Mozilla has released updates to address two critical flaws in Firefox for which it warned that exploit code has been published. The vulnerabilities are listed below - CVE-2026-15718, an invalid...

AL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and CVE-2026-58644

Three bugs are under active attack, and two more critical holes could add to the pain

For years, routing traffic through cloud proxies was good enough. Then work moved to the browser, AI entered the workflow, and the inspection model stopped keeping up. Enterprise workflows now...

Tenable security advisory (AV26-705)

Security researcher Chaotic Eclipse (aka Nightmare-Eclipse) has released a new proof-of-concept (PoC) exploit called LegacyHive. It has been described as a Windows User Profile Service arbitrary...

A single approved marketing tag can quietly load fourth-party code your security team has never seen, granting full access to your forms, customer data, and checkout pages. This on-demand webinar...

The public will be urged to take “small but important steps” to prepare for food or water shortages in the event of a cyber attack or severe weather, the UK government has said as it updated...

Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no warning that anything in the folder is about to...

The pace of cybersecurity threats is overwhelming healthcare organizations and leaving them especially vulnerable to supply-chain compromises, the security firm Fortified Health Security said in a...

The Space Force is the smallest military service, with about 15,400 total personnel in fiscal year 2025. The Space Force largely inherited its workforce from other services and has completed some...

Ransomware group World Leaks has posted on the dark web a huge cache of files related to India’s largest nuclear plant, including purported blueprints of parts of its facilities and supplier...

The United Arab Emirates has gained expanded access from the U.S. to coveted artificial-intelligence chips after aiding America in recent months by carrying out dozens of airstrikes against Iran,...

F5 security advisory (AV26-704)

Mega hardware vendor reports problems - but Windows maker isn't yet naming affected models

The Trump administration has launched a new artificial intelligence cybersecurity clearinghouse that officials say will help federal agencies, critical infrastructure owners and operators, and AI...

Notepad++ security advisory (AV26-703)

Citrix security advisory (AV26-702)

Google Chrome security advisory (AV26-701)

HPE security advisory (AV26-700)

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these...

Threat Advisor could help teams with AI-specific risks. But a broader AppSec strategy rethink is needed in the AI era.

Experts say it’s a useful post-compromise tool, for those with the brain cells required to put it together

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The...

Spend time performing forensic analysis on the Windows Operating System and you'll see a host of artifacts that can be used to identify adversary activity. From changes to the registry to the...

Written by: Corné de Jong Introduction Mandiant security assessments frequently identify publicly exposed serverless applications that lack authentication, often as a result of specific business...

Stuck riding out a contract with a vendor you no longer want to use? The Huntress Buyout Program covers your remaining term so you can switch today, not later.

Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true.

SonicWall patched two recently exploited zero-day vulnerabilities in its SMA 1000 Series secure remote access appliances which may have been chained for unauthenticated remote code execution.Key...

The Los Angeles Police Department is the latest U.S. municipal agency to rethink its relationship to ALPR company Flock Safety.