Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
Fake PoCs, Real Malware: AI Cybersecurity Threats 2026 and GitHub Supply-Chain Defenses
Leiden researchers uncovered thousands of malware-laced GitHub exploit repositories. Explore findings, malware mechanics, and CISA-aligned defenses for AI agents and security teams.
Read Article
Second VeloCloud Zero-Day in Four Months: CVE-2026-93952 and the Escalating Pattern of AI Cybersecurity Threats in 2026
Arista patches CVE-2026-93952, a critical authentication-bypass flaw in VeloCloud Orchestrator On-Prem actively exploited alongside a summer command-injection bug. Exposure analysis, patch guidance, and what this means for AI-driven attack tempo.
AI Cybersecurity Threats 2026: Lessons from 2021's Most Exploited Flaws
Explore how 2021's top exploited vulnerabilities inform modern ai cybersecurity threats in 2026, covering AI agent security, patching priorities, and enterprise defenses.
CISA Warns of Active Plex2Shell Exploitation in Plex Media Server
CISA warns of active exploitation involving four Plex Media Server vulnerabilities. Learn which versions are affected and how operators can reduce risk.
CISA Confirms PHP2Shell Exploitation: Exposure and Patching Guidance
CISA added PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after reported remote code execution. What organizations should check and remediate.
What “AI General Intelligence” Means When You Test Cybersecurity
AI security benchmarks measure different abilities, from knowledge and exploit discovery to defense. Here’s how to interpret the results without mistaking one score for a verdict.
Securing the Next 250 Requires a Threats Vulnerabilities Assets Worksheet, Not a Bigger Patch Queue
CISA's "Securing the Next 250" campaign reframes Cybersecurity Awareness Month around generational resilience. A threats, vulnerabilities, and assets worksheet is the practical tool that bridges the gap between that ambition and daily engineering work.
Cisco Ships Emergency Fix for a Second Actively Exploited Secure Email Gateway Flaw
Cisco closed CVE-2026-76519, a high-severity zero-day in its Secure Email Gateway that lets unauthenticated attackers run commands on the underlying system. This is the latest in a string of exploited SEG bugs.
Microsoft’s .NET Hotfix Targets a Brotli Decoder Flaw With a Configuration Catch
Comprehensive coverage of Microsoft’s emergency .NET updates for CVE-2026-111497 (Broccoli2Shell / Node2Shell / HTTP2Shell), detailing the Brotli decoder vulnerability, configuration exposure requirements, version update matrix, and mitigation options.
AI Cybersecurity Lessons From the Brotli HTTP2Shell Flaw
HTTP2Shell shows why AI cybersecurity depends on disciplined vulnerability intelligence, dependency visibility, and fast patching—not automation alone.
PHP2Shell Is Now a Confirmed Exploit: What Security Teams Must Do
Confirmed PHP2Shell exploitation turns two PHP RCE flaws into an immediate patching and exposure-review priority. Here’s what the evidence and advisories mean for defenders.
AI Cybersecurity Threats 2026: When Fraudsters Stop Hacking and Start Calling
Attackers no longer need to break your perimeter. AI cybersecurity threats in 2026 weaponize help desks, deepfakes, and brand impersonation to exploit the one control that was never meant to defend itself: human trust.