Expert perspectives on application security, compliance, and emerging threats
IncidentWhat happened On July 27, Gitea released version 1.27.1 to patch CVE-2026-60004, a critical remote code execution vulnerability in its diffpatch API endpoint. This flaw allows attackers to execute arb
IncidentWhat Happened In early 2024, security researchers disclosed EchoLeak, a zero-click prompt injection vulnerability in Microsoft 365 Copilot with a CVSS score of 9.3. This flaw allowed attackers to mani
IncidentOn April 17, 2025, Vercel shipped emergency patches for Next.js after discovering two critical vulnerabilities that let unauthenticated attackers execute arbitrary code on affected servers. One exploi
IncidentA coordinated operation by the Australian Federal Police has led to the arrest of two individuals linked to TeamPCP, a hacking group responsible for supply-chain attacks that compromised over a thousa
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Australian Federal Police arrested two individuals linked to TeamPCP, a cybercrime group that compromised at least 3,800 GitHub repositories. The group deployed Shai-Hulud, a self-propag
IncidentIn April 2026, cyber threat assessment firms discovered malicious code in open-source npm packages. By the time Australian Federal Police and the FBI arrested two alleged members of TeamPCP, over 1,00
IncidentA prompt injection flaw in Amazon s Kiro IDE allowed attackers to exfiltrate source code and credentials through a feature meant to assist developers. Disclosed by Mindgard in late 2024, the vulnerabi
IncidentWhat Happened James Kettle from PortSwigger released HTTP Terminator, an AI-powered open source tool that discovered six previously unknown HTTP request-smuggling techniques. The tool uses machine lea
IncidentWhat Happened CERT/CC disclosed two critical vulnerabilities in Kaltura s HTML5 video player library (mwEmbed) that remain unpatched. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912, both resu
IncidentOn July 27, attackers began exploiting a critical vulnerability in Gitea, a popular self-hosted Git service. The flaw, tracked as CVE-2026-60004, allows remote attackers to execute arbitrary shell com
IncidentWhat Happened Attackers exploited CVE-2026-60004 , a critical code injection vulnerability in Gitea, to execute arbitrary shell commands on unpatched self-hosted instances. The attack chain was straig
IncidentOn a Tuesday morning, Wordfence disclosed CVE-2026-18431, a critical vulnerability in Avada that lets unauthenticated attackers execute arbitrary PHP code on your server. No phishing email. No stolen
IncidentOn a Tuesday morning, your monitoring alerts fire. An attacker is exploiting a vulnerability in your API authentication layer that your last pentest missed. The exploit code is sophisticated, targetin
IncidentA malicious website can rewrite your local AI model s behavior without you knowing. Researchers at Cyera discovered this vulnerability in Nvidia s NemoClaw AI assistant, highlighting the urgent need f
IncidentOn August 25, 2026, Oasis Security revealed a vulnerability in NVIDIA NemoClaw that allows a webpage controlled by an attacker to take over a local Ollama instance on your machine. Although no exploit
IncidentWhat Happened NVIDIA s OpenClaw tool had a vulnerability allowing attackers to access the local model server without authentication via the Ollama API. This flaw enabled ongoing corruption of AI agent
