Vulnerabilities
Ivanti disclosed CVE-2026-6973 on May 7 — a CVSS 7.2 EPMM flaw under active exploitation. CISA gave federal agencies just three days to patch (May 10 deadline). It's the third EPMM zero-day of 2026, and Ivanti hints attackers are using credentials stolen during January's campaign. On
Vulnerabilities
Palo Alto Networks disclosed CVE-2026-0300 on May 5, 2026 — a CVSS 9.3 buffer overflow zero-day in PAN-OS that lets unauthenticated attackers execute code as root on internet-exposed PA-Series and VM-Series firewalls. Unit 42 has tracked exploitation by a likely state-sponsored cluster (CL-STA-1132) since April 9. CISA added the CVE
Vulnerabilities
A 9.8 unauthenticated authentication bypass and a 7.7 privilege escalation flaw in MOVEit Automation chain to full administrative control. Patch this week. Upgrading via the full installer is the only fix — there is no workaround. The product family is the same one Cl0p exploited to breach 2,100
Vulnerabilities
A Defender signature update flagged DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha and quarantined them worldwide. Microsoft fixed it in 1.449.430.0. The underlying DigiCert breach is the bigger story.
Vulnerabilities
A pro-Ukrainian hacktivist group called PhantomCore has been exploiting three TrueConf video conferencing flaws (BDU-2025-10114, 10115, 10116) since September 2025 to breach Russian networks. By chaining these vulnerabilities, the group bypasses authentication and executes arbitrary OS commands, turning video conferencing servers into springboards for lateral movement and data harvesting. ST.
Vulnerabilities
Microsoft has patched a serious Entra ID (Azure AD) misconfiguration that exposed an “agent-only” role for Microsoft Graph PowerShell that was not properly restricted to Microsoft’s own internal agents. Attackers who obtained secrets for a service-principal-linked app registration could exploit this role to escalate privileges and pivot to long-term
Supply Chain Attack
Malicious Docker images and VS Code extensions steal IaC secrets; Bitwarden npm trusted publishing abused in a sophisticated DevSecOps attack chain. TEL AVIV, IL — In a cascading security failure that strikes at the heart of modern DevSecOps, the prominent security vendor Checkmarx has confirmed a multi-stage supply chain compromise affecting
Vulnerability Management
A reported Broken Object Level Authorization (BOLA) flaw on the Lovable AI platform allegedly exposed thousands of private coding projects, prompts, and credentials, sparking a debate over "vibe coding" security standards. Stockholm, Sweden — Lovable, the rapidly growing AI "app builder" platform, has found itself at the
Application Security
In a landmark moment for automated defense, Mozilla has patched 271 vulnerabilities in the latest version of Firefox — all identified by Anthropic’s specialized security model, Mythos. Mountain View, CA — Mozilla has released Firefox 150, an update that may represent the single largest leap in automated browser hardening to date.
Artificial Intelligence (AI)
By leveraging Anthropic’s Claude Opus 4.6, a security researcher has successfully developed a working Chrome exploit for roughly $2,300 — demonstrating that the cost of weaponizing known vulnerabilities is plummeting toward commodity pricing. ABINGDON, UK — A watershed moment in the intersection of AI and offensive security was confirmed
Microsoft Ecosystem
An out-of-band update arrives days after the April Patch Tuesday release triggered critical LSASS crashes and BitLocker recovery prompts across enterprise domain controllers. REDMOND, WA — Microsoft has released a series of emergency out-of-band (OOB) updates to address a cascade of failures introduced by its April 2026 "Patch Tuesday"
Enterprise Infrastructure
By wrapping malicious payloads inside legitimate QEMU virtual machines, threat actors are effectively blinding EDR and AV solutions, turning an open-source emulator into a potent defense evasion tool. ABINGDON, UK — A sophisticated shift in ransomware delivery has been identified by security researchers at Sophos and BleepingComputer. Threat actors are increasingly