48 verified briefings on Vulnerability. Each story includes a plain-English summary, why it matters, and the concrete action engineering teams should take.
A vulnerability in Meta's AI support chatbot allowed hackers to take over Instagram accounts. Attackers tricked the chatbot into changing an account's email address, enabling a password reset. Meta has confirmed the security flaw is now patched.
A new analysis highlights how advanced AI models can now autonomously discover software vulnerabilities at an unprecedented scale. This fundamentally changes the balance between offense and defense in cybersecurity, making traditional disclosure timelines potentially obsolete and requiring an urgent rethinking of security strategies.
Palo Alto Networks warns a medium-severity security flaw in its PAN-OS and Prisma Access products is under active attack. The vulnerability, CVE-2026-0257, allows attackers to bypass authentication and potentially establish unauthorized VPN connections, posing a significant risk to affected networks.
Microsoft has launched MDASH, a new AI-powered security platform for large-scale vulnerability discovery. The system uses more than 100 specialized AI agents that work together to automatically scan, validate, and prove security flaws across complex codebases like Windows and other Microsoft software.
Anthropic's Project Glasswing, an AI-powered security initiative, has discovered over 10,000 high- or critical-severity vulnerabilities in widely used software. The project, which launched last month with around 50 partners, demonstrates AI's growing capability in automated vulnerability detection for critical systems.
Critical vulnerabilities have been found in the SEPPMail Secure E-Mail Gateway, an enterprise email security solution. Attackers could exploit these flaws to execute code remotely, read all email traffic passing through the appliance, and potentially gain access to the company's internal network, posing a significant security risk.
Multiple security vulnerabilities have been discovered in the Linux kernel, affecting its cryptographic API and packet sockets. A significant flaw, dubbed "Copy Fail," could allow a local attacker to escalate privileges or even escape a container, potentially leading to a full system compromise. An update has been released.
Ubuntu has issued a security notice for multiple vulnerabilities discovered in the Linux kernel. The flaws affect key subsystems, including network drivers and the BTRFS file system. An attacker could potentially exploit these issues to compromise a system, making immediate updates essential for all affected users.
Cloudflare tested Anthropic's security-focused AI model, Mythos Preview, on its own infrastructure. As part of Project Glasswing, they used the model to scan over fifty internal code repositories to identify potential vulnerabilities and understand how attackers might leverage similar advanced AI tools in the future.
The US cybersecurity agency has updated its Known Exploited Vulnerabilities (KEV) catalog with seven new entries, including flaws in Microsoft Windows, Defender, and Adobe Acrobat. The additions signal that these vulnerabilities are being actively used by attackers, requiring urgent attention from IT and security teams.
A new Linux kernel vulnerability named "Dirty Frag" has been found in versions 4.10 and later. It allows for local privilege escalation by combining two previously known flaws. The issue is in the IP packet fragmentation system and was publicly disclosed on May 7, 2026.
Microsoft's May security update for Windows 11 is failing for some users, leaving their systems unprotected. The installation fails and rolls back when the device's boot partition has insufficient free space. The issue occurs during the reboot phase, leaving dozens of security patches uninstalled.
Ubuntu has patched multiple vulnerabilities in Unbound, a popular DNS resolver. The flaws could allow remote attackers to cause a denial of service or, in some cases, execute arbitrary code. One critical issue affects recent Ubuntu LTS versions, making immediate updates essential for affected systems.
Ubuntu has released a security update for the Linux kernel used in NVIDIA Tegra systems. The update addresses several vulnerabilities in network drivers, NVME drivers, and Netfilter that could allow an attacker to compromise an affected system. Applying the patch is recommended for all users.
A vulnerability has been found in GStreamer Good Plugins due to improper handling of specific MOV/MP4 media files. A remote attacker could exploit this flaw to crash the application, leading to a denial of service, or potentially gain the ability to execute arbitrary code on the affected system.
Security researchers discovered and patched a series of vulnerabilities, named 'Claw Chain', in the OpenClaw AI agent framework. These flaws could have allowed attackers to steal credentials, escalate privileges, and maintain persistent access within affected systems, posing a significant threat to deployments using the framework.
A security researcher has released a proof-of-concept exploit for a new Windows zero-day vulnerability called MiniPlasma. The exploit can grant full SYSTEM privileges on fully patched Windows 11 systems. The flaw is reportedly an unfixed version of a bug Microsoft claimed to have patched in 2020.
Ubuntu has released security updates for the Linux kernel on Xilinx ZynqMP systems. These patches address multiple vulnerabilities, including critical flaws in the OverlayFS implementation that could allow a local attacker to gain elevated privileges and compromise the security of affected devices.
Drupal has announced an upcoming core security release for all supported branches, scheduled for May 20, 2026. The Drupal Security Team is urging site administrators to prepare for immediate updates, warning that exploits could be developed within hours or days of the patch's release.
Researchers have discovered two vulnerabilities in OpenVPN. One flaw could allow an attacker to crash the service, causing a denial of service. The second could leak sensitive data from previous sessions under specific conditions, potentially exposing private information. Both issues affect the handling of network packets.
A nine-year-old vulnerability (CVE-2026-46333) has been found in the Linux kernel. The flaw, caused by improper privilege management, allows a local user without special permissions to access sensitive files and execute commands with root privileges on default installations of several major Linux distributions.
Ivanti, Fortinet, SAP, VMware, and n8n have released security updates to fix several critical vulnerabilities. The flaws could allow attackers to bypass authentication, execute arbitrary code, and disclose information. A particularly severe bug in Ivanti Xtraction received a critical CVSS score of 9.6.
Proof-of-concept exploit code, named DirtyDecrypt, has been publicly released for a recently patched Linux kernel vulnerability. The flaw allows for local privilege escalation, enabling an attacker with local access to gain higher-level system permissions. The vulnerability was discovered and reported by security researchers in early May.
Ubuntu has issued a security notice detailing several vulnerabilities discovered in the Linux kernel. The flaws affect network drivers, NVME drivers, and IPv4 networking subsystems. An attacker could potentially exploit these issues to compromise a system, making the provided security update essential for all users.
A new vulnerability called YellowKey allows attackers with access to a Windows device to bypass Bitlocker encryption and access files. Microsoft is working on a permanent patch for the flaw (CVE-2026-45585) and has released temporary mitigation steps for companies to implement immediately.
Multiple vulnerabilities have been found in the GnuTLS library, a core component for secure communications. The flaws could allow attackers to cause a denial of service, access sensitive information, or potentially execute arbitrary code by sending specially crafted data during a DTLS handshake.
Ubuntu has patched several Linux kernel vulnerabilities, including two in its OverlayFS file system. These flaws could allow a local attacker to bypass permission checks and gain elevated privileges, potentially leading to unauthorized system control. Users should update their systems immediately to mitigate the risk.
A BeyondTrust report found that while Microsoft's total vulnerability count was stable in 2023, critical flaws doubled. Attackers are shifting focus from initial access to privilege escalation, using identity-based attacks to gain deeper control over systems. This trend highlights the growing importance of internal security controls.
Ubuntu has patched two vulnerabilities in the rsync utility. One flaw could allow a remote attacker to cause a denial of service, while another could let a local attacker overwrite files on systems with specific configurations. The issues affect recent versions of Ubuntu, including 22.04 and 24.04 LTS.
Microsoft has released a mitigation for a BitLocker security bypass vulnerability known as "YellowKey." The zero-day flaw, tracked as CVE-2026-45585, was publicly disclosed last week and carries a CVSS score of 6.8, affecting the Windows disk encryption feature.
A proof-of-concept exploit is now public for a high-severity Linux kernel vulnerability dubbed 'DirtyDecrypt.' The flaw allows a local user to gain root privileges on systems with the `rxgk` module enabled. Major distributions are affected, and patches are available. Teams should update their systems immediately.
Ubuntu has released a security update for the Linux kernel, fixing several vulnerabilities. The most critical flaw, known as Copy Fail, could allow a local attacker to escalate privileges or escape from a container. The patch also addresses issues in various other kernel subsystems to prevent system compromise.
Microsoft has uncovered a supply chain attack targeting the @antv npm ecosystem. Attackers compromised a maintainer's account to publish malicious versions of data-visualization packages. The code aims to steal credentials from CI/CD pipelines and affects widely used libraries like echarts-for-react.
Ubuntu has patched several vulnerabilities in the Linux kernel. One major flaw, known as 'Copy Fail,' could allow a local attacker to escalate privileges or escape a container. Other issues were found in subsystems like networking, cryptography, and I/O, which could also lead to system compromise.
A standard, cached AWS access key on a single machine, without any misconfiguration, can provide an attacker with extensive access to a company's cloud environment. This highlights how normal operational behavior can inadvertently create significant security vulnerabilities in cloud infrastructure.
Ubuntu has patched several vulnerabilities in the Linux kernel. A key flaw, dubbed "Copy Fail," could allow a local attacker to escalate privileges or escape a container. Other issues affect the cryptographic API, packet sockets, and TLS protocol, potentially leading to system compromise.
Verizon's latest Data Breach Investigations Report (DBIR) reveals a critical trend: exploiting unpatched vulnerabilities now accounts for 31% of initial breach access. The findings underscore a persistent and dangerous gap between when security fixes are released and when organizations actually apply them, leaving systems exposed.
Drupal has issued security updates for a highly critical vulnerability in its Core software, tracked as CVE-2026-9082. The flaw affects sites using a PostgreSQL database and could allow attackers to execute remote code, escalate privileges, or access sensitive information. Immediate patching is strongly recommended.
Ubuntu has released a security update for the Linux kernel used in Intel IoTG real-time systems. The patch addresses several vulnerabilities in the SMB network file system, Netfilter, and io_uring subsystems. If left unpatched, an attacker could potentially use these flaws to compromise an affected system.
Ubuntu has issued a security notice for multiple Linux kernel vulnerabilities. The update patches several flaws, including a critical issue in a cryptographic module dubbed "Copy Fail." This specific vulnerability could allow a local attacker to gain elevated privileges or potentially escape from a container environment.
A security researcher has released a proof-of-concept for a new zero-day vulnerability in Windows, codenamed MiniPlasma. The flaw affects fully patched systems and allows an attacker to gain the highest level of system privileges. The vulnerability exists in the Windows Cloud Files Mini Filter Driver.
A new exploit called YellowKey can bypass Windows 11's BitLocker full-disk encryption. Published by a security researcher, the attack works on default deployments but requires direct physical access to the target computer. The vulnerability affects systems that use a TPM to store decryption keys.
The SGLang AI framework has three critical vulnerabilities, including two for remote code execution. An attacker with network access can exploit them if the multimodal mode is enabled. The project maintainers have not responded, and no patch is currently available for these significant security flaws.
A new zero-day vulnerability in Microsoft Exchange, identified as CVE-2026-42897, is being actively exploited. The flaw is a cross-site scripting (XSS) issue that allows attackers to compromise Outlook Web Access (OWA) mailboxes. Microsoft has not yet released a patch to fix the vulnerability.
A Windows vulnerability in the Cloud Filter driver, thought to be patched six years ago, is still exploitable. A security researcher has demonstrated a new method to exploit the flaw, allowing an attacker to gain full SYSTEM-level privileges on an affected machine.
A critical security flaw in NGINX Plus and NGINX Open is being actively exploited in the wild, just days after it was disclosed. The vulnerability, CVE-2026-42945, is a heap buffer overflow affecting a wide range of NGINX versions from 0.6.27 through 1.30.0.
A spoofing vulnerability in Microsoft Exchange Outlook Web Access (OWA) is being actively exploited. The U.S. CISA is urging organizations to prioritize patching. Microsoft has released a fix and recommends enabling Extended Protection for Exchange Server (EEMS) to mitigate the significant risk.
A recently published guide demonstrates how a vulnerability in SAR2HTML version 3.2.1 can be exploited for remote code execution. The walkthrough, based on a TryHackMe challenge, shows how attackers can gain root privileges and full control over a target system by leveraging this specific software flaw.