Current analysis, technical guidance and reporting across security, infrastructure, automation and artificial intelligence.
Cisco confirmed exploitation of two Catalyst SD-WAN control-plane flaws and told customers to preserve admin-tech evidence before patching or changing configuration.
The WAF Blocked the Name. The Attacker Changed the Spelling. Update, 29 September 2026: Google’s 25 September report describes renewed ShinyHunters exploitation of CVE-2026-35273 across sectors. The group changed its request paths to bypass WAF rules protecting PeopleSoft’s Environment Management…
A SimpleHelp OIDC bypass could create technician accounts, enrol attacker-controlled MFA and inherit remote-management permissions from a mapped group.
Unauthorised access to a World Food Programme registration system exposed data associated with roughly 600,000 Gaza households. In a conflict zone, ordinary identity and location fields can create extraordinary physical risk. The World Food Programme confirmed unauthorised access to its…
June 2026 Patch Tuesday covers 110 approved patch records and 392 unique CVEs across Microsoft, Adobe and SAP.
Apple extended Private Cloud Compute onto Google Cloud and NVIDIA hardware, turning attestation, independent roots of trust and public verification into the privacy boundary.
France says one hijacked Tchap account exposed public-room content associated with 73,467 officials. Private encrypted histories were not reported compromised.
Google patched an actively exploited V8 memory-corruption flaw reachable through a crafted web page. The fix is not complete until the browser restarts.
A Check Point IKEv1 authentication bypass was exploited for a month before disclosure, with at least one intrusion linked to a Qilin ransomware affiliate.
Cisco’s new infrastructure-security platform combines faster vulnerability research with runtime protections. It could reduce emergency patch pressure, provided temporary shields do not become permanent exceptions. Cisco announced an agentic platform for operating and defending critical IT infrastructure on 2 June.…
CISA confirmed active exploitation of an unauthenticated SolarWinds Serv-U flaw that let one crafted request crash file-transfer services.
A malicious notebook could turn github.dev into a GitHub OAuth-token theft path with read and write access across the developer's repositories.
