[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongVulnerability Management
Google Suspends Open-Source Bug Bounty Program Amid AI-Generated Spam Surge
Google is hitting the pause button on its Open Source Software Vulnerability Rewards Program, temporarily stopping new product vulnerability submissions due to a surge in AI-generated spam. This change doesn't affect existing reports or supply chain submissions.
Mythos Exposes New Vulnerability in Rejetto HTTP File Server
A critical vulnerability, CVE-2026-61500, has been uncovered in Rejetto HTTP File Server (HFS), allowing for full administrator access and remote code execution. This flaw was discovered using Anthropic's bug-hunting model Mythos and can be exploited with alarming ease.
Dell CSM Flaws Expose Kubernetes Nodes to Unauthenticated Admin Access
A critical vulnerability in Dell CSM, known as CVE-2026-63688, allows attackers to completely bypass security measures and gain unrestricted administrative control over storage infrastructure. This flaw leaves Kubernetes nodes open to unauthenticated admin access, putting your entire storage system at risk.
GitLab Fixes 9.9 Flaw in AI Gateway That Enables Command Execution
GitLab has patched a critical 9.9-rated flaw in its AI Gateway that allowed attackers to execute commands, giving logged-in users with access to the Duo Agent Platform the potential to wreak havoc. This fix comes courtesy of HackerOne reporter invisiblemeerkat, who identified the vulnerability.
GitLab patches RCE flaw in AI Gateway service
GitLab has patched a critical remote-code-execution flaw in its AI Gateway service, known as CVE-2026-90970, which could have allowed attackers to run arbitrary commands on vulnerable instances. Even users with basic privileges could exploit this vulnerability, making it essential to apply the patch ASAP.
Dell Urges Admins to Patch CSM Flaws Exploiting Authorization Controls
Dell is urging admins to patch two critical CSM flaws, CVE-2026-63688 and CVE-2026-63692, that allow unauthenticated attackers to gain complete control over storage resources, potentially leading to unauthorized access and manipulation. These maximum-severity vulnerabilities can be exploited to bypass authorization controls and access sensitive storage backend administrator credentials.
Kiteworks Fixes Code Injection Flaw in Email Protection Gateway
Kiteworks has patched a critical vulnerability in its Email Protection Gateway that could have allowed hackers to take full control of the system, and it's essential to update your software ASAP to avoid potential threats. This max-severity flaw, tracked as CVE-2026-54154, could be exploited through low-complexity attacks that require no user interaction.
CISA Warns of Pre-Auth Flaw in MikroTik RouterOS
A critical vulnerability in MikroTik RouterOS, known as CVE-2026-84411, can be exploited with a single crafted request, allowing attackers to execute code with root privileges or cause a denial-of-service condition, even without authentication. This flaw puts your network at risk, and it's essential to take immediate action to protect yourself.
AI-Discovered Vulnerabilities Skew Toward Remote Code Execution
Stay ahead of potential threats: with AI-discovered vulnerabilities, remote code execution is a growing concern, making it crucial to examine your systems for compromise before upgrading or patching. NetScaler customers, in particular, should prioritize checking their systems for signs of exploitation.
TeamViewer Warns Users to Patch Flaws Amid Remote Code Execution Risk
TeamViewer is urging users to update to the latest version immediately due to a critical security risk that could allow hackers to take control of your device. A high-severity flaw, CVE-2026-92370, and four others have been identified, highlighting the urgent need for an update to protect against remote code execution attacks.
OpenSSL Discloses High-Severity DTLS Flaw That Leaks Heap Memory
A newly discovered OpenSSL flaw, CVE-2026-84782, can cause serious problems, leaking sensitive heap memory or even crashing your program, putting your data at risk. Fortunately, OpenSSL has released fixes to patch this high-severity DTLS vulnerability.
UK Businesses Expose Gaps in Basic Cyber Skills
The UK is facing a wake-up call: over half of its businesses lack confidence in their basic cyber skills, leaving them vulnerable to breaches and slow to recover. This alarming gap in technical abilities affects an estimated 808,000 businesses, a significant jump from 699,000 last year.
Spectre Revives: Researchers Expose New JIT Engine Vulnerability
Meet Branch Target Reuse (BTR), a revived Spectre v2 attack that targets JIT engines, allowing hackers to exploit a major vulnerability in many CPUs that use speculative execution. This breakthrough lets attackers siphon sensitive data, like root password hashes, at alarming rates of up to 5.7 KB/sec.
New Spectre Variant BTR Exploits Linux Memory Despite Existing Defenses
Meet Branch Target Reuse (BTR), a new Spectre variant that cleverly exploits Linux memory, dodging existing defenses and leaving multiple JIT engines and the Linux kernel vulnerable. This sneaky attack uses a four-step sequence to tap into the CPU's indirect branch prediction structures.
Kiteworks Fixes Vulnerability During Precautionary Shutdown
When customer data is on the line, Kiteworks chooses certainty over convenience - that's why they took a proactive nine-hour shutdown to safeguard against a potential cyber attack, collaborating with federal authorities to swiftly identify and fix a vulnerability. By prioritizing data security, they ensured their customers' protection, and quickly got back up and running.
AWS Credentials at Risk as Flaws in Amazon Bedrock AgentCore Expose Command Execution
A shocking vulnerability in Amazon Bedrock's AgentCore Python SDK could have put your AWS credentials at risk, allowing hackers to execute commands and access sensitive data. A simple crafted package name was all it took to bypass security measures and get commands running inside the Code Interpreter sandbox.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Kubernetes Operators Expose Hidden Security Risks
A recent discovery revealed that Kubernetes Operators, like IBM Turbonomic, can harbor hidden security risks, including granting excessive access to sensitive cluster data, putting administrative tokens and credentials at risk. Meet OperTraitor, an innovative, open-source tool that helps you uncover these threats by analyzing operator permissions and identifying potential security gaps.
Kiteworks Patches Flaw, Restores Systems After Intelligence Warning
Kiteworks has patched a critical flaw and lifted its shutdown advisory, confirming that its systems and customer environments show no signs of compromise or suspicious activity. With the threat neutralized, customers can now safely bring their hosted systems back online.
MCP Python SDK Flaw Exposes OAuth Credentials to Malicious Servers
A shocking flaw in the MCP Python SDK leaves OAuth credentials vulnerable to malicious servers, allowing hackers to steal sensitive data with a simple trick. Without a crucial security setting, the SDK can be easily duped into sending login info to the wrong server.
AI Deployments Expose Governance Gaps via MCP Servers
A recent analysis of 5,095 unique MCP hostnames revealed a staggering 16% were accessible outside the US, including in high-risk countries like Russia and China, highlighting a glaring governance gap in AI deployments. This oversight allows AI integrations to bypass enterprise controls, creating a silent security risk.
CISA Mandates Patching of Exploited Citrix Flaws
The US government has stepped in, mandating that federal agencies patch two critical Citrix flaws by September 30 to prevent exploitation by malicious actors. This swift action follows the discovery of over 23,000 Internet-facing IP addresses vulnerable to these Citrix NetScaler flaws.
Microsoft Halts KB5002907 Update Amid Office License Issues
Microsoft has hit the pause button on the KB5002907 update due to issues with Office licenses, and is currently investigating the problem. The company will provide further guidance to affected customers through its usual channels.
Salesforce Vulnerabilities Expose CRM Data to Zero-Click Attacks
Meet SalesBleed, a trio of security flaws in Salesforce Agentforce that allowed hackers to hijack AI agents, steal sensitive CRM data, and send phishing messages - all without a single click. These vulnerabilities exposed the power of unchecked AI, as one expert warned: it's a lesson in what it takes to keep AI agents contained.
OnePlus Devices Exposed to Root Exploit via Unpatched Flaws
OnePlus has come under fire for telling a security researcher that revealing details of two major flaws in its OxygenOS phones without permission could lead to legal action, despite confirming the issues in May and promising a fix. The company claims European cybersecurity rules give it the exclusive right to decide when to disclose vulnerabilities.