[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentVulnerability Management
Paperclip AI Flaws Expose Servers to Host Command Attacks
Harmless-looking configuration files can quickly turn into a nightmare, as Oasis Security warns that Paperclip AI flaws can allow attackers to execute host commands, all by treating agent configuration as executable input. This vulnerability, including one flaw scored 10.0 by CVSS, can be exploited by unauthenticated actors to gain control of servers.
Veeam, HashiCorp, Django Patch Flaws
A critical security flaw, CVE-2026-16498, with a perfect CVSS score of 10.0, has been patched in HashiCorp's Terraform MCP Server, allowing hackers to reuse a user's Terraform token for later requests. This bug, now fixed in version 1.1.0, has also prompted patches from Veeam and Django.
Linux Flaw Exposes Local Users to Root via Open vSwitch
A newly discovered Linux flaw, CVE-2026-64531, lets local users potentially gain root access via Open vSwitch, even without an existing OVS bridge, running ovs-vswitchd, or host-level CAP_NET_ADMIN privileges. This vulnerability, with a CVSS score of 7.8, was quickly patched after being responsibly disclosed.
Gitea Flaw Exposes Server Files to Unauthenticated Attackers
A critical vulnerability, CVE-2026-59774, left self-hosted Gitea servers open to attack, allowing unauthenticated hackers to access sensitive files. Immediate action is required for self-hosted administrators to upgrade to version 1.27.1 and prevent exploitation.
TP-Link Omada ZTP Flaws Expose Networks to Remote Attacks
Critical flaws in TP-Link's Omada ZTP mechanism leave networks vulnerable to devastating remote attacks, including code execution, device hijacking, and eavesdropping. Forescout's Vedere Labs has discovered 15 vulnerabilities, now patched by TP-Link, that put small- to medium-sized businesses and enterprises at risk.
AI-Powered Vulnerability Discovery Surges, Threatens Patch Window
In a staggering two-month sprint, Palo Alto Networks' NOVA uncovered 14,090 confirmed vulnerabilities in just 3,915 open-source software projects - a remarkable demonstration of AI-powered vulnerability discovery's rapid impact. This autonomous pipeline is revolutionizing the way we identify and tackle software vulnerabilities.
Microsoft Boosts Bug Bounty Payouts to Record $20 Million
Microsoft just made it very rewarding to be a security researcher, shelling out a record $20 million in bug bounties to 562 talented individuals who helped the company squash vulnerabilities. That's a big jump from last year's $17 million, and a testament to the power of AI-driven security research!
cPanel Flaw Exposes Database Vulnerability to Authenticated Users
A critical cPanel flaw, CVE-2026-58048, with a near-perfect CVSS score of 9.4, allows authenticated users to execute SQL commands with root-level access, putting databases at risk. This vulnerability lets users with basic cPanel access escalate privileges and take control of the server's administrative database.
Fake Vulnerabilities Flood CVE Pipeline via AI-Generated Reports
The CVE pipeline is being flooded with fake vulnerability reports generated by AI, which are then assigned scores as high as 9.8, only to be later debunked as non-existent flaws. Security vendor JFrog recently uncovered six bogus SQLite vulnerabilities, highlighting the alarming ease with which unverified reports can enter the system.
Thermo Fisher Fixes Flaw Enabling Near-Undetectable DNA File Tampering
Thermo Fisher Scientific has patched a high-severity vulnerability in its Applied Biosystems human identification software that could have allowed nearly undetectable DNA file tampering, giving users a false sense of security. The company has implemented digital signatures to ensure data files remain authentic and trustworthy.
Big Tech Bolsters Open-Source AI as Attackers Target Vulnerabilities
Big tech giants like Nvidia, Amazon, and Google are joining forces to supercharge open-source AI, embracing a new era of transparency and collaboration. By adopting open-weight models, they're acknowledging that the future of AI safety lies in community-driven innovation and collective vigilance.
Rails patches Active Storage flaw with RCE potential
A critical vulnerability in Rails' Active Storage, known as CVE-2026-66066, can allow an unauthenticated attacker to read sensitive files and potentially execute remote code, putting your application at risk. This flaw can be exploited under specific conditions, making it crucial to patch immediately.
Adobe Patches CVSS 10.0 Flaw in Campaign Classic
Adobe has patched a critical flaw in Campaign Classic, a vulnerability rated 10.0 on the CVSS scale that could allow attackers to run malicious code without user interaction. This maximum-severity issue, tracked as CVE-2026-48449, enables arbitrary code execution with the privileges of the current user.
Researchers Expose 84 Vulnerabilities in 4G and 5G Core Networks
A shocking 84 previously unknown vulnerabilities have been discovered in widely used 4G and 5G core networks, all stemming from a single, critical flaw: implicit trust between core network functions. This fundamental weakness has left networks open to potential attacks, according to a recent study by Nanyang Technological University.
Google Accelerates Chrome Security Updates to Counter AI-Powered Attacks
Google's Chrome Security Team is stepping up the pace of security updates to outsmart AI-powered attacks, and it's making a big impact: in just three releases, Chrome 149-151, the team fixed a staggering 1,442 flaws, including a 13-year blind spot discovered with the help of Gemini.
CISA Issues Guidance on Open-Source Software Security Risks
The Cybersecurity and Infrastructure Security Agency is stepping up to help manage open-source software security risks with a new guidebook titled "Open Source Software: Security Principles and Practices". This move aims to enhance the nation's cybersecurity by providing federal agencies with essential security recommendations.
[SPONSOREDNUBIVANCE]
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
Broadcom Disrupts VMware with Emergency Patches for Critical Flaws
Broadcom has just released emergency security patches to tackle critical flaws in VMware's vCenter, ESX, Workstation, and Fusion - and it's urging admins to act fast, treating affected systems as immediately vulnerable. Three critical vulnerabilities, including CVE-2026-59309, CVE-2026-59310, and CVE-2026-47876, are among the five patched across these products and others that contain vCenter or ESX.
Google Leverages AI to Fix 1,072 Chrome Security Bugs
Google is supercharging Chrome's security with AI, and the results are staggering: a whopping 1,072 security bugs were squashed in Chrome 149 and 150, outpacing the total fixed in the previous 23 milestones combined. The tech giant is now using large language models to turbocharge its vulnerability management process, from sniffing out flaws to generating patches.
AI Applications Expose Widespread Security Vulnerabilities
A shocking 100% of AI applications tested harbored security vulnerabilities, with prompt injection flaws being the most common and damaging threat. This critical weakness, found in 28% of tested apps, highlights a glaring vulnerability that attackers are exploiting to manipulate model inputs.
Sysadmins' AI Expectations Unmet as Adoption Lags
Sysadmins' hopes for AI-driven automation have fallen short, with a significant gap between expected and actual adoption rates in critical areas like patch management, CPU/memory monitoring, and vulnerability prioritization. Despite comfort with AI's analytical capabilities, sysadmins remain cautious, aware that incorrect decisions can have serious consequences.
Google Patches 370 Chrome Vulnerabilities in Latest Update
Google's latest Chrome update is a major security boost, patching a whopping 370 vulnerabilities across Windows, Mac, and Linux builds to keep your browsing experience safe and secure. Kudos to the security researchers who helped Google identify and squash these bugs before they caused harm!
Microsoft Secure Boot Vulnerability Exposed After 13 Years
A shocking security vulnerability in Microsoft's Secure Boot, a safeguard designed to protect Windows and Linux devices from firmware infections, has been easily exploitable for 13 of its 14 years of existence. Researchers uncovered 11 defective firmware images, some dating back to 2013, that were still publicly available and signed by Microsoft, making it alarmingly simple to bypass the security measure.
US Government Accelerates Post-Quantum Cryptography Transition
The US government is taking a proactive approach to stay ahead of emerging threats by accelerating its transition to post-quantum cryptography, a critical step in safeguarding federal systems against advanced cryptographic attacks. A new Executive Order is driving this effort, requiring federal agencies to rapidly adopt this next-generation security measure.
Rails Flaw Exposes Server Files to Unauthenticated Attackers
A critical security flaw in Rails, known as CVE-2026-66066, could let hackers read sensitive files from your server, including secret keys, database passwords, and API tokens, by exploiting image uploads. This vulnerability affects various Rails releases, including versions 7.0.0 through 7.2.3.1, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3.