Current analysis, technical guidance and reporting across security, infrastructure, automation and artificial intelligence.
Cisco’s new infrastructure-security platform combines faster vulnerability research with runtime protections. It could reduce emergency patch pressure, provided temporary shields do not become permanent exceptions. Cisco announced an agentic platform for operating and defending critical IT infrastructure on 2 June.…
CISA confirmed active exploitation of an unauthenticated SolarWinds Serv-U flaw that let one crafted request crash file-transfer services.
A malicious notebook could turn github.dev into a GitHub OAuth-token theft path with read and write access across the developer's repositories.
Google’s new AI Threat Defense portfolio aims to connect threat intelligence, exposure context and code repair. Its value will depend on whether organisations can govern the decisions between those stages. Google announced AI Threat Defense on 27 May, presenting a…
Attackers exploited a GlobalProtect authentication-cookie bypass to obtain unauthorized VPN access before a public proof of concept appeared.
Oracle fixed an unauthenticated HTTP flaw that could take over the Payments component in E-Business Suite 12.2.3 through 12.2.15.
Attackers turned FortiClient EMS into a trusted malware-delivery system, pushing the EKZ credential stealer to managed endpoints as a fake vendor patch.
A compromised Nx Console update reached a GitHub employee device, stole credentials, and exposed roughly 3,800 internal repositories.
Two actively exploited Microsoft Defender flaws let local attackers reach SYSTEM or disrupt endpoint protection before automatic fixes arrived.
Microsoft’s multi-model agentic security system offers a credible glimpse of faster vulnerability discovery—but its strongest lesson is the combination of specialised agents, tools and human validation. Microsoft has presented a multi-model agentic security system that uses more than 100 specialised…
A coordinated compromise of npm and PyPI packages shows how trusted publishing, CI caches and maintainer identities can combine into an automated supply-chain attack. Security researchers reported a new “Mini Shai-Hulud” campaign on 11 May involving trojanised packages in the…
Dirty Frag turned Linux kernel networking flaws into a reliable path from a low-privilege foothold to root across major distributions.
