Tag: vulnerability management
685 articles
Cisco Disrupts Active Exploitation of SD-WAN Manager Flaw
Cisco is taking swift action to combat the active exploitation of a medium-severity flaw in its SD-WAN Manager, known as CVE-2026-20262, which could let hackers create or overwrite files on affected systems. Federal agencies have until June 29, 2026 to remediate the vulnerability.
Microsoft Fixes Firmware Flaw in Surface Devices That Allowed Bricking via Single Packet
A security researcher discovered that a routine attempt to adjust the backlight on a Surface laptop turned into a nightmare when Microsoft Copilot generated a Python script that overwrote the embedded controller firmware, rendering the machine useless. The script sent faulty commands to the device's microcontroller, highlighting a serious firmware flaw that Microsoft has now fixed.
Microsoft Fixes Flaw in Surface Hardware That Allowed Devices to Be Bricked
A security researcher recently discovered that Microsoft's Copilot AI tool could be used to create a series of aggressive Python scripts that accidentally bricked a Surface device by overwriting its firmware. The incident highlights a flaw in Microsoft's Surface hardware that has since been fixed.
CISA Mandates Patching of Actively Exploited Ivanti Flaw
Federal agencies are on high alert: a severe vulnerability in Ivanti's Sentry gateway, already exploited by attackers, must be patched within three days to prevent further backdoor attacks. CISA's urgent directive demands swift action to secure vulnerable devices and shield against malicious cyber threats.
OpenClaw AI Agent Exposes Sensitive Data to Hidden Attacks
A critical vulnerability in OpenClaw AI, known as OpenClaw 2026.4.23, allowed hackers to hide malicious instructions within shared contacts, vCards, or location pins, which the AI agent then obediently followed. This shocking security flaw was recently patched, but highlights the importance of staying vigilant against emerging threats.
CISA Overhauls Vulnerability Patching with Risk-Based Approach
CISA is shaking up vulnerability patching with a risk-based approach, urging agencies and private operators to focus on high-risk areas first. This new directive ditches rigid deadlines based on severity labels, instead tying remediation timelines to assessed risk.
CISA Mandates Swift Patching of Exploited Flaws Within 3 Days
The US Cybersecurity and Infrastructure Security Agency (CISA) is now requiring federal agencies to patch high-risk vulnerabilities within just three days to significantly reduce the threat of cyberattacks. This new directive aims to slash the time attackers have to exploit weaknesses, protecting the public sector from potential breaches.
Vulnerability Management Collapses as AI Compresses Attack Window
In just one month, AI-powered vulnerability management uncovered over 10,000 high-risk flaws in critical software, revealing a staggering new reality: AI has dramatically compressed the attack window, making traditional vulnerability management nearly obsolete.
GitHub Disrupts Supply Chain Attacks by Blocking npm Install Scripts
GitHub is taking a bold step to safeguard the npm ecosystem by blocking install scripts from running by default, tackling the single largest code-execution surface in the ecosystem. This move, part of npm 12's release, aims to prevent supply chain attacks by requiring explicit permission for scripts to run.
GitHub Bolsters npm Security to Thwart Supply-Chain Attacks
GitHub's upcoming npm v12 update is a game-changer for supply-chain security, as it will require explicit approval for automated actions like install scripts and dependency resolution that are often exploited by attackers. This move aims to shut down common code-execution paths and give developers, CI/CD pipelines, and security teams greater control over their code.
GitHub Overhauls npm Defaults to Thwart Script-Based Attacks
GitHub is taking a major step to boost npm security by changing its default settings to block automatic execution of install-time lifecycle scripts, a common vulnerability exploited in script-based attacks. Starting with npm 12, these scripts will require explicit permission to run, unless explicitly allowed via a new allowlist mechanism.
Ivanti Warns of Critical Bugs in Sentry Software, Urges Immediate Patching
Ivanti is urging Sentry customers to patch immediately due to critical bugs affecting versions 10.0 and 9.9, and it's crucial to act now to avoid potential security risks. Don't delay - apply the necessary patches to keep your system secure.
Microsoft Patch Tuesday Disrupts 206 Vulnerabilities, Including Zero-Days
Microsoft just dropped a massive Patch Tuesday update, fixing a record 206 security vulnerabilities in its software - including three already publicly known flaws - to keep your digital world safe and secure. This critical update tackles a wide range of threats, from remote code execution and privilege escalation to spoofing and more.
Microsoft Fixes Zero-Days in June Patch Tuesday Update
Microsoft just dropped some critical patches in its June update, fixing three zero-day vulnerabilities that left Windows systems open to attacks - and one security researcher isn't happy about the delayed fix. The update squashes bugs that allowed hackers to escalate privileges or bypass disk encryption.
CISA Directive Overhauls Cyber Risk Prioritization Across Agencies
The Cybersecurity and Infrastructure Security Agency is shaking up its approach to cyber risk with a new directive that prioritizes impact over raw vulnerability counts, helping agencies focus on protecting what matters most. Acting director Nick Andersen urges a pragmatic approach, acknowledging that some systems are more critical than others.
Microsoft Patch Tuesday Disrupts 200 Vulnerabilities, Zero-Day Exploits
Microsoft's June Patch Tuesday update is a doozy, tackling a whopping 200 vulnerabilities, including three zero-day exploits and 33 critical flaws that could lead to remote code execution. This crucial update aims to prevent a range of issues, from denial-of-service attacks to elevation of privilege and information disclosure.
ServiceNow Warns of Flaw Exploited for Unauthorized Access
ServiceNow has issued a security update to fix a flaw that could allow unauthorized users to gain excessive access to customer instances, and the company is urging users to take action to protect their systems. The update was applied to hosted customer instances on June 5, 2026.
Protobuf.js Vulnerabilities Expose Node.js Apps to Code Execution, DoS
A single malicious protobuf schema could be all it takes to trigger crashes, corrupt runtimes, or even execute code in vulnerable Node.js apps, warns Cyera security researcher Assaf Morag. Six newly identified vulnerabilities in protobuf.js, known as Proto6, carry high severity scores and could put your app at risk.
Microsoft Patch Tuesday Release Sets Record with 206 CVEs Addressed
Microsoft just dropped a record-breaking Patch Tuesday update, fixing a whopping 206 vulnerabilities across its products - including 38 critical ones. This massive release surpasses previous months and confirms a trend towards larger updates, raising both relief and concern among security experts.
CISA Overhauls Risk Prioritization Approach for Federal Agencies, Private Sector
CISA is shaking up its approach to risk prioritization, urging a smarter strategy for applying patches and tackling vulnerabilities. Acting director Nick Andersen emphasizes the need to focus on what matters most, rather than rushing to apply every patch as soon as it's released.
Microsoft Patch Tuesday Update Sets Record with 206 Vulnerabilities Fixed
Microsoft just dropped a record-breaking Patch Tuesday update, fixing a staggering 206 vulnerabilities in a single swoop - a move that's both impressive and concerning. This massive update is part of a larger trend, with nearly half of this year's patches containing triple-digit numbers of fixes.
SAP Patches Critical Flaws in NetWeaver and Commerce Cloud
SAP has patched 15 vulnerabilities, including four critical flaws in NetWeaver and Commerce Cloud, to safeguard its core application platform and e-commerce solutions from potential threats. These critical fixes aim to protect businesses from severe security breaches.
Microsoft Patch Tuesday Discloses 3 Zero-Day Flaws Amid 200 Security Fixes
Microsoft just dropped its June Patch Tuesday update, tackling a whopping 200 security flaws, including three zero-day vulnerabilities that need urgent attention. This massive release is a must-address for all organizations running Microsoft software.
Google Patches Chrome Zero-Day Flaw Exploited in the Wild
Google just dropped an emergency update for Chrome, fixing a whopping 74 vulnerabilities, including a zero-day flaw that's been exploited by hackers in the wild. A security researcher scored a $55,000 reward for reporting the bug, now patched in the latest Chrome update.