Security & Risk
90 analyses
Anthropic's unreleased frontier model has already identified over 10,000 critical vulnerabilities. The company allocates $100 million in usage credits and $4 million in donations for open-source security.
Mandate effective from 1 June for individual users of Trusted Access for Cyber with access to GPT-5.5, GPT-5.5-Cyber, and GPT-5.4-Cyber. Yubico provides a dual pack of YubiKey dedicated for this purpose.
Sysdig's Threat Research Team reported the first autonomous intrusion conducted by an LLM agent: via CVE-2026-39987 on Marimo (CVSS 9.3), the attacker exfiltrated a PostgreSQL database in under an hour, without pre-written scripts.
The vulnerability allows complete takeover of instances by a remote attacker without login and opens the new monthly critical patch cycle of Oracle. ORDS versions 24.2.0 to 26.1.0 are affected.
Vulnerability in the SetIntegrationRequest policy of Apigee received a 9.2 on the CVSS and allows for the exfiltration of service account tokens, but relies on an insecure prior configuration in the API proxy.
A crafted request allows remote code execution without authentication in WebSphere 8.5 and 9.0 Web Server Plug-ins. On the same day, IBM published another 9.8 vulnerability in Engineering Lifecycle Management.
Vulnerability in KubeVirt's virt-handler allows a user with edit permissions in a single namespace to hijack the CRI-O socket and compromise the entire node. Red Hat has published errata for affected lines starting from 4.12.
An unauthenticated vulnerability in GitHub Enterprise Server has received a CVSS score of 9.2 and allows redirection of internal calls to leak credentials. Fixes are available in builds 3.16.20, 3.17.17, 3.18.11, and 3.19.8.
In the early hours of 22 May, an agent with organisational access to GitHub rewrote 502 historical tags of four PHP packages, injecting a backdoor that exfiltrates cloud credentials, CI/CD tokens, and Kubernetes secrets without visible alerts.
The extortion group CoinbaseCartel claimed access to the domain panasonic.aero on 22 May 2026. Panasonic Avionics serves more than 200 airlines and covers approximately 70% of the global fleet of aircraft equipped with IFE systems.
GitHub's CISO attributed the breach of 3,800 internal repositories to a malicious version of the Nx Console extension for VS Code, linked to a supply chain attack against TanStack's npm packages on 11 May.
The TeamPCP group compromised a GitHub employee's device with a tampered VS Code extension to exfiltrate approximately 3,800 internal repositories. The company confirms that customer data was not affected.