News

Massive Stable Channel Rollout Safeguards Web Browsers The Google development team promoted Chrome 149 to the stable channel

A critical security warning has been issued regarding a command injection vulnerability in Cisco SD-WAN, tracked as CVE-2026-20245. This flaw poses significant risks as it allows authenticated attackers to gain root access by uploading malicious files due to…

Recent vulnerabilities in the Vitest framework, which has over 53 million weekly downloads, expose development setups to remote code execution risks. Key flaws include: 1. **CVE-2026-47428**: An unsanitized query parameter vulnerability allows attackers to…

The article discusses significant vulnerabilities in the SSHFS utility, particularly a command execution exploit denoted as CVE-2026-48711. This flaw allows attackers to execute arbitrary code through improper handling of parameters in the software.…

A new malware campaign called 'IronWorm' is targeting the open source software ecosystem, particularly developers through compromised npm workflows. Written in Rust, it steals sensitive developer secrets such as API keys and SSH keys, which are then used to…

Gartner's analysts have highlighted four critical threats where attackers currently have the advantage: deepfakes, software supply chain risks, prompt injections, and AI application compromises. During the Gartner Security and Risk Management Summit, it was…

Dashlane reported a coordinated hacking attempt aimed at accessing the encrypted password vaults of its users. Attackers exploited the device enrollment feature, sending automated requests to numerous accounts, which led to fewer than 20 vaults being…

The Microsoft AI Red Team updated the Taxonomy of Failure Modes in Agentic AI Systems to reflect new findings from twelve months of red teaming. The v2.0 version expands on failure modes unique to agentic systems and adds seven new categories, such as…

This newsletter highlights recent cybersecurity developments, particularly focusing on threats emerging from North Korea (DPRK) and various malware campaigns. Key points include: 1. **ZionSiphon OT Malware**: DTI analyzed a malware targeting Israeli water…

Microsoft rebranded its WinUI 3 framework as WinUI during the Build 2026 developer conference, emphasizing a shift back towards high-performance native applications rather than resource-heavy web technologies. This strategic move aims to eliminate hybrid…

The article discusses the impending challenges posed by quantum computing to current cryptographic methods like RSA and ECC, highlighting the threat of 'harvest now, decrypt later' tactics. In response, the US and EU are planning a shift to quantum-resistant…

The article discusses the criticisms of the Windows 11 context menu, highlighting issues with its cluttered layout that prioritizes system defaults over user convenience. Users find it cumbersome as legacy options require additional clicks to access,…

A high-severity vulnerability has been identified in Apache Fory, impacting distributed enterprise networks through unauthorized remote code execution. This issue, tracked as CVE-2026-50076, arises from a deserialization bypass due to inadequate verification…

A major vulnerability has been discovered in the Everest Forms Pro plugin for WordPress, allowing unauthenticated attackers to execute remote code and take over websites. This critical flaw, recorded as CVE-2026-3300, received a CVSS score of 9.8 and affects…

The article discusses a critical flaw in the Claude Code GitHub Action, which allowed a single malicious issue to hijack multiple repositories. This vulnerability underscores significant risks associated with the increasing prevalence of AI technologies in…

The article discusses the impact of Agentic AI on defense systems, emphasizing the necessity of a secure IT infrastructure to harness its full potential. Key points include the transformative capabilities of AI in enhancing defense mechanisms, the importance…

Offroad, a New York and Tel Aviv-based startup, has raised $7 million in seed funding to enhance identity management in organizations. Their approach focuses on using agentic AI to address identity risks by autonomously investigating and rectifying issues…

SecurityWeek is hosting a live webinar on June 4, 2026, focusing on the performance of third-party risk programs in organizations. The session will utilize real-world data to identify gaps and suggest improvements to enhance security. Key topics to be…

Willow, formerly known as Webrix, has launched an identity and access management platform aimed at securing enterprise AI agents, backed by $7 million in seed funding from Hetz Ventures and Wix executives. The platform functions as a centralized gateway for…

Bugcrowd has introduced a Data Residency Option to address growing data sovereignty concerns in the EU. This expansion is crucial for organizations as geopolitical tensions and regulatory complexities increase, necessitating strict compliance with EU data…

The article "ThreatsDay Bulletin" discusses significant cybersecurity threats, particularly involving AI agents that have been misused. It highlights various new stories, including malicious command and control (C2) tools, exploits involving JavaScript…

Microsoft warns that the adoption of AI in organizations presents new cyber threats, as attackers exploit AI capabilities to distribute malware. During Infosecurity Europe, experts highlighted the risks of flawed AI code and demonstrated a specific attack…

During Infosecurity Europe 2026, a benchmark called ExploitBench revealed that Anthropic’s AI model, Claude Mythos, outperformed OpenAI’s GPT5.5 in exploiting real-world Google Chrome vulnerabilities. Conducted by Bugcrowd in collaboration with Carnegie…

VoidZero, known for creating tools like Vite, is joining Cloudflare, along with its entire team. Key points include: 1. **Open Source Commitment**: Vite and its related products (Vitest, Rolldown, Oxc, Vite+) will remain open source and vendor-agnostic. 2.…

SafeBreach researchers discovered a critical vulnerability in Google’s Gemini voice assistant that allows attackers to use indirect prompt injections through common messaging notifications. This new attack, termed 'Fake Context Alignment,' was found to…

ProtonMail, a Swiss privacy service, emphasizes the challenge of preventing criminal use of its platform while maintaining user privacy and end-to-end encryption. COO Raphael Auphan highlighted that they cannot access user message contents due to their…

The article discusses the prevalence of travel scams that target individuals during holiday bookings, exploiting emotional decision-making and the sharing of personal information. Key scams include fake booking websites that clone legitimate platforms,…