Legacy infrastructure can put your AI agents at risk of hijacking, as seen with CVE-2025-24813, a remote code execution flaw that lets attackers turn a routine server compromise into a full takeover. An unpatched Internet-facing Apache Tomcat server is all it takes to expose your enterprise to this threat.
Millions of iPhones are vulnerable to a newly discovered BootROM exploit, known as "usbliter8", that can't be fixed with software updates because it's embedded in the device's hardware. This means iPhones with A12 and A13 processors will be at risk for the rest of their lifespan.
Microsoft just revealed a frustrating glitch in the Recycle Bin that displays a confusing filename when you permanently delete an item, showing a cryptic code instead of the file's original name. Luckily, the issue only affects the deletion confirmation dialog and doesn't change the file's name in the Recycle Bin or when it's restored.
Discover and remediate code vulnerabilities with ease using AWS Continuum, a game-changing platform that streamlines vulnerability management with AI-powered recommendations and automated remediation. With Continuum, you can gain confidence in your security posture and automate fixes based on your own risk profiles and priorities.
F5 has issued urgent security updates for NGINX products after discovering two critical flaws, CVE-2026-42530 and CVE-2026-42055, that could allow remote code execution. These vulnerabilities, rated 9.2 on the CVSS v4 scale, pose a significant threat and require immediate attention to prevent exploitation.
Google's security team initially praised researcher Justin O'Leary for uncovering a high-severity flaw, dubbed ConfigConfusion, in the Config Connector add-on for Kubernetes - only to later claim it wasn't a vulnerability at all and deny a bug bounty. The issue still lingers, leaving users of the open-source tool potentially exposed.
Apple just patched a major flaw in its Beats Studio Buds that allowed hackers within Bluetooth range to eavesdrop on conversations through the earbuds' microphone, even if they weren't paired with the device. The company has released a security update, Beats Firmware Update 1B211, to fix the issue.
F5 has urgently released patches to fix two critical vulnerabilities in NGINX modules that can be exploited by remote attackers to cause denial-of-service or even execute remote code. Admins are advised to install the updates ASAP to protect NGINX Plus, Open Source, Gateway Fabric, and Instance Manager from potential attacks.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
Microsoft has fixed a frustrating issue that caused June's security update to fail installation on some Windows Server 2016 devices, resolving the error code 0x80070002 (ERROR_FILE_NOT_FOUND) problem that had administrators scratching their heads. The update should now install smoothly on affected servers.
Cisco has urgently warned organizations using its Catalyst SD-WAN products to investigate their exposure to network compromise and hunt for malicious activity following a maximum-severity bug. This critical alert was issued after Cisco expanded its advisory to include the Cisco Catalyst SD-WAN Validator, which is vulnerable to a 10.0 improper-authentication exploit.
Homebrew just got a major security boost with its 6.0 release, introducing a new security mechanism and Linux sandbox to keep things safe and secure. This latest update, which landed on June 17, 2026, promises even more under the hood.
Despite pouring resources into security tools for better visibility, many teams still struggle to turn insights into action, leaving them overwhelmed by endless findings with unclear priorities. It's time to bridge the gap between detection and response to truly fortify digital defenses.
Microsoft is investigating a frustrating issue that prevents some third-party apps from launching Office applications or opening documents after installing recent Windows updates. This problem, affecting Word, Excel, PowerPoint, and more, leaves users unable to access their files or work smoothly.
Did you know that 60% of organizations have at least one HTTP panel exposed to the internet, leaving them vulnerable to rapid exploitation by cyber attackers? In today's threat landscape, this kind of exposure can turn into a security breach in just 24 hours.
Don't wait until it's too late - CISA is requiring Federal agencies to patch a critical Joomla plugin flaw by Friday, as hackers can exploit it to upload and execute malicious PHP code. The vulnerability, found in the Widget Factory Joomla Content Editor, allows unauthenticated users to create new editor profiles and poses significant risks to your online security.
Researchers uncovered over 30 security patches for Anthropic's Claude Code in just two months, revealing a concerning pattern of brief, often silent vulnerabilities as AI models are rapidly updated. This finding highlights the need for greater transparency and scrutiny in the high-stakes world of AI model security.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
A newly discovered flaw in the Google Vertex AI SDK for Python left model uploads vulnerable to hijacking, allowing attackers to swap models and execute code within Google's serving infrastructure in a matter of seconds. This vulnerability, found by Palo Alto Networks Unit 42, could be exploited in just 2.5 seconds - a window of opportunity for attackers to wreak havoc.
A recent vulnerability in Google Cloud's Vertex AI Python SDK left the door open for cross-tenant attacks, allowing hackers in separate projects to hijack model uploads and potentially execute malicious code remotely. This flaw was fortunately patched in version 1.148.0, released on April 15, 2026.
Experts warn that without standardized AI model inventories, we risk a chaotic "fire, ready, aim" approach, where multiple incompatible solutions create more cyber threats than they mitigate. A new policy paper proposes an AI bill of materials (AIBOM) as a crucial step towards reducing cyber risk and improving transparency.
Meet Athena, a groundbreaking coalition and platform that helps safeguard open-source software from AI-driven threats by streamlining vulnerability detection, private remediation, and coordinated disclosure. By joining forces, Athena members can proactively protect the entire open-source ecosystem from emerging risks.
Cisco has warned of a critical vulnerability in its SD-WAN system that allows attackers to gain root access by sending a malicious HTTP request. This flaw, now patched, could have let hackers create or overwrite files and ultimately elevate their privileges.
A critical vulnerability in SimpleHelp, known as CVE-2026-48558, lets hackers create rogue remote support accounts and gain privileged access to servers, allowing them to execute scripts and wreak havoc on your system. This gaping security hole enables unauthenticated attackers to bypass multi-factor authentication and log in as a Technician user, putting your entire network at risk.
A shocking vulnerability chain in LiteLLM has been discovered, allowing hackers to hijack servers with just a low-privilege account, and experts warn it's a critical threat with a near-perfect CVSS score of 9.9. By chaining three distinct bugs, attackers can escalate their access to full admin rights and run code on the server.
By empowering teams to build their own AI-powered tooling and iterate on the best approaches, the Government Cyber Coordination Centre (GC3) successfully uncovered over 400 vulnerabilities in a series of innovative hackathons. This collaborative, flexible approach allowed teams to create bespoke solutions that effectively scanned public code repositories across nine government departments.