Six critical vulnerabilities collectively dubbed “Proto6” have been discovered in protobuf.js, a widely-used JavaScript implementation of Google’s Protocol Buffers. These flaws expose Node.js applications to remote code execution (RCE) and denial-of-service (DoS) attacks. The vulnerabilities stem fr
Anthropic has launched Claude Fable 5, a new AI model available for a limited time period. This specialized model introduces unique capabilities that present both opportunities and security considerations for organizations. Security teams must understand the model’s architecture, assess potential at
A critical zero-day vulnerability dubbed “RoguePlanet” in Microsoft Defender allows attackers with basic user access to escalate privileges to SYSTEM-level control on Windows machines. The flaw exploits Defender’s built-in scanning mechanisms through a time-of-check-time-of-use (TOCTOU) race conditi
Threat actors are increasingly targeting cloud logging infrastructure as a primary defense evasion technique. By disabling, deleting, or manipulating cloud audit logs across AWS CloudTrail, Azure Monitor, and Google Cloud Logging, attackers effectively blind security teams during intrusions. This ta
Meta has updated its data usage policies to expand how it leverages off-Meta business activity data beyond advertising purposes. The social media giant will now use information about user interactions with third-party businesses—collected through Meta Pixel, Conversions API, and similar tools—to per
Microsoft’s June 2026 Patch Tuesday addresses 89 security vulnerabilities across its product ecosystem, including five zero-day vulnerabilities—three actively exploited in the wild. The most critical issues affect Windows Kernel, Microsoft Exchange Server, and Azure Cloud Services. Organizations sho
ServiceNow, a major cloud-based workflow automation platform used by thousands of enterprises, disclosed a security incident that exposed customer data through a misconfigured development instance. The breach, discovered in early 2024, affected an undisclosed number of customers and involved unautho
OpenClaw, an AI-powered email management agent, has been compromised through phishing attacks, resulting in the exposure of sensitive user data. The incident demonstrates a critical vulnerability in autonomous AI systems that process emails without adequate security controls. Multiple users reported
Google has released an emergency patch for CVE-2026-11645, a critical zero-day vulnerability in Chrome that attackers are actively exploiting in the wild. The flaw, a use-after-free bug in Chrome’s JavaScript engine, allows remote code execution through maliciously crafted web pages. All Chrome user
SAP has released critical security patches addressing severe vulnerabilities in NetWeaver and Commerce Cloud platforms. These flaws could allow attackers to execute arbitrary code, bypass authentication mechanisms, and compromise sensitive business data. Organizations running affected SAP products m