Expert perspectives on application security, compliance, and emerging threats
IncidentOn October 4, 2024, Patchstack identified active exploitation of two stored cross-site scripting (XSS) vulnerabilities in WordPress plugins. Attackers targeted CVE-2026-93836 in WPC Product Bundles an
IncidentWhat Happened Between July 13 and early August 2026, attackers began scanning for CVE-2026-61500 , a critical remote code execution vulnerability in Rejetto HFS (HTTP File Server) versions 3.0.0 throu
IncidentWhat Happened On January 14, 2025, GitLab disclosed CVE-2026-90970 , a critical remote code execution vulnerability in its AI Gateway service. An attacker with basic user privileges could execute arbi
IncidentA command execution vulnerability in GitLab s AI Gateway, disclosed on October 2, 2026, scored 9.9 on the CVSS scale. If you re running a self-hosted instance with Duo Agent Platform access enabled, a
Get weekly security insights and compliance updates delivered to your inbox.
IncidentTruffle Security recently identified 543,699 unique credentials in public GitHub repositories. These aren t outdated keys. They re live credentials granting access to production systems right now. Thi
IncidentWhat Happened Truffle Security s research revealed that over 543,000 valid credentials were exposed in public GitHub repositories as of July 2024. These weren t just outdated tokens from abandoned pro
IncidentOpenAI has identified a new attack vector in simulated environments: prompt injections that can spread across AI systems. Using their GPT-Red-style training framework, researchers observed malicious p
IncidentWhat Happened Attackers exploited two zero-day vulnerabilities in Citrix NetScaler products to plant webshells on internet-facing devices. CVE-2026-88771 , the more severe of the two, allows remote, u
IncidentWhat Happened ShinyHunters, identified as UNC6240, exploited CVE-2026-35273 in Oracle PeopleSoft to deploy web shells and achieve remote code execution across multiple organizations worldwide. This vu
IncidentOn September 4, 2025, security researcher Oren Yomtov reported a vulnerability through HackerOne that allowed one Cloudflare customer to read another customer s data. The flaw was in Cloudflare s Cont
IncidentWhat Happened On September 22, 2026, WordPress released patches for CVE-2026-87902 , a remote code execution vulnerability with a CVSS score of 9.2. At 11:49 a.m. UTC that same day, Previdian s teleme
IncidentOn a Tuesday morning, WordPress released security updates for 25 version branches due to CVE-2026-87902, a path traversal flaw that lets unauthenticated attackers execute arbitrary PHP code on vulnera
IncidentOn August 22, a security researcher reported a critical vulnerability in WordPress that allowed administrative access to become a remote code execution vector. The flaw, named Click2Shell, exploited a
IncidentCVE-2026-76460 earned the maximum CVSS score for a reason: an unauthenticated attacker can bypass authentication on Cisco s Identity Services Engine and gain full administrative control. No credential
IncidentWhat Happened Between May and June 2024, AIR discovered a zero-click remote code execution vulnerability in multiple AI coding agents. The flaw, dubbed Plugin4Shell, allowed attackers to execute arbit
IncidentA crafted URL shouldn t be able to install software on your WordPress site. But that s exactly what Click2Shell did before WordPress patched it in version 7.1.1. Here s what happened, which controls f
