Security & Risk
140 analyses
Use-after-free vulnerability with CVSS 8.8 was present in the client unblock flow since version 7.2.0, released in August 2023. The bug was uncovered by an autonomous bug bounty tool.
Record Net New ARR of $256 million and a 4-for-1 stock split raised the annual guidance, but billings below consensus punished the stock after the market closed on June 3.
Anthropic's unreleased frontier model has already identified over 10,000 critical vulnerabilities. The company allocates $100 million in usage credits and $4 million in donations for open-source security.
Mandate effective from 1 June for individual users of Trusted Access for Cyber with access to GPT-5.5, GPT-5.5-Cyber, and GPT-5.4-Cyber. Yubico provides a dual pack of YubiKey dedicated for this purpose.
Sysdig's Threat Research Team reported the first autonomous intrusion conducted by an LLM agent: via CVE-2026-39987 on Marimo (CVSS 9.3), the attacker exfiltrated a PostgreSQL database in under an hour, without pre-written scripts.
The vulnerability allows complete takeover of instances by a remote attacker without login and opens the new monthly critical patch cycle of Oracle. ORDS versions 24.2.0 to 26.1.0 are affected.
Vulnerability in the SetIntegrationRequest policy of Apigee received a 9.2 on the CVSS and allows for the exfiltration of service account tokens, but relies on an insecure prior configuration in the API proxy.
A crafted request allows remote code execution without authentication in WebSphere 8.5 and 9.0 Web Server Plug-ins. On the same day, IBM published another 9.8 vulnerability in Engineering Lifecycle Management.
Vulnerability in KubeVirt's virt-handler allows a user with edit permissions in a single namespace to hijack the CRI-O socket and compromise the entire node. Red Hat has published errata for affected lines starting from 4.12.
An unauthenticated vulnerability in GitHub Enterprise Server has received a CVSS score of 9.2 and allows redirection of internal calls to leak credentials. Fixes are available in builds 3.16.20, 3.17.17, 3.18.11, and 3.19.8.
In the early hours of 22 May, an agent with organisational access to GitHub rewrote 502 historical tags of four PHP packages, injecting a backdoor that exfiltrates cloud credentials, CI/CD tokens, and Kubernetes secrets without visible alerts.
The extortion group CoinbaseCartel claimed access to the domain panasonic.aero on 22 May 2026. Panasonic Avionics serves more than 200 airlines and covers approximately 70% of the global fleet of aircraft equipped with IFE systems.