Closed AI models are causing frustration for Linux bug researchers, with one expert likening them to a roadblock in the investigation process. Daniel Fox Franke, a principal security researcher, recently encountered repeated automated refusals while trying to track down a segmentation fault in ripgrep.
Imagine a seemingly harmless Word document that could secretly spread a malicious AI worm through Microsoft Copilot, replicating itself into new files and putting your data at risk. A security researcher has demonstrated just such a vulnerability, exposing a hidden threat that could propagate through everyday workflows.
Broadcom has patched critical VMware vCenter flaws, including a severe authentication-bypass vulnerability that could let hackers gain unauthorized access to your system. This game-changing flaw, rated 9.8 in severity, can be exploited by malicious actors with network access to wreak havoc on your VMware environment.
A critical vulnerability in Ruflo, known as RufRoot, allows hackers to execute code remotely without authentication, putting AI systems at risk. This severe flaw, rated 10.0 on the CVSS scale, affects all Ruflo versions before 3.16.3.
Microsoft just dropped a new update, KB5101684, for Windows 11, packing 42 bug fixes and snappy new features to take your experience to the next level. This July 2026 optional non-security preview release is a sneak peek at what's coming next in August's Patch Tuesday.
The arrival of AI models like Anthropic's Mythos is compressing exploit timelines, shrinking the window to patch vulnerabilities from weeks to just days or even hours. This acceleration exposes flaws in traditional prioritization methods, where only a handful of findings truly matter - out of 50,000, only a dozen make the cut.
New research reveals that vulnerabilities discovered using AI tools are being exploited at almost the same rate as those found through traditional methods, with a 1.3% exploitation rate for AI-discovered vulnerabilities. This challenges alarmist predictions of an impending AI-driven security crisis.
A newly discovered vulnerability in Gitea, rated 9.8 in severity, allows ordinary repository writers to execute shell commands as the Gitea service account by exploiting a remote code execution bug via a cleverly planted Git hook. This critical flaw, tracked as CVE-2026-60004, puts Gitea users at risk of a devastating attack.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Can AI models uncover weaknesses in centuries-old cryptographic algorithms? A new benchmark, CryptanalysisBench, puts large language models to the test, challenging them to discover real cryptanalytic attacks against historical and contemporary schemes.
An AI system has made a groundbreaking discovery, uncovering significant weaknesses in key encryption algorithms that even the experts didn't know existed. By working together with a human researcher, the AI was able to find a mathematical shortcut that halves the effective strength of HAWK, a digital-signature scheme being considered for post-quantum cryptography.
AI-assisted tools are supercharging vulnerability discovery, uncovering over 1,000 new defects in just six months, yet the rate of exploitation remains surprisingly steady, with only 1.3% of AI-discovered vulnerabilities being exploited in the wild. This finding challenges the notion that AI-discovered vulnerabilities are inherently more attractive to attackers.
Anthropic's Claude AI has made a groundbreaking discovery, cracking a post-quantum cryptography scheme in just three hours and 42 minutes on a 96-core server. The AI, specifically Mythos Preview, uncovered a hidden symmetry that paved the way for a direct key-recovery path.
AI agents are revolutionizing bug hunting, outperforming solo models with a staggering 90% success rate, and uncovering critical security holes in widely used open-source code. This breakthrough has significant implications for cybersecurity, with leading agentic systems like Wiz's Project Atlas and Microsoft's MDASH achieving double-digit gains over single-model competitors.
The hype around AI-assisted bug discovery may have been overstated, as a recent analysis found that only 1.3% of vulnerabilities identified with AI have been confirmed as exploited in the wild. This surprisingly low rate suggests that AI-assisted discovery may not be the silver bullet for uncovering easily exploitable vulnerabilities.
Researchers have uncovered a long-standing vulnerability in the Linux kernel, known as CVE-2026-53264, which allows a local user to gain root privileges by exploiting a flaw in the packet-scheduling code. This zero-day flaw was identified with the help of AI-assisted research and has since been patched.
A recent security researcher found that over 30% of server management interface passwords can be easily cracked using common wordlists and factory default patterns, exposing a massive 24,650 interfaces to potential threats. This startling vulnerability, CVE-2013-4786, allows hackers to gain unauthorized access to sensitive server management hardware.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
Researchers uncovered a disturbing vulnerability in Hugging Face's diffusers library, where three high-severity flaws allowed hackers to secretly execute malicious code through model repositories, bypassing built-in safeguards designed to prevent such threats. This alarming exploit highlights the urgent need for enhanced security measures in AI repositories.
OpenWrt has patched a critical DHCPv6 flaw, known as CVE-2026-53921, that could allow an unauthenticated attacker to execute root code by sending a crafted request to the DHCPv6 server. This severe vulnerability, rated 9.8 out of 10, highlights the importance of updating your OpenWrt setup to prevent potential security breaches.
A decades-old security flaw in Baseboard Management Controller (BMC) interfaces is putting over 24,000 internet-exposed servers at risk of password cracking, thanks to a vulnerability that allows attackers to capture and crack authentication responses. This two-decade-old weakness, tracked as CVE-2013-4786, is a pressing concern for server administrators.
Researchers have uncovered a significant Linux exploit, CVE-2026-53264, that can turn local users into root users, highlighting the importance of human judgement in AI-assisted security work. This flaw, patched in June 2026, shows AI still has limitations, emphasizing the need for human oversight.
The clock is ticking: with legacy technology, organisations know the risks, but lack a mechanism to spark change, leaving nations vulnerable to growing cyber threats. As exploits and AI evolve at breakneck speed, the window for protection is shrinking fast.
Microsoft's new AI model, MAI-Cyber-1-Flash, paired with GPT-5.4, has achieved a remarkable 95.95% vulnerability detection rate at nearly half the cost of its previous system. This game-changing tech, integrated into MDASH, is revolutionizing cybersecurity with faster and more affordable threat detection.
Beware of the Certighost exploit, a sneaky attack that lets hackers hijack Windows domains by manipulating machine account attributes and snagging authentication certificates. This vulnerability, tracked as CVE-2026-54121, was patched in July 2026, but not before security researchers publicly disclosed its technical details.
Microsoft just unveiled a game-changing AI-powered security model that has achieved a remarkable 95.95 percent success rate in identifying vulnerabilities, leaving the competition in the dust. This innovative model, combined with the MDASH harness, is poised to revolutionize bug hunting and cybersecurity.