The Linux kernel is set for a major overhaul, with plans to cut support for dozens of outdated devices, including ancient network cards and legacy parallel-port hardware, freeing up thousands of lines of code and reducing the maintenance burden. This could slash nearly 30,000 lines of code, just from Ethernet device removals alone.
The impressive performance of Anthropic's Mythos in automated bug finding, which uncovered 271 Firefox flaws, has been called into question by Ari Herbert-Voss, who argues that open-source models can be just as effective. Herbert-Voss suggests that Mythos's success can be attributed to its ability to detect both simple and complex vulnerabilities, thanks to a phenomenon he terms "supralinear scaling".
Microsoft's latest update aimed at boosting Remote Desktop security may have an unintended consequence: a display-scaling bug that makes crucial security warnings hard to read or even unreadable. This glitch comes at a critical time, as the update was designed to protect against phishing attacks that exploit .rdp files.
The recent exposure of Anthropic's Claude Mythos highlights a chilling reality: AI tools designed to improve software quality can be easily repurposed to accelerate vulnerability discovery for malicious ends. This underscores the growing threat of AI-powered attacks, as malicious actors exploit commercial tools with minimal friction.
Apple just dropped an emergency update to squash a pesky iOS bug that let deleted messages linger on your device - and it's already patched in iOS 26.4.2 and iPadOS 26.4.2. The fix tackles a Notification Services flaw that allowed deleted alerts to persist, putting your private info at risk.
Researchers have uncovered four vulnerabilities in Microsoft's Windows Admin Center, exposing a dual attack surface in hybrid cloud tools that may be flying under your radar. If left unmonitored, this unmanaged attack surface can leave your organization vulnerable to potential threats.
The AI-powered Mythos model discovered a staggering number of vulnerabilities, including a 27-year-old bug in OpenBSD and a four-bug exploit chain that bypassed browser and OS defenses, with fewer than 1% of these vulnerabilities patched. This led Anthropic to delay a public release and share the findings with tech giants like Apple and Microsoft to prioritize patching.
Don't let your federal systems become an easy target: CISA is mandating the patching of the exploited BlueHammer flaw to prevent malicious cyber actors from gaining a foothold. A high-severity vulnerability in Microsoft Defender can allow low-privileged users to gain SYSTEM permissions - but a patch is available.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Apple has fixed a frustrating iOS flaw that was causing deleted Signal notifications to stick around, and you can get the solution by updating your iPhone or iPad to the latest software version. The update addresses a logging issue that allowed deleted notifications to be retained on the device.
Apple fixed a security flaw in its iOS system that was storing deleted notifications, and released emergency updates on April 22, 2026, to address the issue. The out-of-band fixes, available in iOS and iPadOS updates, ensure that deleted notifications are now properly erased from your device.
The UK government is stepping up its cyber defence game with a £90m funding boost to help small and medium-sized businesses bolster their cyber resilience and protect against growing online threats. This move aims to support organisations in implementing essential cyber security standards.
Microsoft just patched a critical bug in ASP.NET Core that could let hackers escalate their privileges and take control - and they've already released an out-of-band update to fix it. The flaw, tracked as CVE-2026-40372, carries a near-perfect CVSS score of 9.1, indicating a high severity threat.
A critical flaw in Terrarium's sandbox, rated 9.3 on the CVSS scale, allows attackers to break free from container constraints and execute code with root privileges. This alarming vulnerability, tracked as CVE-2026-5752, stems from a JavaScript prototype chain traversal that lets sandboxed code run amok on the host Node.js process.
Microsoft has patched a critical ASP.NET Core vulnerability, CVE-2026-40372, that allowed unauthenticated attackers to forge authentication cookies and gain SYSTEM privileges on affected devices. This fix addresses a flaw in the ASP.NET Core Data Protection cryptographic APIs that could be exploited for privilege escalation.
Mozilla's CTO, Bobby Holley, exclaims that AI-powered bug detection is a game-changer for security, giving defenders a decisive edge. This innovative technology, tested on Firefox releases, has already uncovered hundreds of vulnerabilities, outpacing traditional automated fuzzers and human researchers.
The French National Cybersecurity Agency is urging a proactive approach to post-quantum cryptography, warning that the transition to quantum-resistant algorithms is a long-term effort that must be initiated now. France has set a 2030 deadline for ministries to deploy post-quantum encryption for sensitive systems.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
A shocking 20,000 serial-to-IP converters are at risk of being hijacked due to newly discovered vulnerabilities, putting countless systems and data in jeopardy. Cybersecurity experts at Forescout Research Vedere Labs have uncovered 22 flaws in popular models from leading manufacturers Lantronix and Silex.
The game-changing AI system, Mythos, has made significant strides in vulnerability discovery, revealing software flaws with unprecedented depth - but does this progress signal a sigh of relief or a surge of concern for defenders? As automated discovery advances, it's clear that Mythos is a crucial step forward, not a sudden collapse of security efforts.
Google's Antigravity tool, designed to streamline coding, had a flaw that allowed hackers to run malicious code - but luckily, the tech giant has patched the vulnerability. This fix prevents cyber threats that could have exploited the tool's file-creation capabilities and lax input sanitization.
Imagine if the hum of internet chatter could predict the next big security threat - GreyNoise researchers have cracked the code, uncovering a pattern in network background noise that signals impending edge-device vulnerabilities. This breakthrough offers defenders a crucial early-warning system to stay ahead of emerging threats.
Imagine a world where AI models don't just help find software bugs, but actually behave like expert security researchers - that's the reality we're facing, and it's changing the vulnerability discovery game. Frontier AI models are now capable of autonomously discovering zero-day vulnerabilities and speeding up patching processes.
As AI-generated code becomes more prevalent, a pressing question emerges: how much attention should security teams give to code produced by artificial intelligence? The surprising answer: a lot, with 58% of organizations dedicating over 10 hours a month to securing it.
Microsoft has released an emergency update to fix a critical issue causing some Windows Server devices to get stuck in a restart loop after a recent update. This out-of-band update aims to quickly resolve the problem and prevent further disruptions.
A critical flaw in the Model Context Protocol could allow attackers to run malicious code across dependent machines, posing a remote code execution risk that ripples through the AI supply chain. This structural weakness, discovered by cybersecurity researchers, highlights a vulnerable link in the AI ecosystem.