Vulnerabilities
Citrix Patches Six NetScaler Flaws, Including CVE-2026-8451 With Echoes of CitrixBleed
Six NetScaler flaws, one with echoes of CitrixBleed — defender teams stay in patch-verification posture this week.
Latest
Artificial Intelligence (AI)
Microsoft Warns Poisoned MCP Tool Descriptions Can Turn AI Agents Into Data-Leak Channels
A fresh vendor-research disclosure at the intersection of AI agents and supply-chain risk — Microsoft says poisoned tool descriptions can quietly redirect what an agent does, and pairs the research with defender guidance for teams shipping agentic AI this week.
Vulnerabilities
Microsoft Defender Flaw CVE-2026-33825, 'BlueHammer,' Tied to Ransomware Activity
Another Defender zero-day for defender teams to verify — patch cycle plus KEV watch this week.
Data Breaches
Nissan Oracle PeopleSoft Campaign Reportedly Targeted 100 Organizations
One confirmed victim, a reported 99 more not yet named — Oracle PeopleSoft customers stay in patch-verification posture this week.
Mobile Security
Researchers Disclose AirDrop and Quick Share Flaws Affecting Five Billion Devices
Two researchers mapped the proximity-sharing protocols behind AirDrop and Quick Share and found six flaws spanning five billion Apple and Android devices, with vendor fixes only partly shipped.
Mobile Security
Researchers Disclose 282 iOS AI Apps Leaking API Keys in Network Traffic
A scale-significant AI-app privacy disclosure with developer accountability implications: Wake Forest researchers found 282 of 444 iOS AI apps exposing usable LLM credentials in their own network traffic, and most stayed open months after notification.
Vulnerabilities
SimpleHelp CVE-2026-48558 Exploited to Deliver TaskWeaver and Djinn Stealer
A critical remote monitoring and management vulnerability is under active exploitation to deliver an infostealer that hunts cloud and AI development credentials — and it is now on CISA's KEV list.
Vulnerabilities
Oracle E-Business Suite Payments Flaw CVE-2026-46817 Under Active Exploitation
Another Oracle product line under active exploitation — high-priority patch verification this week.
Data Breaches
Aflac Japan Discloses Data Breach Affecting 4.38 Million People
Another scale-significant Japanese-sector disclosure: Aflac Life Insurance Japan says intruders sat in its policyholder portal for ten days and exfiltrated the personal data of roughly 4.38 million customers and agents.
Data Breaches
Nissan Discloses Employee Data Breach Linked to Oracle PeopleSoft Zero-Day
A high-profile Oracle PeopleSoft customer disclosure: Nissan says current and former employees' data was exposed via CVE-2026-35273, with sector-advisory implications for the broader Oracle exploitation cycle.
Threat Intelligence
Microsoft Removes 119 Edge Extensions That Hid Malicious Content in Images and Fonts
Browser-extension enforcement action at scale from Microsoft. The company pulled 119 Edge add-ons that concealed payloads inside image and font files, with a combined install base reported at up to 2.6 million, and suspended the developer accounts behind them.
Vulnerabilities
Researchers Disclose Amazon Q Developer VS Code Flaw Affecting Cloud Credentials
A coding-AI-assistant flaw with cloud-credential implications — defender posture review for the week.