Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

appknox

Gemini XSS Vulnerability: When AI Executes Malicious Code

Mar 31, 2026 By Jeel Patel In Appknox
Artificial intelligence is no longer just generating text. It generates and executes code in real time. With tools like Google Gemini, features such as code canvases and live previews are turning AI systems into interactive execution environments. This shift introduces a new and rapidly growing category of risk: AI security vulnerabilities tied to real-time code execution.
Read Post
seemplicity

Secure the Supply Chain at Scale with Step Security and Seemplicity

Mar 31, 2026 By Kevin Swan In Seemplicity
CI/CD risks don’t get fixed on visibility alone. Step Security surfaces pipeline exposures, while Seemplicity turns them into clear, assigned remediation tasks, grouped by fix and owner, routed into existing workflows, and tracked through resolution, so teams can reduce exposure faster and prove progress.
Read Post
Arctic Wolf

CVE-2025-53521: F5 BIG-IP APM Vulnerability Reclassified as Unauthenticated RCE and Exploited in the Wild

Mar 31, 2026 By Arctic Wolf Labs In Arctic Wolf
On March 28, 2026, F5 updated its security advisory for a vulnerability impacting BIG-IP APM that was originally disclosed in October 2025 (CVE-2025-53521). The vulnerability was initially classified as a medium-severity denial-of-service (DoS) issue but has been reclassified as a critical remote code execution (RCE) vulnerability. F5 has stated CVE-2025-53521 is being exploited by unauthenticated remote threat actors to deploy web shells.
Read Post
seal security

When "latest" stops being "greatest"

Mar 31, 2026 By Itamar Sher In Seal Security
Open source made software development faster. It also made software delivery more fragile. Most teams already understand that dependencies can contain vulnerabilities. Fewer teams fully internalize the other half of the problem: dependencies can also change underneath them. When versions are not pinned, code from outside your organization can enter your build, CI pipeline, or runtime environment without a deliberate engineering decision. Your repo may be unchanged. Your app may be unchanged.
Read Post
CrowdStrike

Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse

Mar 31, 2026 By Yan Linkov In CrowdStrike
CVE-2026-20929, a vulnerability with a CVSS of 7.5 that was patched in the January 2026 Patch Tuesday update, enables attackers to exploit Kerberos authentication relay through DNS CNAME record abuse. This blog focuses on detecting one particularly impactful attack vector: relaying authentication to Active Directory Certificate Services (AD CS) to enroll certificates for user accounts, as detailed in recent research.
Read Post
indusface

46 Vulnerability Statistics 2026: Key Trends in Discovery, Exploitation, and Risk

Mar 31, 2026 By Vinugayathri Chinnasamy In Indusface
Vulnerabilities remain one of the most exploited entry points for cyberattacks. According to the Indusface State of Application Security Report 2026, attacks targeting website vulnerabilities reached 6.29 billion in 2025, up from 4 billion in 2024, a 56% year-over-year increase. That number is not just a trend line. It means attackers are finding, weaponizing, and exploiting vulnerabilities faster than most security teams can respond.
Read Post
cycognito

Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521)

Mar 30, 2026 By Igal Zeifman In CyCognito
CVE-2025-53521 is an unauthenticated remote code execution vulnerability in F5's BIG-IP Access Policy Manager (APM). The flaw exists in the apmd process, the daemon responsible for processing live access policy traffic, and is triggered when a BIG-IP APM access policy is configured on a virtual server and the system receives specific malicious traffic. No credentials are required to exploit it. The vulnerability carries a CVSS score of 9.8 and a CVSS score of 9.3.
Read Post
armo

CVE-2026-32922: Critical Privilege Escalation in OpenClaw - What Cloud Security Teams Need to Know

Mar 30, 2026 By ARMO In ARMO
The adoption of personal AI assistants is on the rise. everywhere. Developers, power users, and in a few cases, entire teams self-host them to connect messaging apps, automate tasks, and interact with AI models across their infrastructure. But when these self-hosted gateways become compromised, the blast radius can extend far beyond a single user’s chat history.
Read Post
Snyk

Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT

Mar 30, 2026 By Liran Tal In Snyk
On March 31, 2026, two malicious versions of axios, the enormously popular JavaScript HTTP client with over 100 million weekly downloads, were briefly published to npm via a compromised maintainer account. The packages contained a hidden dependency that deployed a cross-platform remote access trojan (RAT) to any machine that ran npm install (or equivalent in other package managers like Bun) during a two-hour window. The malicious versions (1.14.1 and 0.30.4) were removed from npm by 03:29 UTC.
Read Post

GitHub Spark vs. Replit - Vibe Code Challenge

Mar 30, 2026 By Snyk In Snyk
We pit GitHub Spark (in public preview) against Replit's AI agent. The challenge? Build a fully functional community forum for DIY tips from a single prompt. We compare design aesthetics, mobile responsiveness, login security, and deployment speed to see which tool creates a truly production-ready application. Which one do you think deserved the win? Let me know in the comments!
View Video
Arctic Wolf

Riding the Rails: Arctic Wolf Tracking Threat Actors Abusing Railway PaaS for Microsoft 365 Token Compromise

Mar 27, 2026 By Andres Ramos In Arctic Wolf
Arctic Wolf has recently observed a phishing campaign targeting Microsoft 365 that abuses the OAuth device code flow to trick victims into providing authentication codes. Threat actors use Railway’s Platform-as-a-Service (PaaS) infrastructure (a trusted cloud platform with valid IP addresses) to host attack components, allowing the activity to blend in with normal traffic. This enables threat actors to steal valid access and refresh tokens and bypass multi‑factor authentication protections.
Read Post
Snyk

The 5 Principles of Snyk's Developer Experience

Mar 26, 2026 By Mayank Khera In Snyk
In the age of AI-driven development, speed is the new baseline. But as AI agents accelerate the pace of coding, they also amplify the risk of security bottlenecks. At Snyk, we believe a superior Developer Experience (DX) is the only way to secure this new frontier. DX is not just a layer on top of the product. It is the foundation that allows developers to unleash AI innovation securely. We think of DX as a system of decisions that compound over time.
Read Post
cycognito

Citrix NetScaler ADC and Gateway Vulnerabilities (CVE-2026-3055 & CVE-2026-4368)

Mar 26, 2026 By Igal Zeifman In CyCognito
On March 23, 2026, Cloud Software Group (Citrix) published a security bulletin disclosing two vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Both affect customer-managed on-premises deployments; Citrix-managed cloud services and Adaptive Authentication instances have been updated automatically. CVE-2026-3055 is an out-of-bounds read resulting from insufficient input validation in NetScaler ADC and NetScaler Gateway.
Read Post
fidelis security

How Can Network-Based Detection Help Stop Zero-Day Exploits?

Mar 26, 2026 By Fidelis Security In Fidelis Security
Zero-day exploits rarely announce themselves. There is no public advisory yet. No CVE identifier. No detection signature sitting inside a rule library. The vulnerability exists quietly until someone discovers it and unfortunately attackers often discover it first. Once that happens, the exploit becomes a test of visibility. Attackers do not usually rush into environments using zero-days. They explore carefully. They check which systems respond. They observe how security tools behave.
Read Post
safeaeon

Vulnerability Management as a Service: What Businesses Need to Know

Mar 25, 2026 By SafeAeon Inc. In SafeAeon
Cyber threats are at an all-time high because the digital world is rapidly changing. Every day, new vulnerabilities are found in security systems. Attacks threaten businesses of all sizes by stealing data, disrupting operations, and damaging reputations. It has become clear that Vulnerability Management as a Service (VMaaS) is an effective managed approach for companies to protect their digital assets without managing security systems themselves.
Read Post
Snyk

From Discovery to Defense: Why AI Red Teaming Is the Next Step After AI-SPM

Mar 25, 2026 By Agnieszka Koc In Snyk
This week, we announced the general availability of Evo AI-SPM, the first operational layer of Snyk’s AI Security Fabric. AI-SPM gives security teams something they’ve never had before: a system of record for AI risk, with the ability to discover models, frameworks, datasets, and agent infrastructure embedded directly in code. For many organizations, that discovery step is a breakthrough.
Read Post
bitsight

Major Security Event: Supply Chain Compromise in LiteLLM Versions 1.82.7 and 1.82.8

Mar 25, 2026 By Emma Stevens In BitSight
A supply chain compromise that impacted the Python package LiteLLM, with malicious versions 1.82.7 and 1.82.8 was published to PyPI on March 24, 2026. Bitsight Threat Intelligence, public reporting and vendor disclosures indicate the malicious releases included credential harvesting, Kubernetes-focused lateral movement, and persistence mechanisms, creating serious risk for cloud-native and AI-related environments that installed or ran the affected versions.
Read Post
nucleus

The 9 Essential Requirements for an Enterprise Vulnerability Management System

Mar 25, 2026 By Doug Drew In Nucleus
The fastest way to reduce risk at enterprise scale is to standardize on a vulnerability and exposure management platform that unifies asset visibility, prioritizes what matters, and automates workflow to remediate. In this article, we’ll break down the nine essential requirements security leaders should insist on when evaluating an enterprise vulnerability management system, whether it’s an existing tool in their tech stack or a potential new capability.
Read Post
seemplicity

Redefining WTF in Cybersecurity: Why It's Time to Focus on the Fix

Mar 25, 2026 By Tony Thompson In Seemplicity
The cybersecurity industry is currently defined by “WTF” moments of panic, from overwhelming vulnerability backlogs to sophisticated AI-driven attacks that bypass traditional defenses. To combat this, organizations must shift their narrative away from reactive frustration and toward the most critical part of exposure management: The Fix. By redefining WTF, security teams can move beyond context-less alerts and manual spreadsheets.
Read Post
knowbe4

100,000+ New Vulnerabilities This Year and Most Will Be Zero-Days Exploited Faster

Mar 24, 2026 By Roger Grimes In KnowBe4
The number of publicly reported unique vulnerabilities has risen year after year. There was a brief decrease and stabilization in 2015 - 2016, but those are the only years in the over two decades (1999 - on) I have been following vulnerability metrics. Other than that, it has been up, up, up.
Read Post
cato networks

WebPromptTrap - New Indirect Prompt Injection Vulnerability in BrowserOS

Mar 24, 2026 By Dr. Guy Waizel In Cato Networks
Cato researchers have discovered a new indirect prompt injection exploit pattern workflow in BrowserOS (an open-source agentic AI browser). We named it “WebPromptTrap” because the prompt originates from untrusted web content and it traps users into approving an authorization step through a trusted-looking AI summary.
Read Post
indusface

CVE-2026-20963: SharePoint Deserialization Remote Code Execution Vulnerability

Mar 24, 2026 By Deepak Kumar Choudhary In Indusface
Microsoft SharePoint, a core platform for enterprise collaboration, is facing active exploitation through a newly confirmed vulnerability, tracked as CVE-2026-20963. Rooted in unsafe deserialization of user-controlled data, this vulnerability allows remote code execution with low-privileged authenticated access, making it a high-priority threat for organizations worldwide.
Read Post
sophos

Oracle vulnerability (CVE-2026-21992) impacts core products

Mar 23, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On March 20, 2026, Oracle disclosed a critical (CVSS score of 9.8) vulnerability (CVE-2026-21992) impacting two Oracle Fusion Middleware components: Oracle Identity Manager and Oracle Web Services Manager. An unauthenticated attacker could exploit the vulnerability to obtain network access via HTTP and remotely execute code. Critical functions of the products are exposed due to the lack of network-level authentication. As of this publication, there are no reports of active exploitation.
Read Post
cycognito

Emerging Threat: Ubiquiti UniFi Network Application Path Traversal (CVE-2026-22557)

Mar 22, 2026 By Igal Zeifman In CyCognito
CVE-2026-22557 is a path traversal vulnerability in the Ubiquiti UniFi Network Application caused by improper limitation of a pathname to a restricted directory (CWE-22). A malicious actor with network access can exploit the flaw to traverse directory boundaries, access files on the underlying operating system, and manipulate those files to gain unauthorized access to system accounts.
Read Post
Snyk

The Next Era of AppSec: Why AI-Generated Code Needs Offensive Dynamic Testing

Mar 20, 2026 By Nuno Loureiro In Snyk
My colleague Manoj Nair recently wrote about the growing gap between what AI builds and what security teams actually test. He made the case that the speed of AI-driven development has fundamentally outpaced validation, and that the response can't be to slow down, but to change what testing means. I agree with every word.
Read Post
nucleus

Why More AI Doesn't Guarantee Better Vulnerability Management Outcomes

Mar 19, 2026 By Will Gorman In Nucleus
AI is everywhere in vulnerability management right now. Technology vendors in all areas are adding new features and making bold claims about revolutionary capabilities. But here's the reality, especially for vulnerability and exposure management: more AI doesn't automatically mean less risk. The gap between AI's promise and its practical impact in enterprise vulnerability management is wider than most organizations realize.
Read Post
cycognito

Emerging Threat: GNU Inetutils telnetd LINEMODE SLC Buffer Overflow (CVE-2026-32746)

Mar 19, 2026 By Igal Zeifman In CyCognito
CVE-2026-32746 is a critical out-of-bounds write in GNU Inetutils telnetd caused by insufficient bounds checking in the LINEMODE SLC (Set Local Characters) suboption handler. Public advisories attribute the issue to the add_slc logic not verifying whether the destination buffer is already full before writing additional data. The published CVSS v3.1 score is 9.8, with network attack vector, no required privileges, and no user interaction.
Read Post
tanium

CVE202547813: Wing FTP Server vulnerability flagged by CISA

Mar 19, 2026 By Tanium In Tanium
CVE-2025-47813 is an information disclosure vulnerability in Wing FTP Server that reveals the application's full installation path when attackers send an oversized UID cookie value. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog in March 2026, indicating active exploitation in the wild.
Read Post
Arctic Wolf

CVE-2025-32975: Arctic Wolf Observes Exploitation of Quest KACE Systems Management Appliance

Mar 19, 2026 By Andres Ramos In Arctic Wolf
Starting the week of March 9, 2026, Arctic Wolf observed malicious activity in customer environments potentially linked to the exploitation of CVE-2025-32975 on unpatched Quest KACE Systems Management Appliance (SMA) instances that were publicly exposed to the internet. This vulnerability was patched in May 2025. Quest KACE SMA is an on-premises appliance for centralized endpoint management, providing inventory, software deployment, patching, and endpoint monitoring capabilities.
Read Post
Snyk

AI Is Building Your Attack Surface. Are You Testing It?

Mar 19, 2026 By Manoj Nair In Snyk
The market is flooded with claims. One vendor tops a leaderboard. Another raises nine figures on a pitch deck. Meanwhile, your developers shipped three AI-generated services before lunch. Here's the conversation the industry isn't having, and the one we've been building toward for years. There's a version of this conversation happening inside every Security team right now. Someone demos an AI coding assistant. The speed is undeniable and the team is in awe. Still cautious, sometimes skeptical.
Read Post
seemplicity

The Unsung AI Hero: Data Normalization

Mar 18, 2026 By Megan Horner In Seemplicity
AI agents are only as effective as the data they consume. In this post, we explore the unsung hero of the security stack: data normalization. This process serves as the deterministic guardrail that makes AI grounding possible. Without a structured data foundation, grounding is only as good as the often chaotic data being retrieved, leading to confident but incorrect AI responses.
Read Post
Snyk

Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard

Mar 17, 2026 By Stephen Thoemmes In Snyk
Agent skills are becoming the building blocks of AI-native software development, giving coding agents structured, versioned context, like how to use your APIs, how to build in your codebase, and how to enforce your team's policies. Developers install them from registries the same way they install npm packages or Python libraries. But unlike npm or PyPI, the agent skills ecosystem is new.
Read Post
Snyk

I Read Cursor's Security Agent Prompts, So You Don't Have To

Mar 17, 2026 By Randall Degges In Snyk
Cursor's security team built four autonomous agents that review 3,000+ PRs per week, catch 200+ vulnerabilities, and open fix PRs automatically. The engineering is impressive, and the prompts are shockingly simple. But there's a meaningful gap between "LLM agents reviewing PRs" and "enterprise security program," and that gap is exactly where things get interesting.
Read Post
outpost 24

Why Evolving Cyber Threats Rely on Old Vulnerabilities

Mar 16, 2026 By Daniel Imber In Outpost 24
Credential abuse, exploitation of vulnerabilities, or phishing were the initial access vectors in 61% of breaches in 2025, according to Verizon’s 2025 Data Breach Investigation Report. While new threats present fresh challenges to security teams, reports like this highlight that cybercriminals still favor well-established attack methods and exploit familiar weaknesses.
Read Post

Lovable vs. Bolt - Vibe Code Challenge

Mar 16, 2026 By Snyk In Snyk
Which AI tool is better for building a real app without writing code, Bolt or Lovable? In this video, I put both AI app builders head-to-head using the exact same prompt to create a DIY home repair forum. From database setup to authentication, UI design, publishing, and security checks, we compare how each platform performs in real time. The goal isn’t just to generate something that looks like an app, it’s to see whether these tools can actually create something usable, functional, and potentially production-ready. We evaluate.
View Video
Arctic Wolf

Multiple Authenticated High and Critical Vulnerabilities in Veeam Backup & Replication

Mar 13, 2026 By Andres Ramos In Arctic Wolf
On March 12, 2026, Veeam released fixes for multiple high and critical severity vulnerabilities in their Backup & Replication product that could allow remote code execution (RCE), privilege escalation, and credential theft. Arctic Wolf has not identified publicly available proof-of-concept exploits for these vulnerabilities, nor have we observed any exploitation.
Read Post
Arctic Wolf

Stryker Systems Disrupted in Cyber Attack; Handala Group Claims Responsibility

Mar 13, 2026 By Arctic Wolf Labs In Arctic Wolf
On March 11, 2026, U.S. medical technology company Stryker Corporation disclosed a cyber attack that disrupted its global internal networks and Microsoft systems, leaving thousands of employees unable to access corporate systems and devices inoperable. In its SEC filing, Stryker stated it has no indication of ransomware or malware, considers the incident contained, and is assessing the full impact, with no timeline provided for full restoration.
Read Post
cycognito

Emerging Threat: Microsoft SQL Server Elevation of Privilege Vulnerability (CVE-2026-21262)

Mar 12, 2026 By Igal Zeifman In CyCognito
CVE-2026-21262 is an elevation of privilege vulnerability affecting Microsoft SQL Server. The issue is caused by improper access control within SQL Server components, allowing an authenticated attacker to elevate privileges over a network.
Read Post
bitsight

RondoDox Botnet: From Zero to 174 Exploited Vulnerabilities

Mar 11, 2026 By João Godinho In BitSight
According to a 2024 report from IoT Analytics, there were 16.6 billion Internet of Things (IoT) connected devices at the end of 2023, and that number is expected to grow to 41.1 billion by 2030. This means an increased attack surface for malicious actors to take advantage of, especially given that the security posture of the vendors that provide these devices varies greatly.
Read Post
seemplicity

Preventing SCA Findings From Becoming a Remediation Bottleneck

Mar 11, 2026 By Kevin Swan In Seemplicity
SCA tools often generate multiple CVEs for the same dependency, creating unnecessary tickets and slowing remediation. Aggregating those findings into a single fix helps AppSec teams reduce ticket sprawl and align security work with how developers actually resolve vulnerabilities.
Read Post
veracode

The 36% Surge in High-Risk Vulnerabilities: What It Means for Your Business

Mar 10, 2026 By Natalie Tischler In Veracode
The concentration of dangerous software flaws is accelerating. The number of high-risk vulnerabilities – those with both high severity and high exploitability – has surged by 36% year-over-year, according to the 2026 State of Software Security Report. This trend indicates a critical problem: more risk is entering your codebase faster than ever before.
Read Post
armo

Signature Verification Bypass in Authlib (CVE-2026-28802): What Cloud Security Teams Need to Know

Mar 10, 2026 By Ben Hirschberg In ARMO
OAuth and OpenID Connect are the backbone of modern cloud-native identity and access management. From SaaS platforms and internal APIs to Kubernetes microservices, these protocols are responsible for verifying who is allowed to access what. When a vulnerability appears in a widely used authentication library, the impact can cascade across entire application ecosystems.
Read Post
outpost 24

Proactive Cybersecurity Strategy: Reducing Risk Ahead of Time

Mar 9, 2026 By Daniel Imber In Outpost 24
Proactive instead of reactive. Are you tired of hearing that already? This phrase seems to appear in almost every elevator pitch. But when it comes to cybersecurity, anticipating threats is essential. Attackers are more professional, automated, and faster than ever. The damage they cause keeps growing, and the window you have after the first alarm to protect your organization is shrinking.
Read Post
armo

Top Vulnerability Prioritization Tools Compared: 2026 Edition

Mar 9, 2026 By Ben Hirschberg In ARMO
Why do 3,000 CVEs not mean 3,000 real problems? Most vulnerability scanners flag every CVE in your container images without checking whether the vulnerable code is actually loaded and executed at runtime. Only 2–5% of alerts typically require action, which means your team is likely spending days triaging theoretical risks while genuinely exploitable vulnerabilities stay buried.
Read Post
indusface

CVE-2026-27739: Angular SSR Request Vulnerability Enabling Server-Side Request Forgery

Mar 9, 2026 By Bhargavi Pallati In Indusface
A critical vulnerability has been discovered in Angular Server-Side Rendering (SSR) that could allow attackers to manipulate request handling and trigger unauthorized server-side requests. Tracked as CVE-2026-27739, the vulnerability arises from how Angular SSR reconstructs request origins using HTTP headers such as Host and X-Forwarded-*. In affected versions, these headers were not strictly validated before being used to build request URLs.
Read Post
cloudflare

Active defense: introducing a stateful vulnerability scanner for APIs

Mar 9, 2026 By John Cosgrove In Cloudflare
Security is traditionally a game of defense. You build walls, set up gates, and write rules to block traffic that looks suspicious. For years, Cloudflare has been a leader in this space: our Application Security platform is designed to catch attacks in flight, dropping malicious requests at the edge before they ever reach your origin. But for API security, defensive posturing isn’t enough. That’s why today, we are launching the beta of Cloudflare’s Web and API Vulnerability Scanner.
Read Post
cloudflare

Fixing request smuggling vulnerabilities in Pingora OSS deployments

Mar 9, 2026 By Edward Wang In Cloudflare
In December 2025, Cloudflare received reports of HTTP/1.x request smuggling vulnerabilities in the Pingora open source framework when Pingora is used to build an ingress proxy. Today we are discussing how these vulnerabilities work and how we patched them in Pingora 0.8.0. The vulnerabilities are CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836. These issues were responsibly reported to us by Rajat Raghav (xclow3n) through our Bug Bounty Program.
Read Post
Arctic Wolf

CVE-2026-20079 & CVE-2026-20131: Maximum-severity Vulnerabilities in Cisco FMC

Mar 6, 2026 By Andres Ramos In Arctic Wolf
On March 4, 2026, Cisco released fixes for two maximum-severity vulnerabilities impacting Cisco Secure Firewall Management Center (FMC), which is used to centrally manage Cisco Secure Firewall devices. Arctic Wolf has not observed threat actors exploiting these vulnerabilities, nor have any public proof-of-concept exploits been reported.
Read Post
Arctic Wolf

CVE-2026-29000: Authentication Bypass in pac4j-jwt Java Library

Mar 6, 2026 By Arctic Wolf Labs In Arctic Wolf
On March 03, 2026, pac4j released fixes for a maximum severity vulnerability in pac4j-jwt, tracked as CVE-2026-29000. The flaw arises from improper verification of cryptographic signatures in the JwtAuthenticator component when processing encrypted JWTs (JWE). A remote, unauthenticated threat actor who knows the server’s RSA public key can bypass authentication and impersonate arbitrary users (including administrators) by submitting a crafted JWE whose inner token is an unsigned PlainJWT.
Read Post
armo

Four Critical RCE Vulnerabilities in n8n: What Cloud Security Teams Need to Know

Mar 5, 2026 By Ben Hirschberg In ARMO
Automation platforms sit at the center of modern infrastructure. They connect APIs, databases, CI/CD pipelines, SaaS tools, and internal systems. But when automation engines become compromised, the blast radius can be enormous. In February 2026, n8n, a widely used open-source workflow automation platform, disclosed four critical vulnerabilities that can lead to remote code execution (RCE) by authenticated users with workflow creation or editing permissions.
Read Post
seemplicity

The Future of the Cybersecurity Workforce in an AI-Driven Era

Mar 5, 2026 By Jessica Amado In Seemplicity
New research shows the cybersecurity workforce is undergoing a major shift as AI transforms security operations. While leaders remain deeply committed to the field, many are facing increasing burnout, evolving skill demands, and growing responsibility for governing AI-driven systems. The future cybersecurity leader will need to balance technical expertise with communication, business alignment, and AI oversight.
Read Post
levelblue

LevelBlue Partners With Tenable to Deliver Expanded Vulnerability and Exposure Management Capabilities

Mar 5, 2026 By LevelBlue In LevelBlue
Periodic vulnerability scans should no longer be an acceptable standard by any security-minded organization. What is needed is the ability for MSSPs to quickly identify and prioritize risks across all client environments. To enable this capability LevelBlue has developed and rolled out LevelBlue Exposure Management for Partners. This solution delivers continuous visibility, meaningful context, and clarity around how risks could impact the business.
Read Post
nucleus

Exposure Assessment Platforms Are Here and They're a Big Part of Successful CTEM

Mar 5, 2026 By Rob Gibson In Nucleus
Gartner released its 2025 Magic Quadrant for Exposure Assessment Platforms in November 2025. The new categorization detailed in the report is something we view as a natural progression in response to the way enterprise risk has evolved over the years. It’s a move away from viewing vulnerabilities in a vacuum and looking at a more complete picture of the risk today’s enterprises face.
Read Post
The Silent Vulnerability: Why Non-Human Identities Are Now Prime for Exploitation

The Silent Vulnerability: Why Non-Human Identities Are Now Prime for Exploitation

Mar 4, 2026 By Bharath Rangamannar, SVP Engineering In Reach Security
The explosive growth of nonhuman identities (NHIs) has quietly become one of the most pressing cybersecurity challenges of the modern enterprise. Machine identities, API keys, service accounts, OAuth tokens, digital certificates, and other automated credentials now outnumber human identities by ever-growing ratios, sometimes by as much as 50 to one. However, despite their ubiquity and critical operational role, NHIs rarely receive the same level of governance or scrutiny as human-centered identities. Visibility is fragmented, controls are inconsistent, and access is often far broader than it needs to be.
Read Post

Why AI Features Don't Equal Better Vulnerability Management

Mar 4, 2026 By Nucleus Security In Nucleus
AI is becoming table stakes in vulnerability and exposure management. In this candid webinar conversation, Chris Ray, Field CTO at GigaOm, and Will Gorman, CTO and leader of AI initiatives at Nucleus Security, challenge the assumption that more AI automatically leads to better outcomes.
View Video
cato networks

Cato CTRL Threat Research: New MongoDB Vulnerability Allows Instant Remote Server Takedown (CVE-2026-25611)

Mar 4, 2026 By Vitaly Simonovich In Cato Networks
Cato CTRL’s Vitaly Simonovich (senior security researcher) has discovered a new vulnerability (CVE-2026-25611 with a “High” severity rating of 7.5 out of 10) in all MongoDB versions with compression enabled (version 3.4+, enabled by default since version 3.6), including MongoDB Atlas. The vulnerability can enable a threat actor to crash any MongoDB server. MongoDB Atlas clusters are not internet-reachable by default.
Read Post
Snyk

The 89% Problem: How LLMs Are Resurrecting the "Dormant Majority" of Open Source

Mar 4, 2026 By Noa Yaffe-Ermoza In Snyk
AI coding assistants are quietly resurrecting millions of abandoned open source packages. For the last decade, developers relied on a simple heuristic for open source security: Prevalence \= Trust. If a package was downloaded millions of times a week (lodash, react, requests), we assumed it was "safe enough" because thousands of eyes were on it. If it was obscure, we approached with caution.
Read Post
foresiet

CVE-2026-21513: APT28 Exploits MSHTML Zero-Day in Targeted Attacks

Mar 3, 2026 By foresiet In Foresiet
A Russia-linked threat actor widely tracked as APT28 leveraged a zero-day vulnerability in Microsoft’s MSHTML engine, tracked as CVE-2026-21513, in targeted operations before a security patch was made available. The vulnerability enabled remote code execution through crafted content rendered by the Windows MSHTML component, which remains embedded across supported Windows systems. The exploitation occurred in targeted spear-phishing campaigns aimed at diplomatic and defense-aligned organizations.
Read Post
aikido

Persistent XSS/RCE using WebSockets in Storybook's dev server

Mar 3, 2026 By Robbe Verwilghen In Aikido
Aikido Attack, our AI pentest product, found a WebSocket hijacking vulnerability in Storybook's dev server that can lead to persistent XSS, remote code execution, and, in the worst case, supply chain compromise. Storybook's WebSocket server has no authentication or access control, so if the dev server is publicly accessible, an attacker can exploit this without any user interaction at all. In the more common local setup, a developer just has to visit the wrong website while Storybook is running.
Read Post
outpost 24

Stove Off, Windows Closed: What CMDB Accuracy Has to Do with Home Security

Mar 2, 2026 By Daniel Imber In Outpost 24
Have you ever left your home without checking if all the windows were closed? And have you ever sat in the office wondering whether you turned off the stove? When it comes to our own homes, most of us care a lot about safety. But what about corporate IT? Have you turned off the virtual stove and secured all doors and windows against unauthorized access? Do you even know how many doors and windows exist in your IT environment?
Read Post

AI on the Radar: Securing AI Driven Development

Mar 2, 2026 By Snyk In Snyk
Join Vandana and Rob in this insightful webinar exploring the rapidly evolving landscape of AI security. As we shift from simple query-response models to complex autonomous agents that can plan, execute code, and access sensitive APIs, the traditional security "locks" are no longer sufficient. This session dives deep into the OWASP AI Exchange, a community-driven initiative providing practical guidance and technical controls for securing AI systems.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.