Security & Risk
90 analyses
A paper by eight researchers decoded the internal reasoning of the APIs from OpenAI, Anthropic, and Google, extracting 182 valid credentials and 367 pieces of personally identifiable information from public developer sessions.
North Korean group used CVE-2026-68820 in AFD.sys to escalate privileges to SYSTEM in a global espionage campaign. Microsoft fixed it in August's Patch Tuesday just days after Check Point's disclosure.
CVSS 9.8 vulnerability allows remote code execution without authentication on JetBrains TeamCity servers. CISA added it to the KEV on August 5 with a three-day deadline.
Seven CVEs in IOS XE with a CVSS of 9.8 and five in Catalyst SD-WAN with a CVSS of 9.9, all discovered internally. Cisco states there is no workaround, only an update, with tight deadlines for network teams.
The U.S. agency added CVE-2026-18577 to the KEV catalog on August 3 after attackers exploited an authentication vulnerability in N-able's RMM to take over servers and pivot to managed endpoints.
Hotfix 2026.3.1.7 was released on August 2 to contain authentication bypass used in active attacks. The vulnerability provides root access to the console orchestrating client endpoints.
N-able released hotfix 2026.3.1.7 on Saturday for CVE-2026-18577, an authentication bypass already in active use by attackers. Compromised RMM provides access to every endpoint it manages.
Versions 22.23.2, 24.18.1, and 26.5.1 were released on July 29 to address memory issues in HTTP/2, use-after-free vulnerabilities, and a bypass of the permission model supporting isolated workloads.
CVE-2026-16812 allows remote command execution without authentication on the on-premises SD-WAN orchestrator. CISA mandated federal agencies to mitigate by July 30, and there is evidence of active exploitation.
CVE-2026-63077 in the agent polling protocol allows any attacker with HTTP access to execute code on the server. All On-Premises installations prior to 2025.11.7 and 2026.1.3 are vulnerable.
India's second-largest public bank confirmed on Monday the compromise of a functional email account, as the TripleX group claims to have freely published 1 TB of internal data as punishment for password failures.
Cl0p affiliates have been exploiting CVE-2026-12569 on exposed PTC Windchill and FlexPLM servers since July 20. The campaign targets intellectual property from automotive, aerospace, and manufacturing industries across various geographies.