23 articles on vulnerability-management — privacy laws, security frameworks, and regulatory compliance.
In two days CISA added seven vulnerabilities to the Known Exploited Vulnerabilities catalog — one Gitea code injection flaw, one actively exploited Ci...
Microsoft disclosed a maximum-severity remote code execution flaw in Entra ID, the authentication control plane underneath every access control most e...
GitLab shipped an out-of-band emergency patch on August 17, 2026 for CVE-2026-19478, a CVSS 9.4 unauthenticated code injection in the GraphQL @gl_intr...
GHSA-864f-rcv7-6rh4 is a type confusion vulnerability in isolated-vm's ExternalCopy transferList handling that lets code inside the sandbox corrupt ho...
Two studies published this month put numbers on something most secure development programmes have been assuming rather than measuring. Veracode found ...
On 17 August CISA added CVE-2025-62593 — a code injection flaw in Ray, the distributed AI compute engine — to the Known Exploited Vulnerabilities cata...
Microsoft shipped 398 new CVEs on 11 August 2026 — 62 Critical, 336 Important, one Moderate — with exactly one under active attack: CVE-2026-68820 in ...
Switzerland's Federal Office of Information Technology detected unusual SharePoint activity on 28 July 2026 and confirmed 200 compromised accounts on ...
Microsoft Threat Intelligence attributed a new ransomware strain, StormEncryptor, to Storm-1175 beginning 2 August 2026 — the same day CVE-2026-18577 ...
CISA added CVE-2026-9198 to the KEV catalog on 4 August 2026 with a 7 August federal deadline. A CVSS 9.8 unauthenticated RCE in IBM Langflow, exploit...
SpecterOps presented the Pass-the-Passkey research at Black Hat USA on 5 August 2026: more than 20 techniques against Windows 11, Microsoft Entra ID, ...
Attackers found a bypass for the fix to CVE-2026-18556 and began exploiting it in late July 2026. N-able confirmed exploitation on 2 August; CISA adde...
INC Ransomware has become the dominant actor exploiting CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA 1000 appliances, with 885 victims claimed a...
On 27 July 2026 CISA added a Fortinet FortiOS information-disclosure flaw and an Arista VeloCloud Orchestrator command-injection flaw to the KEV catal...
On 14 July 2026 Romania's e-Terra cadastre platform went dark. The national cyber directorate later confirmed the attack was not sophisticated: leaked...
A critical code injection flaw in the ServiceNow AI Platform lets unauthenticated attackers escape the script sandbox and execute code on the instance...
On July 14, 2026, Microsoft shipped the largest Patch Tuesday in history — 569 to 622 CVEs depending on who is counting — including actively exploited...
Sysdig says JADEPUFFER is the first documented ransomware operation run end-to-end by an LLM agent — it broke into a Langflow instance via CVE-2025-32...
Comcast agreed to pay $117.5 million to resolve claims from the October 2023 Xfinity breach that exposed the data of more than 30 million customers. T...
The 2026 Verizon Data Breach Investigations Report analyzed more than 22,000 confirmed breaches and found that vulnerability exploitation now accounts...
The New York Department of Financial Services has moved past the first compliance certification deadline under its amended Part 500 cybersecurity regu...
CVE-2026-1709 in Keylime remote attestation allowed unauthenticated administrative access, compromising the very foundation of zero-trust architecture...
CISA has issued an urgent alert urging organizations to harden Microsoft Intune configurations following the devastating March 2026 cyberattack on med...