Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
Check Point links VPN zero-day attacks to Qilin ransomware gang
Israeli cybersecurity company Check Point has released security updates to patch a critical flaw affecting Remote Access VPN and Mobile Access deployments, which was exploited in zero-day attacks linked to the Qilin ransomware gang.
Max Severity Ivanti Sentry Vulnerability Now Exploited in Attacks
Attackers are now targeting CVE-2026-10520, a recently patched maximum-severity flaw in Ivanti Sentry that allows remote code execution with root privileges on Internet-exposed secure mobile gateways.
AI Accelerates Vulnerability Discovery: Record 206 CVEs on Patch Tuesday Signal New Normal
Artificial intelligence is transforming the cybersecurity landscape by dramatically accelerating the speed and scale of vulnerability discovery, as evidenced by Microsoft's June 2026 Patch Tuesday which addressed a record-breaking 206 vulnerabilities. This unprecedented volume signals that voluminous patch updates could soon become the norm.
Patch Tuesday Just Exposed How Broken Windows Security Really Is
Microsoft patched three zero-days on Tuesday—two that hand attackers SYSTEM access, one that opens BitLocker drives. But the real story is what came after: a researcher named Nightmare Eclipse kept leaking exploits because Microsoft wouldn't listen.
Copilot SearchLeak Attack: A Critical Three-Stage Vulnerability Patched
A critical three-stage attack exploiting Microsoft 365 Copilot's search functionality allowed 1-click data theft. Learn how the SearchLeak vulnerability worked and what defenders need to know about this new wave of AI prompt-injection issues.
Trivial RCE in AMD AutoUpdate Software Due to HTTP Downloads and Missing Signature Verification
A detailed analysis of CVE-2026-40677: How AMD's AutoUpdate software allowed Remote Code Execution through unencrypted HTTP downloads without cryptographic signature verification, and the controversial 124-day embargo period.
Oracle PeopleSoft RCE Vulnerability CVE-2026-35273: Emergency Alert for Zero-Day Exploited by ShinyHunters
Critical unauthenticated remote code execution flaw (CVSS 9.8) in Oracle PeopleSoft PeopleTools actively exploited by ShinyHunters extortion gang targeting 300+ instances across 100+ organizations.
Langflow Path Traversal Vulnerability CVE-2026-5027 Actively Exploited in Attacks
Attackers are actively exploiting a high-severity path traversal vulnerability in Langflow, the popular AI development platform. The flaw allows unauthenticated attackers to write arbitrary files on exposed servers, potentially leading to remote code execution. This article details the vulnerability, its exploitation timeline, and necessary mitigation steps.