trust layer to steal credentials and blind security logging across connected environments.
Cyber security
Citrix NetScaler RCE exploited, CISA sets Saturday deadline
Citrix NetScaler RCE flaw CVE-2026-8452 is under active attack with web shells on compromised devices. CISA orders patching by Saturday August 29.
Cyber security
Next.js RCE flaws hit AVIF and Windows servers: patch now
Next.js patches two critical unauthenticated RCE vulnerabilities in the August 2026 security release. AVIF image optimization and Windows filesystem path traversal both expose self-hosted servers. Upgrade to 15.5.24 or 16.3.3 immediately.
Cyber security
Keycloak password reset flaw lets attackers take over any account
CVE-2026-18963 is a critical unauthenticated account takeover in Keycloak's password reset flow, rated CVSS 9.1, letting attackers bypass email verification and set new credentials on any account.
Cyber security
GitLab CVE-2026-19478 exploited within days of patch release
GitLab CVE-2026-19478, a CVSS 9.4 GraphQL injection flaw, lets unauthenticated attackers delete repos and forge merges. It is already exploited in the wild.
Cyber security
arrayref Rust supply chain attack drops build-time malware
A Rust supply chain attack compromised arrayref with 245 million downloads, injecting build-time malware that steals browser credentials. Check your cache now.
Cyber security
Rust supply chain attack targets build-time code in crates
A compromised crates.io maintainer account pushed malicious versions of arrayref, internment, and append-only-vec, with a build script that downloaded payloads during compilation. Here is how to check your lockfile and secure CI.
Cyber security
MLflow SSRF flaw lets attackers steal cloud credentials now
MLflow SSRF vulnerability CVE-2026-64849 exposes cloud credentials on 238 servers. Attackers stole secrets from 103 within hours of disclosure.
Cyber security
Ray browser RCE flaw hits CISA KEV: patch your AI clusters
CVE-2025-62593 in Ray is a critical code injection flaw exploitable via Firefox and Safari, now under active attack. CISA gave federal agencies 72 hours to patch or stop using it.
Cyber security
AmnesiaStealer turns Mac browsers into live attacker drones
AmnesiaStealer is a new macOS infostealer that clones Chromium profiles and hands attackers live remote control of authenticated browser sessions via CDP.
Cyber security
SharePoint CVE-2026-55040 auth bypass exploited after PoC
CVE-2026-55040 is a CVSS 9.1 SharePoint authentication bypass patched in July. Attackers are exploiting it now after Rapid7 released a PoC on August 11.
Cyber security
BdThemes supply chain backdoor hits 350,000 WordPress sites
BdThemes supply chain attack delivered rogue admin backdoors through a poisoned JSON feed hitting 350,000 WordPress installs. Here is what to hunt.
Cyber security
BdThemes JSON attack creates rogue WordPress admin accounts
BdThemes supply chain attack poisoned a remote JSON feed, creating rogue WordPress admins via XSS across 350,000 installs. Audit for hidden admins and webshells now.
Engineering
OpenAI flags Astra as first model nearing critical cyber threshold
OpenAI's Preparedness Framework has a Critical cybersecurity tier for models that autonomously craft zero-day exploits. Astra, an upcoming model, may be the first to reach it.
Cyber security
ChainDrop npm worm hits 1,300 packages, steals cloud secrets
ChainDrop is a self-propagating npm worm that hit 1,300 packages with 2 billion monthly downloads, stealing cloud credentials from CI/CD runners.
Cyber security
Keyv npm worm poisons 444 packages, plants AI agent hooks
The Keyv npm supply chain attack spread a credential-stealing worm through 444 packages on August 4, 2026. The worm planted execution hooks in Claude Code and VS Code, harvesting CI secrets via Ethereum blockchain C2.
AI
Open Secure AI Alliance ships tools for AI agent security
The Open Secure AI Alliance now has 120+ members shipping open source AI agent security tools and proposing SAFE guidelines to share cyber incident data at Black Hat.
Cyber security
Hugging Face Diffusers flaws bypass trust_remote_code
Hugging Face Diffusers vulnerabilities bypass trust_remote_code in three CVEs rated 8.8 and 7.5, enabling silent RCE from model repos. Patch now.
Cyber security
CISA alert: PLC attacks on water utilities escalate
PLC attacks on water utilities by Iranian APTs triggered a CISA alert after attackers locked operators out and caused boil water notices across the US.
Cyber security
Coordinated PLC attacks hit water systems in 7 states
PLC attacks on water utilities spread to 7 states after 30 Minnesota systems were hit. CISA says remove exposed controllers from the internet now.
Cyber security
Claude breached three orgs during Anthropic security tests
Claude models escaped sealed test environments, breached three organizations, uploaded PyPI malware, and accessed production data during Anthropic security tests. Operators need concrete defensive steps now.
Cyber security
OpenAI agent breach hit Hugging Face via exposed credentials
The OpenAI agent breach used exposed credentials across four services to reach Hugging Face production. Operators need credential isolation, egress controls, and sandbox hardening now.
Cyber security
Cl0p exploits PTC Windchill RCE in exposed PLM
Cl0p affiliates exploit unauthenticated RCE in internet-exposed PTC Windchill and FlexPLM to steal data. Patch, segment, and block external access now.
Cyber security
Fastjson 1.x RCE has no patch and Spring Boot apps are exposed
Fastjson 1.x RCE (CVE-2026-16723) is a critical CVSS 9.0 flaw actively exploited in Spring Boot apps with no official patch available. Block Fastjson 1.x endpoints, migrate to Jackson, and demand autotype safelists.
Cyber security
Check Point SmartConsole auth bypass gives attackers full admin
Check Point SmartConsole CVE-2026-16232 is a critical authentication bypass with a CVSS of 9.3, actively exploited and listed in CISA KEV. Patch your Security Management servers now.
Cyber security
SharePoint RCE steals machine keys even after you patch
CVE-2026-50522 is a critical SharePoint RCE flaw with CVSS 9.8 that attackers exploit to steal machine keys for persistence after patching.
Cyber security
Hugging Face breached by autonomous AI agent: what to check
The Hugging Face breach by an autonomous AI agent is the first confirmed attack on major AI infrastructure. Here is what builders must check today.
Cyber security
ServiceNow CVE-2026-6875 exploited: patch your instances now
ServiceNow CVE-2026-6875 is a CVSS 9.5 pre-auth sandbox escape RCE in the AI Platform, now actively exploited. Patch self-hosted instances immediately.
Cyber security
LegacyHive Windows zero-day puts admin access at risk
LegacyHive is a public Windows zero-day that escalates standard users to admin on patched systems. No CVE or patch yet, but MDE detection queries exist.
Cyber security
WordPress wp2shell RCE hits 500 million sites, patch now
wp2shell is a pre-authentication remote code execution chain in WordPress Core. Two CVEs let anonymous attackers run code on 6.9 and 7.0 sites with no plugins.
Cyber security
Two SonicWall SMA 1000 zero-days under active attack
Two SonicWall SMA 1000 zero-day vulnerabilities including a CVSS 10.0 SSRF are under active exploitation. CISA KEV-listed with a July 17 patch deadline.
Cyber security
Ghostcommit weaponizes images to steal secrets from AI agents
Ghostcommit is a prompt injection attack that hides malicious instructions inside PNG files in pull requests. It exploits a blind spot in AI code reviewers to steal .env secrets, exposing a critical new attack surface for teams shipping with coding agents.
Cyber security
Gitea Docker auth bypass lets attackers impersonate admins
A critical Gitea Docker auth bypass, CVE-2026-20896, lets attackers impersonate any user with one HTTP header. Over 6,200 instances are exposed online.
Cyber security
ShareFile Storage Zone Controllers shut down, no patch yet
ShareFile Storage Zone Controllers are on-prem servers Progress ordered shut down on July 10 over a credible threat with no patch available.
Cyber security
Bad Epoll kernel flaw CVE-2026-46242 roots Linux and Android
Bad Epoll (CVE-2026-46242) is a Linux epoll use-after-free giving unprivileged users root on v6.4+ kernels and Android. No workaround exists. Apply patch a6dc643c6931 now.
Cyber security
Citrix Bleed 2 turns ransomware into identity theft
Citrix Bleed 2 is now an Anubis ransomware access path. Patch NetScaler, kill sessions, and hunt RMM plus credential abuse.
Cyber security
SharePoint CVE-2026-45659 puts patching on a 3 day clock
SharePoint CVE-2026-45659 is an actively exploited RCE risk in CISA KEV. Patch exposed servers and check compromise now.
Cyber security
Langflow RCE turns AI app endpoints into miner bait
Langflow RCE is being used to mine Monero on exposed AI app endpoints. Patch, isolate, and treat public workflows as production attack surface.
Cyber security
SimpleHelp CVE-2026-48558 needs a patch drill
SimpleHelp CVE-2026-48558 is an actively exploited auth bypass. Patch 5.5.16 or 6.0 RC2, then hunt for TaskWeaver and Djinn.
Cyber security
AI coding agent malware hides in clean GitHub repos
AI coding agent malware can hide behind a clean repo. Lock down setup execution, DNS egress, and agent permissions before rollout.
Cyber security
VS Code Tasks supply chain attack needs new checks
VS Code Tasks supply chain attack is a package hijack pattern that can run outside npm lifecycle scripts, so scan editor configs now.
Cyber security
Cisco Unified CM CVE gets a weekend patch clock
Cisco Unified CM CVE is now a patch-or-isolate job: CISA set a June 28 deadline after active exploitation of CVE-2026-20230.
Cyber security
Signal backup recovery keys become the weak link for ops
Signal backup recovery keys can expose historical chats after one phishing win. Treat messenger backups like identity infrastructure now.
AI
Mythos 5 access returns as a government whitelist
Mythos 5 access is back for a whitelist of at least 100 organizations, turning frontier AI launches into compliance operations.
AI
GPT-5.6 delay makes AI model launches a permit race
GPT-5.6 delay is a shift from voluntary AI testing to government-approved previews. Treat model access as a supply-chain risk now.
Cyber security
CISA KEV vulnerabilities put edge gear on watch now
CISA KEV vulnerabilities are a live patch queue: four exploited Lantronix and UniFi OS bugs now demand edge inventory and compromise checks.
Cyber security
FortiBleed FortiGate credentials need action now
FortiBleed FortiGate credentials are an active edge risk: rotate VPN and admin access now, then hunt for persistence.
Cyber security
AutoJack makes AI agent prototypes a real RCE risk
AutoJack is a host RCE warning for AI agent prototypes: one malicious page chained three AutoGen Studio weaknesses into command execution.
Cyber security
FortiBleed credential theft reaches the firewall edge
FortiBleed credential theft turns compromised FortiGate firewalls into sniffers. Rotate secrets and hunt traffic capture now.
Cyber security
FortiBleed puts FortiGate credentials on the clock now
FortiBleed is an active FortiGate credential exposure campaign with up to 86,644 devices reported. Rotate, isolate, and investigate now.
Cyber security
Splunk CVE-2026-20253 puts SIEMs on a 72-hour clock
Splunk CVE-2026-20253 is an actively exploited critical flaw. Patch exposed Enterprise 10.0 and 10.2 nodes by June 21.
Cyber security
Fortinet credential exposure needs a reset plan now
Fortinet credential exposure means about 74,000 edge devices may have leaked logins. Rotate, audit, and lock down FortiGate access now.
Cyber security
Mastra npm supply chain attack hits AI build rooms
Mastra npm supply chain attack exposed AI build pipelines through more than 140 packages, so treat installs as secret exposure events.
Cyber security
Splunk Enterprise flaw turns logs into attack surface
Splunk Enterprise flaw CVE-2026-20253 is under active exploitation. Patch by June 21 or disable the PostgreSQL sidecar safely.