vulnerabilities news
22 stories
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 2
AI agents have been observed attempting SQL injection attacks while searching government data, with investigators successfully tracing an AI agent's path from a research task to reconnaissance activities. This comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities to its Known Exploited Vulnerabilities catalog, including flaws in Zammad…
'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
A Chinese threat group is reportedly deploying "Warlock" ransomware in attacks targeting critical infrastructure organizations in Portuguese and Spanish-speaking countries. The campaign exploits various vulnerabilities within Microsoft SharePoint, according to recent analysis from the Symantec Threat Hunter Team.
CISA Adds 5 Exploited Flaws in Artifactory, ScreenConnect, RouterOS to KEV
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog, adding five new flaws that have been observed under active exploitation. These vulnerabilities impact products from JFrog, ConnectWise, and MikroTik, specifically affecting Artifactory, ScreenConnect, and RouterOS platforms. The inclusion in the KEV catalog mandates that…
Microsoft Patches Record 973 Vulnerabilities Amidst Active Exploitation
Microsoft has released patches for an unprecedented 973 vulnerabilities as part of its latest Patch Tuesday update, a new record for the company. Among these, two specific vulnerabilities, identified as CVE-2026-81963 and CVE-2026-85880, are confirmed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to be actively exploited in the wild.
Cisco Patches Nine Flaws in Crosswork and Secure Workload Software
Cisco has issued security updates to address a total of nine vulnerabilities impacting its Crosswork platforms and Secure Workload Software. Among these, five distinct flaws have been assigned a critical Common Vulnerability Scoring System (CVSS) score of 10.0, indicating the highest level of severity. The company’s advisory notes that the vulnerabilities affect specific components within the…
Critical Chrome Update Fixes Two Buffer Overflow Vulnerabilities
Google has released an urgent update for its Chrome desktop browser to address 15 security vulnerabilities, including two critical buffer overflow flaws that could allow remote code execution outside the browser's sandbox. The stable channel has been updated to version 151.0.7922.169/.170 for Windows and Mac users, and 151.0.7922.169 for Linux.
Enterprise Software Has 4.31x More Critical Vulnerabilities
Enterprise applications are now exhibiting a 4.31-fold increase in critical and high-severity vulnerabilities compared to the period before the widespread adoption of AI in software development. This finding comes from a recent analysis by Sonatype, which examined four years of enterprise software development data. The study indicates that while the pace of application creation has accelerated…
17th August – Threat Intelligence Report
Several organizations across various sectors have recently reported cyberattacks and data breaches, while security researchers have detailed new vulnerabilities and emerging threat trends, including the use of AI in cyberespionage.
Crooks Buy Expired Domains for Malware Delivery, Other Threats Detailed
Cybercriminals are increasingly acquiring expired internet domains to host malware and execute other malicious activities, according to recent security reports. This tactic leverages previously legitimate domain names, which can lend an air of trustworthiness to their operations.
Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI
The National Institute of Standards and Technology (NIST) is reportedly investigating the application of artificial intelligence (AI) to manage and mitigate software vulnerabilities. This initiative comes amidst a significant increase in the volume of newly discovered flaws, a trend that is, in part, attributed to the growing use of AI-powered tools by security researchers and malicious actors…
Black Hat USA 2026: AI is racing ahead of cybersecurity controls
AI's rapid advancement is outpacing current cybersecurity controls and accountability frameworks, a central theme at Black Hat USA 2026. Discussions highlighted the increasing speed and volume of vulnerability discovery by AI-powered systems, alongside concerns about the lack of clear ownership and governance for AI actions.
Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws
Adobe has issued an urgent advisory, urging users to immediately patch critical security vulnerabilities identified in its ColdFusion and Campaign Classic products. The company has released security updates to address these flaws, which pose significant risks to affected systems.
When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers
Check Point Research has identified five memory-corruption vulnerabilities within `workerd`, the open-source runtime environment underpinning both Cloudflare Code Mode and Cloudflare Workers. Two of these vulnerabilities were rated critical by Cloudflare. The flaws could enable sandbox escapes in Code Mode and cross-tenant data exposure in Cloudflare Workers, a platform utilized by millions of…
Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw
Researchers have reported the discovery of 84 previously unknown vulnerabilities affecting the core networks of 4G and 5G mobile systems. These flaws, collectively termed 'iTrue' vulnerabilities, are described as stemming from implicit trust errors between various network functions within the core infrastructure. The report indicates that these issues could potentially be exploited to…
AI to Drive More Windows Security Updates, Microsoft Says
Microsoft has indicated that users of its Windows operating system should anticipate an increase in the volume of security updates. This projected rise is attributed to the company's expanding reliance on artificial intelligence (AI) to identify vulnerabilities within its codebase.
Summer Staffing Shortages Expose IT Security Risks
Cybersecurity experts are warning that organizations face heightened risks during summer months due to reduced IT staffing levels, creating opportunities for threat actors. Data indicates a significant increase in cyberattacks during holiday periods, with summer being particularly vulnerable as security teams operate with diminished capacity.
Chrome 150 Update Fixes 27 Security Flaws
Google has released an update for its Chrome browser, version 150, which addresses a total of 27 security vulnerabilities. Among the patched flaws, 13 were identified as use-after-free bugs, with two of these specifically noted as critical in severity. This update is crucial for users to maintain the security posture of their browsing environment.
Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation
Ubiquiti has released security updates to address seven vulnerabilities in its UniFi OS, including a critical flaw that could allow for command injection. The most severe of these, CVE-2026-50746, carries a CVSS score of 10.0 and affects the UniFi Connect Application, versions 3.4.16 and earlier. This application is used for managing commercial building systems like smart lighting and EV chargers.
Cybersecurity and the Gap Between Skill and Ability
National security agencies from the Five Eyes alliance have issued a joint warning about the escalating cyber risks posed by AI, particularly its capacity for autonomous hacking. The advisory reiterates long-standing cybersecurity best practices but emphasizes their increased urgency due to rapid AI advancements.
OpenClaw: risks for the users and how to mitigate them
OpenClaw, an AI agent ecosystem formerly known as Clawdbot and Moltbot, presents significant security risks to users and organizations due to vulnerabilities and the widespread distribution of malicious extensions. The platform's popularity stems from its flexibility and ability to automate complex tasks using natural language instructions without requiring programming knowledge. This ease of…
AI Creates 457 Million Security Issues for Organizations
A recent analysis by Tenable identified 457 million AI-related security issues across more than 7,000 organizations over a 30-day period, averaging 62,000 exposures per organization. These issues are primarily linked to misconfigurations and unmanaged dependencies within AI tools, rather than traditional Common Vulnerabilities and Exposures (CVEs). The findings highlight a significant…
Oracle Releases June Patch Update Addressing 243 Vulnerabilities
Oracle has issued its June Critical Security Patch Update, resolving 243 unique CVEs with 245 security patches. A significant portion, 122 patches, are rated as critical severity. The Oracle Fusion Middleware product family received the largest number of fixes, with 106 patches.