Microsoft issued an emergency patch for CVE-2026-42897, a critical zero-day vulnerability in Outlook Web Access (OWA) that threat actor TA488 allegedly exploited in the wild before public disclosure. The flaw allows remote attackers to execute arbitrary code on Exchange servers without authenticatio
Google has released DiffusionGemma, an open-source AI image generation model featuring a 4x performance improvement over its predecessor. While the speed enhancement democratizes AI capabilities, it simultaneously amplifies security risks including adversarial attacks, deepfake generation velocity,
A federal audit has exposed serious operational failures at NIST’s National Vulnerability Database (NVD), revealing a staggering backlog of 27,000 unprocessed security vulnerabilities. The investigation uncovered systematic issues including inadequate resource planning, excessive duplication of effo
The notorious cybercriminal group ShinyHunters has weaponized a zero-day vulnerability in Oracle PeopleSoft Campus Solutions, launching targeted attacks against educational institutions. The exploit allows unauthorized access to student records, financial data, and administrative systems. Multiple c
Security researchers have uncovered four critical vulnerabilities in the Dify AI platform that collectively affect over 1 million AI applications. Dubbed “DifyTap,” these bugs enable attackers to execute arbitrary code, steal sensitive data, hijack administrative accounts, and compromise entire AI w
A newly identified threat actor dubbed “Pink” has emerged with a focused campaign targeting enterprise users to steal cloud storage credentials. The group employs sophisticated phishing techniques, credential harvesting infrastructure, and evasion tactics to compromise corporate accounts across majo
A critical zero-day vulnerability in Windows’ Collaborative Translation Framework (CTF) client-server runtime process (CTFMON.EXE) allows authenticated attackers to escalate privileges to SYSTEM level. The vulnerability, actively exploited in targeted attacks, affects all supported Windows versions
The personal website of FBI Director Kash Patel was abruptly taken offline following reports of malware infections targeting visitors. The site, which served as Patel’s brand platform, reportedly distributed malicious code that triggered security alerts across multiple antivirus solutions. The incid
CISA has issued an urgent alert regarding widespread exploitation of a credential exposure vulnerability dubbed “FortiBleed” affecting over 74,000 Fortinet devices globally. The flaw allows attackers to extract plaintext credentials from vulnerable FortiGate SSL-VPN appliances without authentication
Google has released an emergency patch for CVE-2026-11645, a critical zero-day vulnerability in Chrome that attackers are actively exploiting in the wild. The flaw, a use-after-free bug in Chrome’s JavaScript engine, allows remote code execution through maliciously crafted web pages. All Chrome user