Tag: vulnerability
-
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/
-
Mythos Vulnerability Firehose Hits a Human Bottleneck
Tags: vulnerabilityAn analysis of Project Glasswing findings shows only a fraction have reached disclosure, and an even smaller number have been fixed. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/mythos-vulnerability-firehose-hits-human-bottleneck
-
4 groups caught using the same Chrome and Windows exploit kit
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2026/09/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/
-
4 groups caught using the same Chrome and Windows exploit kit
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2026/09/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/
-
4 groups caught using the same Chrome and Windows exploit kit
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2026/09/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/
-
Microsoft’s September Patch Tuesday Fixes Nearly 1,000 Flaws, Including 2 Exploited Zero-Days
Microsoft’s September 2026 Patch Tuesday fixes nearly 1,000 vulnerabilities, including two Windows zero-days already exploited in attacks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-microsoft-september-2026-patch-tuesday-zero-days/
-
MDR Services
Cyberattacks are becoming more persistent, automated, and difficult to manage with traditional security tools alone. Organizations may have firewalls, endpoint protection, vulnerability scanners, identity security, cloud security, and other technologies in place, yet still struggle to determine which alerts represent… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/mdr-services/
-
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome.The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo, First seen on thehackernews.com Jump to…
-
A New AI Vulnerability Exposes the Security Gap That PQC Won’t Fix
In a previous article, we discussed why PQC compliance does not equal architectural resilience. In this post, we’ll explore why organizations must be prepared to protect identity, context, communications, and paths not merely ciphertext. What a New AI Vulnerability… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/a-new-ai-vulnerability-exposes-the-security-gap-that-pqc-wont-fix/
-
Zero Day Initiative (ZDI) von TrendAI fast den Rekord-Patchday von September zusammen
Rekord-Patchday September 2026: Microsoft behebt fast 1.000 CVEs, Adobe 172 Lücken. Zero-Days und 20 potenziell wormable Schwachstellen im Fokus. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/zero-day-initiative-zdi-von-trendai-fast-den-rekord-patchday-von-september-zusammen/a46368/
-
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/fmc-ongoing-exploitation/
-
Windows 11 cumulative updates KB5124008 & KB5122880 released
Microsoft has released Windows 11 KB5124008 and KB5122880 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-cumulative-updates-kb5124008-and-kb5122880-released/
-
What Benchmark Data Says About Deterministic SAST and Agentic Code Scanning
Much of the debate about agentic code scanning revolves around three core questions: Do more capable models find more vulnerabilities? Where does deterministic, rules-based SAST still fit? What does the cost and performance balance look like? We ran two benchmarks… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/what-benchmark-data-says-about-deterministic-sast-and-agentic-code-scanning/
-
What Benchmark Data Says About Deterministic SAST and Agentic Code Scanning
Much of the debate about agentic code scanning revolves around three core questions: Do more capable models find more vulnerabilities? Where does deterministic, rules-based SAST still fit? What does the cost and performance balance look like? We ran two benchmarks… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/what-benchmark-data-says-about-deterministic-sast-and-agentic-code-scanning/
-
SAP warns of maximum severity ‘OVERPASS’ kernel vulnerability
SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/
-
Daily OT Security News: September 08, 2026
Today’s verified developments cover critical vulnerabilities, exploit chains, AI-assisted PLC research, federal incident-reporting fragmentation, and a major mobile security release, items that affect IoT, OT, ICS, CPS, industrial and critical”‘infrastructure operations, and connected devices. N-able Patches Critical Zero-Day in… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/daily-ot-security-news-september-08-2026/
-
Daily OT Security News: September 08, 2026
Daily OT Security News, September 08, 2026. Concise operational summaries of the latest OT/ICS cybersecurity developments. MikroTik patches actively exploited RouterOS attack chain MikroTik released fixes for six RouterOS vulnerabilities after CERT Poland confirmed two flaws, collectively dubbed MikroTrick,… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/daily-ot-security-news-september-08-2026-2/
-
Threat actors are giving AI agents a bigger role in cyberattacks
AI agents are automating parts of cyberattacks with less human involvement, including vulnerability scanning, credential harvesting, and troubleshooting, according to Google … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/08/ai-agents-cyberattacks-automation-google-research/
-
>>Zero-click<< WeChat worm could hijack accounts and spread via a single call
Researchers with security company Calif have discovered, weaponized, and privately reported to Tencent a critical vulnerability that allowed them to create … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/08/wechat-weworm-vulnerability-exploit-account-hijacking/
-
AI Could Shrink the Supply of Exploits Governments Rely On
AI could accelerate vulnerability discovery, shrinking the pool of exploits governments rely on while speeding up the race between attackers and defenders. The post AI Could Shrink the Supply of Exploits Governments Rely On appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-ai-government-hackers-vulnerability-discovery/
-
Adobe fixes critical Magento zero-day exploited to backdoor servers
Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/
-
Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests
Boston, MA, USA, September 8th, 2026, CyberNewswire Specialized team of AI agents that discover, attack, and validate web vulnerabilities, leveraging pre-existing site context to eliminate noise and speed remediation. Reflectiz, the continuous web exposure management company, today launched a multi-agent penetration testing platform for websites. Multiple specialized AI agents discover, attack, and validate vulnerabilities across…
-
Black Duck Joins Project Glasswing to Strengthen AI-Era Software Security
Black Duck, a provider of AI-powered application security solutions, has announced its participation in Project Glasswing, Anthropic’s industry-wide initiative aimed at protecting critical software infrastructure through the defensive use of advanced AI. Through its involvement, Black Duck will integrate Mythos throughout its application security offerings, pairing AI-driven, deterministic vulnerability detection with established remediation processes, risk-based…
-
Attack Chaining: When Low-Severity Vulnerabilities Combine into High-Risk Attack Paths
Your backlog is full of low- and medium-severity vulnerabilities nobody is planning to fix. A profile page leaking information. A reset endpoint with no rate limit. A form missing a CSRF check. These are all medium-severity issues which are reasonable… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/attack-chaining-when-low-severity-vulnerabilities-combine-into-high-risk-attack-paths/
-
Bug Bounty vs Penetration Testing: What the Data Shows
Key TakeawaysHackerOne’s own data shows the average pentest surfaces 12 vulnerabilities with 16 percent rated high or critical, while bug bounty programs average a higher 25 percent high or critical rate.Pentests tend to surface more systemic and architectural issues, like… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/bug-bounty-vs-penetration-testing-what-the-data-shows/
-
ASUS Control Center Critical Flaw Allows Unauthenticated Attackers to Gain Root Access
ASUS has released a security update for the Control Center Express Agent to address CVE-2026-19397, a high-severity vulnerability related to missing authentication. This vulnerability allows an unauthenticated nearby attacker to potentially take control of an affected host through a direct connection to the agent. The issue affects versions before 1.7.24 and was published and updated…
-
SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws
SAP released 19 new Security Notes addressing four critical vulnerabilities and 15 additional flaws throughout its enterprise portfolio. The vendor also updated one note from August. The most urgent issue is CVE-2026-44756, a memory-corruption vulnerability in Extended Passport (EPP) Processing with a CVSS score of 10.0. This flaw affects numerous SAP Kernel and Web Dispatcher…
-
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe”¯Commerce and”¯Magento Open Source that has come under active exploitation in the wild.The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.”This update resolves a critical First seen on thehackernews.com…
-
Mathspace breach exposes data on over a million students and parents
Mathspace has confirmed that attackers broke into its internal reporting system through an unpatched Metabase vulnerability and stole data belonging to more than a million … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/08/mathspace-data-breach-metabase-vulnerability/