Microsoft has pulled the plug on the Windows Management Instrumentation Command-line (WMIC) tool, removing it from Windows 11 versions 24H2 and 25H2, and phasing it out from future updates. This move marks the end of an era for a utility that's been a favorite among cybercriminals.
GitLab has urgently patched a critical vulnerability that left public projects open to deletion by anyone, with no login required - a flaw that scored a near-perfect 9.4 on the severity scale. The fix addresses a GraphQL weakness that could let unauthenticated users remotely modify or delete public projects and user data.
In just five days, an AI-assisted commit introduced a workflow injection bug, and an AI attacker autonomously found and abused it, highlighting the vulnerability risks of relying on AI coding assistants. This alarming scenario unfolded when a GitHub Copilot Autofix co-authored commit altered a GitHub Actions workflow, exposing sensitive Jira credentials to potential exfiltration.
A single misstep in a Certificate Authority can have devastating consequences, as seen in CVE-2026-54121, aka Certighost, which allows a low-privileged domain user to escalate to full domain compromise. This shocking vulnerability exploits a little-known "chase" functionality in Active Directory Certificate Services.
A critical vulnerability in the popular User Profile Builder plugin has put over 40,000 WordPress sites at risk of admin takeover, with a CVSS rating of 9.8; site owners should immediately update to version 3.16.5 or later to patch the flaw.
Mark your calendars: Windows Server 2022 will reach the end of its mainstream support on October 13, 2026, and transition to extended support, where you'll still receive free monthly security updates until October 14, 2031.
Are your organization's secrets safe with AI? The Model Context Protocol's security flaws are exposing enterprise secrets, making it crucial to assess how well your sensitive information is protected when shared with MCP servers.
Microsoft's Exchange team is working on Cumulative Update 1 (CU1) for Exchange Server Subscription Edition, but has delayed its release due to an unexpected bug discovery driven by AI, leaving customers waiting a bit longer for the update that packs recent bug fixes, new features, and code refinements. The team promises it's on the way, but a new timeline isn't available just yet.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Microsoft just patched a nasty zero-day vulnerability, known as LegacyHive, that could let hackers gain administrator privileges on your Windows PC - but thankfully, it's now fixed in the August Patch Tuesday updates.
Researchers at Germany's Helmholtz Center for Information Security have uncovered a vulnerability in Loongson processors that allows data to leak from the L1 data cache, putting sensitive information at risk. This surprising discovery was made by fuzzing Loongson processors and tracing an "uncertain" state in a specific instruction back to its source.
Researchers have made a groundbreaking discovery, proving that commercially available RISC-V chips are vulnerable to devastating Spectre attacks, including Spectre-PHT, Spectre-BTB, Spectre-RSB, and Spectre-STL. They successfully demonstrated attacks with alarming accuracy, achieving up to 100% recall and over 97% precision.
The US government's quest to modernize the National Vulnerability Database is underway, and it's seeking your input - with an October 13 deadline to share innovative ideas on how to bring this critical cybersecurity resource into the automation age. NIST wants to hear your forward-looking perspectives on how to scale the NVD and supercharge its support for automated security workflows.
Adobe has patched critical vulnerabilities in ColdFusion, Commerce, and Campaign Classic, including a zero-day flaw with a perfect 10.0 CVSS score that could allow hackers to execute arbitrary code or escalate privileges. These high-severity flaws, including operating system command injection and eval injection, require immediate attention to prevent exploitation.
Microsoft's August Patch Tuesday update is a doozy, tackling a whopping 400 vulnerabilities, including an actively exploited zero-day threat that demands immediate attention from sysadmins. With high-risk impacts on confidentiality, integrity, and availability, these fixes should be top priority.
Microsoft just dropped a massive patch update to fix a whopping 398 security flaws in Windows and its software, including a critical vulnerability that's already being exploited by hackers. This crucial update tackles a range of weaknesses, from a zero-day privilege-escalation flaw in a key Windows driver to other publicly known vulnerabilities.
A recent incident in Australia revealed a shocking vulnerability in an API, uncovered by an AI agent working on behalf of a user named Andrew to book gym classes. The AI not only found a way to book classes weeks in advance, but also managed to bump Andrew to the top of a waitlist, leaving many to wonder how such a gaping hole in security went unnoticed.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A critical flaw in SAP Commerce Cloud, rated 10.0 on the CVSS scale, allows hackers to execute malicious code without any authentication, putting your entire system at risk. This severe vulnerability can be exploited with specially crafted input, making it essential to patch ASAP.
The National Institute for Standards and Technology is calling for a major revamp of its National Vulnerability Database to better tackle software vulnerabilities in the AI-driven era. It's seeking public input on how to modernize the database and its processes to stay ahead of emerging threats.
Microsoft's August Patch Tuesday update is a doozy, tackling a whopping 400 security flaws, including a zero-day vulnerability that's already being exploited by hackers. This massive release also includes fixes for two other zero-day vulnerabilities that were publicly disclosed.
Microsoft just dropped a crucial update, KB5120249, for Windows 10 versions 22H2 and 21H2, squashing security vulnerabilities and pesky bugs that could compromise your system. This August 2026 cumulative update tackles major issues like File History backup failures and expands Secure Boot certificate coverage.
Microsoft just dropped a massive security update, addressing a whopping 400 vulnerabilities with its August 2026 Patch Tuesday release - and it's a mandatory install to keep your system safe. You can grab the update via Windows Update or by downloading it directly from the Microsoft Update Catalog.
A security flaw in Cursor allowed hackers to run malicious commands on a developer's machine before they even had a chance to trust the repository, thanks to a vulnerability in its isolated worktree feature. Fortunately, a fix was swiftly rolled out just three days after Manifold Security reported the issue on July 20.
Mozilla swiftly responded to a security slip-up by revoking a Firefox GPG key after it was accidentally exposed in a private GitHub repository, and has since transitioned to a new key to ensure the integrity of its software. The move aims to prevent potential misuse and protect users, with measures also put in place to avoid similar incidents in the future.
Mozilla sprang into action after discovering a sensitive Firefox signing key had been mistakenly uploaded to a private GitHub repository, revoking the exposed key and implementing extra safeguards to prevent future mishaps. Fortunately, the company found no evidence that the key was compromised during its brief online exposure.