Tag Archive

The U.S. Cybersecurity and Infrastructure Security Agency has added two Zammad vulnerabilities to its Known Exploited Vulnerabilities catalog after reports that attackers are actively exploiting at least one flaw. The issues, tracked as CVE-2026-102489 and CVE-2026-102490, can be chained to …

Broken access control sits at 1 on the OWASP Top 10 because authorization logic scattered through if-statements always rots. We scored ten tools that centralize the decision on whether an identity can execute a specific action against a resource, aligning …

Cling malware is turning compromised internet-connected devices into a botnet while disguising its control traffic as replies from Google’s public STUN service. The technique makes attacker instructions look like routine communications used by applications to connect across network boundaries. The …

An expired certificate is the outage everyone saw coming, and with public TLS marching toward 47-day maximum lifetimes, renewal frequency is about to rise eightfold. We scored ten CLM/PKI options with automation-through-deployment weighted highest. As organizations scale infrastructure across clouds …

Every workload, container, and script now carries an identity, machines outnumber humans dozens to one, and unmanaged non-human and control-plane identities have become primary attack paths. We scored ten machine-identity solutions with automation depth weighted highest. CyberArk (Venafi) takes 1 …

Citrix has released emergency security updates for a NetScaler SAML zero-day vulnerability that attackers are actively exploiting. Tracked as CVE-2026-88779, the flaw affects customer-managed NetScaler ADC and NetScaler Gateway appliances and can cause denial of service, disrupting access to services …

This week’s security newsletter was dominated by a Pentagon personnel data breach affecting more than three million people, actively exploited zero-days in Apple CoreGraphics and Fortinet FortiMail, and reports of two still-unpatched Citrix NetScaler RCE flaws. The broader bulletin covers …

South Korean President Lee Jae Myung ordered a thorough investigation on October 4, 2026, after a series of financial sector data breaches exposed customer and worker information. The order comes as investigators examine whether AI tools helped attackers break into …

Vercel has confirmed a KVM zero-day vulnerability after security researcher Paulos Yibelo reported a full virtual machine escape that, he says, allows code inside a guest to gain root access on the host. Full VM escape zeroday (guest>host root in …

A suspected ShinyHunters member has been detained in Jordan and is reportedly helping the FBI identify other hackers linked to the group. Reuters reported on October 3 that three people familiar with the matter confirmed the detention of Saif al-Din …