Security & Risk
171 analyses
A report by Palo Alto Networks published on September 2 describes an invasion in which tactical execution was delegated to autonomous agents, including an 80-page report left for the victim.
Annual revenue closes at $11.5 billion with a 24% increase, RPO surpasses $20 billion for the first time, and Console is acquired to bring autonomous agents to Cortex.
The U.S. agency added CVE-2026-82078 (CVSS 9.4) and CVE-2026-81578 (CVSS 8.8) to the KEV this Monday; federal agencies have until September 14 to apply the second PaperCut patch under BOD 26-04.
Sygnia detailed on August 30 how the Chinese espionage cluster Fire Ant, with significant overlap with UNC3886, has transitioned from the virtualization layer to Cisco IOS XR routers and TACACS servers for high-value clients.
Anthropic has begun logging out Claude accounts, deleting saved payment methods, and refunding charges after identifying malware stealing session cookies and draining paid quotas without going through MFA.
Manchester Airports Group confirmed that external attackers exfiltrated data of 8.7 million passengers from Manchester, Stansted, and East Midlands airports. The company refused to pay the ransom demanded by the intruders.
ServiceNow has released patches for four critical vulnerabilities in the Now Platform and AI Platform, two of which have a CVSS score of 10.0. These vulnerabilities allow code execution and SQL injection by unauthenticated attackers without user interaction.
Anthropic, Google, Cisco, CrowdStrike, Palo Alto Networks, Visa, and Capital One join OpenAI in a document highlighting a narrow window before the next wave of AI-driven attacks.
CVSS 9.8 vulnerability in Gitea allows an attacker with write permission to execute commands as the service user. CISA placed the flaw in the KEV and set a deadline of August 28 for federal agencies to patch.
CVE-2026-73570 allows for remote code execution without authentication on Zimbra servers with SNMP enabled by default. CISA has imposed a three-day deadline for federal agencies, and the patch window is tightening.
CVE-2026-21962 allows unauthenticated access to Oracle HTTP Server and WebLogic. U.S. federal agencies have until August 27 to apply the patch. The vulnerability has been actively exploited for eight months.
The critical vulnerability CVE-2026-21962 in the WebLogic proxy plug-in was patched in January, generated over 140,000 attack attempts in 21 countries, and has only now entered the active exploitation list of the U.S. agency.