Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CrowdStrike

Defending Against CORDIAL SPIDER and SNARKY SPIDER with Falcon Shield

Apr 30, 2026 By Falcon Shield - Counter Adversary Operations In CrowdStrike
Since October 2025, CrowdStrike Counter Adversary Operations has observed a shift in intrusion tradecraft: Threat actors are executing high-speed, SaaS-centric attacks that bypass traditional endpoint visibility. CORDIAL SPIDER and SNARKY SPIDER exemplify this evolution as distinct adversaries conducting rapid data theft and extortion campaigns with striking operational similarities.
Read Post
tanium

Copy Fail (CVE-2026-31431): What Linux administrators need to know now

Apr 30, 2026 By Tanium In Tanium
Copy Fail, or CVE-2026-31431, is a Linux kernel local privilege escalation vulnerability that can let an unprivileged local user corrupt page-cache-backed file data under specific conditions and potentially escalate privileges. Exposure depends on the running vendor kernel and backported fixes. Installing a vendor-provided kernel fix is the primary remediation, with temporary mitigations available in some environments if patching is delayed.
Read Post
veracode

Surviving the Vulnpocalypse: How to Prepare for the AI-Driven Security Reckoning

Apr 30, 2026 By Natalie Tischler In Veracode
The cybersecurity landscape is facing an unprecedented shift, and industry experts are sounding the alarm about what many are calling the “vulnpocalypse.” This isn’t just another security buzzword or overhyped threat. It represents a fundamental transformation in how vulnerabilities are discovered, exploited, and defended against in the age of artificial intelligence.
Read Post
seemplicity

Help! I'm Drowning in Alphabet Soup

Apr 30, 2026 By Megan Horner In Seemplicity
The cybersecurity industry is currently drowning in an “alphabet soup” of over 500 different category acronyms, a trend that is creating unnecessary noise and silos rather than helping practitioners. This hyper-niche branding often forces security teams to manage fragmented dashboards that don’t communicate with each other, adding to their workload instead of reducing it.
Read Post
Snyk

lightning PyPI Compromise: A Bun-Based Credential Stealer in Python

Apr 30, 2026 By Stephen Thoemmes In Snyk
On April 30, 2026, two malicious releases of the popular lightning PyPI package were published, affecting the deep learning framework formerly distributed as pytorch-lightning. Versions 2.6.2 and 2.6.3 ship a hidden _runtime directory that downloads the Bun JavaScript runtime from GitHub at import time and uses it to execute an ~11 MB obfuscated credential stealer. The last clean release is 2.6.1, published January 30, 2026.
Read Post
bitsight

Critical Vulnerability Alert: CVE-2026-41940 in cPanel, WHM, and WP Squared

Apr 30, 2026 By Emma Stevens In BitSight
A critical vulnerability CVE-2026-41940 has been identified in cPanel, WHM, and WP Squared, affecting cPanel & WHM versions after 11.40, as well as WP Squared. These web hosting control panels are commonly used to manage websites, email, databases, and server configurations, making unauthorized access a serious security concern.
Read Post
Arctic Wolf

CVE-2026-41940: Critical Exploited Authentication Bypass Vulnerability in cPanel & WHM

Apr 30, 2026 By Andres Ramos In Arctic Wolf
On April 28, 2026, cPanel patched a critical authentication bypass vulnerability affecting cPanel and WebHost Manager (WHM), tracked as CVE-2026-41940. The issue stems from a flaw in the login and session handling process that allows Carriage Return Line Feed (CRLF) injection, enabling remote threat actors to bypass authentication and gain unauthorized access to the control panel.
Read Post
outpost 24

Stryker Hack: What We Know So Far

Apr 29, 2026 By Outpost24 Threat Intelligence Team In Outpost 24
On March 11, 2026, the Iranian hacktivist group Handala Hack Team claimed responsibility for compromising the American healthcare technology company Stryker. Public reporting suggests more than 200,000 systems were impacted and up to 50TB of data exfiltrated. While these figures remain unverified, the scale of operational disruption alone places this incident among the most significant enterprise cyber events of the year so far.
Read Post
Snyk

Bridging the Gap to Autonomous Fixes: Snyk and Atlassian Unveil Intelligent Remediation for Jira

Apr 29, 2026 By Jack Ryan In Snyk
Modern development teams are currently drowning in security debt, often trapped in a manual, fragmented cycle of "find and fix" that slows down innovation. Even when equipped with high-fidelity vulnerability data, traditional workflows require developers to constantly context-switch between Jira tickets and their codebases to manually implement and test patches.
Read Post
Snyk

Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

Apr 29, 2026 By Brian Vermeer In Snyk
The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as the new Log4shell, read this first. CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf. Thymeleaf is a templating engine in Java that is used for server-side webpage rendering. The sandbox that normally prevents arbitrary code execution got bypassed using a tab character. And yes, this can lead to a remote code execution if exploited.
Read Post
Snyk

"A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages

Apr 29, 2026 By Stephen Thoemmes In Snyk
On April 29, 2026, attackers published malicious versions of four npm packages in the SAP development ecosystem: mbt, @cap-js/db-service, @cap-js/sqlite, and @cap-js/postgres. Each compromised release ships a preinstall hook that downloads the Bun JavaScript runtime from GitHub Releases and uses it to execute an ~11.6 MB obfuscated credential stealer.
Read Post
cycognito

Emerging Threat: (CVE-2026-3854) GitHub Enterprise Server RCE via Git Push Injection

Apr 29, 2026 By Igal Zeifman In CyCognito
CVE-2026-3854 is a command injection vulnerability in GitHub Enterprise Server. It lives in the git push pipeline. User-supplied push option values were not properly sanitized before being embedded in an internal service header. The header format used a delimiter that could also appear in user input. A crafted push option containing that delimiter let an attacker inject additional metadata fields. Downstream services treated those fields as trusted internal values.
Read Post
seal security

Beyond the Build: Dynamic Remediation for Malicious Package Versions

Apr 29, 2026 By Alon Navon In Seal Security
In the fast-moving world of software supply chains, the discovery of a malicious version of a popular library often triggers a state of emergency. Traditional security tools take a reactive approach: they scan, they find a match, and they fail the build. But what happens if the malicious version was merged before it was flagged? What if it’s already running in your production containers? Or what if it’s being pulled dynamically across hundreds of different pipelines?
Read Post
nucleus

Exploited Before CISA KEV: What 8 Confirmed Cases Reveal

Apr 29, 2026 By Tally Netzer In Nucleus
Most vulnerability programs are built to act when risk looks obvious, such as when a vulnerability lands in CISA KEV, a public exploit emerges, or EPSS rises. This approach is rational because it provides a clear, defensible trigger for action. But it often comes with delay: by the time signals are strong enough to drive consensus, the window to get ahead of risk may already be closing.
Read Post
Arctic Wolf

Vulnerability Prioritization Requires More Than a Score

Apr 29, 2026 By Dan Schiappa In Arctic Wolf
As AI systems become more capable and increasingly embedded into business operations, security teams are confronting a familiar challenge in a new form: speed without context. Vulnerability discovery is accelerating toward machine scale, while adversaries continue to adapt in real time. In response, the industry has gravitated toward data‑driven scoring models to help determine what deserves attention first.
Read Post

"Just looking at code and finding vulnerabilities is not going to stop breaches."

Apr 29, 2026 By CrowdStrike In CrowdStrike
CrowdStrike CEO and Founder George Kurtz discusses with Dan Ives of Wedbush Securities why frontier AI models won’t replace cybersecurity platforms: stopping breaches requires proprietary data, real-time decisions, enterprise-grade support and the ability to act in milliseconds.
View Video
cato networks

Cato CTRL Threat Research: New Vulnerabilities in NVIDIA NeMo and Meta PyTorch Enable Full System Compromise

Apr 29, 2026 By Inga Cherny In Cato Networks
Cato CTRL has discovered high-severity vulnerabilities in NVIDIA NeMo (CVE-2025-33236 with a CVSS score of 7.8) and Meta PyTorch that turns AI model files into remote code execution (RCE) vectors. The NeMo vulnerability allows RCE by importing a malicious AI model. The NeMo framework silently executes threat actor-controlled code with no warning.
Read Post
Continuous Threat Exposure Management (CTEM): The Complete Guide to Proactive Cybersecurity

Continuous Threat Exposure Management (CTEM): The Complete Guide to Proactive Cybersecurity

Apr 28, 2026 By SecuritySenses In SecuritySenses
The cybersecurity landscape has fundamentally changed. Organizations today manage sprawling digital environments - cloud workloads, remote endpoints, SaaS applications, third-party APIs, and hybrid infrastructure - all of which expand the attack surface at a pace that traditional security programs simply cannot match.
Read Post

Exposure Prioritization Agent: Demo Drill Down

Apr 27, 2026 By CrowdStrike In CrowdStrike
Vulnerability volume continues to rise, making it difficult for security teams to determine which exposures actually matter. Without clear prioritization, teams are forced to react to volume, often focusing on severity scores instead of real risk. In this demo drill down, we showcase the Exposure Prioritization Agent within Falcon Exposure Management. You’ll see how AI-driven prioritization uses ExPRT.AI, adversary intelligence, and business context to reduce millions of vulnerabilities into a focused set of high-risk exposures.
View Video
outpost 24

Defending Critical Infrastructure in a Hyperconnected Society

Apr 27, 2026 By Outpost 24 In Outpost 24
On April 28, 2025, a massive power outage affected large areas of the Iberian Peninsula and parts of southern France. Traffic lights, elevators, point-of-sale systems, and many mobile phone and internet networks suddenly stopped functioning. Subways and parts of the rail network ground to a halt. Industrial production and numerous service businesses were interrupted for several hours to a full day.
Read Post
Snyk

Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining

Apr 27, 2026 By Julia Kinday In Snyk
In early February 2026, users of Qinglong (青龙), a popular open source timed task management platform with over 19,000 GitHub stars, began reporting that their servers were maxing out CPU usage. The cause was a cryptominer binary called.fullgc, deployed through two authentication bypass vulnerabilities that allowed unauthenticated remote code execution. The attacks went largely unnoticed in the English-speaking security community.
Read Post
sentrium

ASP.NET Core Privilege Escalation Vulnerability (CVE-2026-40372)

Apr 24, 2026 By James Drew In Sentrium
Microsoft has released an emergency out of band update for.NET to address a critical security vulnerability affecting ASP.NET Core applications. The issue, tracked as CVE-2026-40372, relates to improper verification of cryptographic signatures within the ASP.NET Core Data Protection framework. The vulnerability was introduced as a regression in earlier.NET 10 releases and has prompted the release of.NET 10.0.7 to mitigate risk.
Read Post
outpost 24

Handala Hack Team: Threat Actor Profile

Apr 24, 2026 By Outpost24 Threat Intelligence Team In Outpost 24
Handala Hack Team, also stylized as Handala_hack, is a hacktivist threat group aligned with pro-Palestinian messaging and Iranian strategic interests. It emerged in December 2023 following the escalation of the Gaza conflict, shortly after the 7 October 2023 Hamas attack on Israel, presenting itself as a pro-Palestinian hacktivist collective. Its operations closely mirror Iranian state-linked activity and indicate a focus on disruption and psychological impact rather than financial gain.
Read Post

How Hackers Get In: What Is a Vulnerability? (Containers Explained)

Apr 24, 2026 By Sysdig In Sysdig
A vulnerability is a weakness in software—and in containerized environments, even one small flaw can open the door. From buggy code to outdated images and misconfigurations, risk can exist at every layer of the stack. And if a vulnerability is already known… attackers often already know how to exploit it. In this video, we break down: Next up: What is a CVE?
View Video
indusface

CVE-2026-32201: SharePoint Spoofing Vulnerability Enabling Unauthenticated Impersonation

Apr 24, 2026 By Deepak Kumar Choudhary In Indusface
Over 1,300 Microsoft SharePoint servers exposed online remain unpatched against a spoofing vulnerability that was exploited as a zero-day. The vulnerability in question, CVE-2026-32201, is a spoofing vulnerability rooted in improper input validation that requires no login, no user interaction, and no special conditions to exploit. The vulnerability allows unauthenticated attackers to influence how content is rendered, making attacker-controlled data appear as legitimate output.
Read Post
10 Essential Tools Every Cybersecurity Professional Uses

10 Essential Tools Every Cybersecurity Professional Uses

Apr 24, 2026 By SecuritySenses In SecuritySenses
Working in cybersecurity means that you are constantly dealing with all kinds of potential threats. And that's why it's inherently important to find ways of improving that security, which can prove to be very challenging a lot of the time. But that's why cybersecurity professionals are continually relying on professional tools to get their job done. Here's what they are using.
Read Post

How to scan your code bases using AI for vulnerabilities with Jeff McJunkin

Apr 23, 2026 By LimaCharlie In LimaCharlie
Join us for this week's Defender Fridays as Jeff McJunkin, Founder of Rogue Valley Information Security, walks through how he built an AI-powered pipeline to scan large codebases for real, exploitable vulnerabilities, using the Linux kernel as his proving ground. At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.
View Video
Snyk

JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?

Apr 23, 2026 By John Carione In Snyk
JPMorganChase's Global Technology Leadership published "Fortifying the enterprise: 10 actions to take now for AI-ready cyber resilience" on April 17, 2026. It's a CISO mandate for every large enterprise. Snyk directly addresses 8 of those 10 actions — out of the box, in the developer workflow, with one platform.
Read Post
Snyk

Hardcoding Security into Every Commit: The Future of Snyk Secrets

Apr 23, 2026 By Kate Powers Burke In Snyk
In the modern software development lifecycle, the speed of innovation is often at odds with the security of our most sensitive data. As organizations embrace cloud-native development and AI-generated code, they face a phenomenon known as “secret sprawl”, aka, the uncontrolled and widespread distribution of API keys, passwords, and tokens across repositories, CI/CD logs, and developer collaboration tools.
Read Post
cycognito

Emerging Threat: (CVE-2026-40372) ASP.NET Core Privilege Escalation via Signature Bypass

Apr 23, 2026 By Igal Zeifman In CyCognito
CVE-2026-40372 is an elevation of privilege vulnerability in ASP.NET Core caused by improper verification of cryptographic signatures in the Data Protection library. The flaw sits in the HMAC validation routine of the managed authenticated encryptor, where a defective comparison lets an attacker submit a forged payload that the application accepts as legitimately signed. The vulnerability carries a CVSS v3.1 base score of 8.1 (Important), as assigned by Microsoft in the official advisory.
Read Post
outpost 24

Navigating Cyber Essentials v3.3: A Guide to Compliance

Apr 23, 2026 By Dominique Adams In Outpost 24
On 27 April 2026, the National Cyber Security Centre (NCSC) will officially implement Cyber Essentials v3.3, delivered through a new self-assessment question set known as Danzell, which replaces the previous Willow set. The foundational five technical controls remain the bedrock of the scheme, but this latest iteration tightens wording, scoping, and marking criteria in ways that have immediate consequences.
Read Post
exabeam

OWASP Defines AI Agent Risk. Behavioral Analytics Detects It

Apr 22, 2026 By Exabeam In Exabeam
The OWASP Top 10 for Agentic Applications defines the most common AI agent risks, but real attacks unfold across multiple stages of behavior. Behavioral analytics detects those risks by modeling how users, AI agents, and their interactions change over time. By observing deviations across inputs, processing, and outputs, security operations teams can identify insider‑driven and agent‑driven threats that traditional, event‑based detection misses.
Read Post
salt security

You're Not Watching MCPs. Anthropic's Vulnerability Shows Why You Should Be.

Apr 22, 2026 By Roey Eliyahu In Salt Security
Last week, researchers at OX Security published findings that should stop every security leader in their tracks. They discovered a critical vulnerability baked directly into Anthropic's Model Context Protocol SDK, affecting every supported language: Python, TypeScript, Java, and Rust. The result: remote code execution on any system running a vulnerable MCP implementation, with direct access to sensitive user data, internal databases, API keys, and chat histories. Over 7,000 publicly accessible servers.
Read Post
astra

A Comprehensive Guide to OWASP Penetration Testing

Apr 22, 2026 By Keshav Malik In Astra
OWASP Penetration Testing is a specialized type of security testing that focuses on attack vectors and vulnerabilities listed in OWASP Top 10. An organization’s security landscape is complex, and thus it is essential to test the organization’s security measures to ensure that they are working correctly. OWASP’s (Open Web Application Security Project) compiled a list of the top 10 attacks named OWASP Top 10 for multiple technologies such as Web Applications, Cloud, Mobile Security, etc.
Read Post
detectify

How Internal Scanning works: Q&A with Detectify's product expert

Apr 21, 2026 By Detectify In Detectify
Security doesn’t stop at the perimeter. The “inside” of your network often harbors many overlooked risks. To address this, ealier this year we launched Detectify Internal Scanning, designed to bring our world-class vulnerability research directly into your private ecosystems.
Read Post
mend

From Panic to Playbook: Modernizing ZeroDay Response in AppSec

Apr 21, 2026 By Shannon Davis In Mend
Why the next Log4Shell will be won or lost in the first 72 hours—and what a modern zero‑day workflow looks like. Every security team remembers where they were when Log4Shell dropped. A quiet Friday afternoon in December 2021 turned into a weekend of war rooms, emergency patches, and executive updates. Years on, the Log4j fallout still shows up in breach reports—a stubborn reminder that zero‑days don’t end when the news cycle does.
Read Post
armo

If "stdio" is a Vulnerability, So Is "git clone" - Notes on Riding the AI Vulnerability Trend

Apr 21, 2026 By Ben Hirschberg In ARMO
A developer clones a repository and opens it in VS Code at 10:47 a.m. Before their cursor blinks, six different configuration file formats on disk have a chance to execute shell commands on the host. A.vscode/tasks.json with runOn: folderOpen. A.devcontainer/devcontainer.json with initializeCommand. A post-checkout hook already sitting in.git/hooks/. A postinstall line waiting in package.json for the next dependency install. A.envrc in the project root.
Read Post
outpost 24

AI Penetration Testing: Protecting LLMs From Cyber Attacks

Apr 20, 2026 By David Ketler In Outpost 24
88% of organizations now regularly use artificial intelligence (AI) in at least one business function. While adoption of AI technologies has accelerated rapidly, security measures often lag. The rush to roll out AI has, in many cases, overshadowed essential testing and safety protocols. This is particularly a worry when AI and Large Language Models (LLMs) become deeply embedded within organizational workflows and systems in a way that most software isn’t.
Read Post

Claude Mythos Just Killed Exploitability as a Security Signal

Apr 19, 2026 By Seemplicity In Seemplicity
The game has changed. For years, security teams used exploitability to decide what to patch first. If a vulnerability had a known exploit, it went to the top of the list. If not, it waited. But with the arrival of next-gen AI models like Claude Mythos, that strategy is officially broken. In this video, we discuss how Claude Mythos has collapsed the barrier to building working exploits. What used to take real skill and significant time can now be weaponized in minutes. When everything is exploitable, exploitability becomes noise.
View Video
aikido

Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow

Apr 17, 2026 By Jorian Woltjer In Aikido
Mailcow is a widely used self-hosted and open source email server that hosts everything you'd need to manage mailboxes yourself. To assess its security, we set up a local instance and ran our AI pentesting agents against it. We found three XSS vulnerabilities, including a critical vulnerability that allowed unauthenticated attackers to take over administrator accounts while looking at their logs in the UI. Gaining access to a mailbox can have a serious security impact.
Read Post
indusface

CVE-2026-34197: Apache ActiveMQ Jolokia RCE Vulnerability

Apr 17, 2026 By Deepak Kumar Choudhary In Indusface
Apache ActiveMQ Classic, widely used as a messaging backbone in enterprise environments, carries a high-severity vulnerability tracked as CVE-2026-34197. What makes this particularly alarming is its roots. The underlying behavior enabling this vulnerability has existed for nearly 13 years, silently present across countless enterprise deployments.
Read Post
Forward Networks

How Forward Helps You Respond to CVE-2025-53521 and the CISA KEV Listing for F5 BIG-IP APM

Apr 16, 2026 By Forward Networks In Forward Networks
CVE-2025-53521 was first disclosed by F5 in October 2025 as part of their quarterly security advisory cycle. At that point, it was classified as a denial-of-service vulnerability with a CVSS v4 score of 8.7. Many security teams logged it and moved on, reasonably treating it as a lower-priority item in an already full patch queue.
Read Post
sentrium

Windows IKE Service Extensions Vulnerability Enables Remote Code Execution (CVE-2026-33824)

Apr 16, 2026 By Theklis Stefani In Sentrium
In April 2026, Microsoft disclosed and patched a critical remote code execution vulnerability affecting the Windows Internet Key Exchange Service Extensions. Tracked as CVE-2026-33824, the issue was addressed as part of Microsoft’s April 2026 Patch Tuesday release. The affected component forms part of the Windows IPsec and IKEv2 stack, which is widely used to provide secure network connectivity.
Read Post
foresiet

Zero Day SharePoint Server Spoofing via Improper Input Validation

Apr 16, 2026 By foresiet In Foresiet
CVE-2026-32201 is a spoofing vulnerability in Microsoft SharePoint Server stemming from improper input validation. It permits an unauthenticated remote attacker to spoof trusted content and resources over the network. The flaw affects on-premises deployments of SharePoint Server 2016, 2019, and Subscription Edition. Exploitation has been observed in the wild as a zero-day prior to the April 2026 Patch Tuesday release.
Read Post
cycognito

Emerging Threat: (CVE-2026-23869) React Server Components Denial of Service

Apr 15, 2026 By Igal Zeifman In CyCognito
CVE-2026-23869 is a denial of service vulnerability in React Server Components, caused by improper handling of cyclic data structures during deserialization of incoming HTTP requests. The vulnerability resides in the React Flight protocol's server-side reply handling, specifically in the createMap, createSet, and extractIterator functions within ReactFlightReplyServer.js. The vulnerability carries a CVSS v3.1 base score of 7.5 (High). Exploitation requires no authentication and no user interaction.
Read Post
foresiet

CVE-2026-21643: Pre-Authentication SQL Injection in Endpoint Management Server Leading to Remote Code Execution

Apr 15, 2026 By foresiet In Foresiet
CVE-2026-21643 is a critical SQL injection vulnerability in the administrative web interface of FortiClient Endpoint Management Server version 7.4.4. It allows unauthenticated remote attackers to execute arbitrary SQL commands through specially crafted HTTP requests, primarily by injecting malicious payloads via the Site HTTP header.
Read Post
seemplicity

Scaling Your Security Program to Match the Speed of Mythos

Apr 15, 2026 By Ravid Circus In Seemplicity
Anthropic’s Project Glasswing and the Claude Mythos model represents a fundamental change in the physics of cyber defense. With the gap between patch releases and weaponized exploits shrinking to hours, traditional manual security triage is now obsolete. Organizations must adopt AI-driven automated remediation.
Read Post
aikido

Axios CVE-2026-40175: a critical bug that's... not exploitable

Apr 14, 2026 By Mackenzie Jackson In Aikido
It’s been a chaotic few weeks for Axios. First, a major supply chain attack put the package under scrutiny. Then, just days later, headlines started appearing about a “critical 10/10 vulnerability” that could lead to full cloud compromise. If you’ve read the coverage, you’ve probably seen claims like: That sounds bad. But when you look closely at how this vulnerability actually behaves in real environments, the story changes.
Read Post
cycognito

Mythos, MOAK, CTEM and the End of CVE Chasing

Apr 14, 2026 By Igal Zeifman In CyCognito
A few weeks ago the world was exposed to Mythos, Anthropic's new frontier model and the Project Glasswing announcement that came with it. The reaction across the industry was immediate. Cybersecurity stocks fell sharply. The Treasury Secretary convened an emergency meeting with major bank CEOs. 250 CISOs produced a response playbook over a single weekend. That is not a typical announcement or a PR "leak". That is a reckoning. Then, about a week later, I came across MOAK.
Read Post
seal security

How We're Securing Our Own Supply Chain

Apr 13, 2026 By Lev Pachmanov In Seal Security
Building a supply chain security company comes with an uncomfortable truth: our remediated packages run inside our customers' production environments. A compromise on our end is a compromise on theirs. We take that responsibility seriously. I want to pull back the curtain on how we actually secure our own supply chain - from the code we write, to the artifacts we deliver, to the infrastructure that holds it all together. ‍
Read Post
ionix

Are You Ready for the CVE Avalanche?

Apr 13, 2026 By Marc Gaffan In IONIX
What the Anthropic Mythos findings mean for every security team, and the 90-day window you cannot afford to miss. Last week, Anthropic published something that should stop every CISO in their tracks. Its Mythos Preview model, running autonomously, without expert guidance, identified thousands of high- and critical-severity vulnerabilities across major operating systems, browsers, and open-source projects.
Read Post

Lightboard Lab: Closing the Valley of Visibility in Network Vulnerability Assessment

Apr 13, 2026 By CrowdStrike In CrowdStrike
Network Vulnerability Assessment is often treated as a point-in-time exercise—but real environments don’t stand still. Between long scan cycles, two things are constantly changing: network devices drift as configurations and versions evolve, and the world around them shifts as new vulnerabilities are disclosed.
View Video

I Tried 5 Prompt Injection Attacks (Here's What Happened)

Apr 13, 2026 By Snyk In Snyk
In this video, we explore the growing security risk of prompt injection in large language model (LLM) applications. As AI becomes embedded in more products, new vulnerabilities emerge, especially through natural language manipulation. We break down how LLMs work, the importance of system prompts, and demonstrate five real-world prompt injection techniques used to extract sensitive information or bypass safeguards. You’ll see live examples using different models and learn why newer models are more resilient, but still not immune.
View Video
Snyk

Governing Security in the Age of Infinite Signal - From Discovery to Control

Apr 10, 2026 By Randall Degges In Snyk
Anthropic just open-sourced vulnerability discovery at scale. Now what? A few weeks ago, Anthropic launched Glasswing, a $100 million initiative to use AI to identify vulnerabilities at scale. Around the same time, they introduced Claude Mythos, a system that can autonomously discover and exploit software flaws. I wrote about this trajectory in my previous analysis: AI accelerates discovery, but enterprise trust still depends on deterministic validation, remediation automation, and governance at scale.
Read Post
graylog

What is the OWASP Top 10 for LLM Application Security

Apr 10, 2026 By Jeff Darrington In Graylog
Initially published by the Open Worldwide Application Security Project (OWASP) in 2023, the Top 10 for LLM Application Security list seeks to bridge the gap between traditional application security and the unique threats related to large language models (LLMs). Even where the vulnerabilities listed have the same names, the Top 10 for LLM Application Security focuses on how threat actors can exploit LLMs in new ways and potential remediation strategies that developers can implement.
Read Post
armo

CVE-2026-0968: The libssh Heap Read That Isn't as Scary as Scanners Say

Apr 10, 2026 By Ben Hirschberg In ARMO
A missing null check in libssh’s SFTP directory listing code lets a malicious server crash clients, but real-world exploitability is extremely constrained. CVE-2026-0968 is an out-of-bounds heap read in sftp_parse_longname(), triggered when an SFTP client processes a crafted SSH_FXP_NAME response with a malformed longname field. Red Hat, which serves as the CNA (CVE Numbering Authority) for this vulnerability, scored it 3.1 (Low), while Amazon Linux independently scored it 4.2 (Medium).
Read Post
outpost 24

What Is a PCI ASV Scan? A Guide to PCI DSS Compliance Scanning

Apr 10, 2026 By Daniel Imber In Outpost 24
“We do not store any credit card data, we outsource it. PCI DSS is not relevant for us.” If you think this way, you are not alone, but it is a misconception. The Payment Card Industry Data Security Standard (PCI DSS), is designed to enhance the security of credit card data. It applies to all organizations that store, process, or transmit cardholder data and sensitive authentication data, or that could affect the security of the environment used for such data.
Read Post
sophos

The vulnerability flood is here. Here's what it means - and how to prepare

Apr 9, 2026 By Ross McKerchar In Sophos
We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond. Last week, Thomas Ptacek published a piece arguing that vulnerability research is cooked. His thesis: AI agents are about to drown us in a steady stream of validated, exploitable, high-severity vulnerabilities, faster than anyone can patch them. But from where I sit, the more urgent question isn't whether the flood is coming, but whether the infrastructure we depend on can absorb it.
Read Post
sophos

Adobe Reader zero-day vulnerability in active exploitation

Apr 9, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On April 7, 2026, a security researcher described an Adobe Reader zero-day vulnerability that has been exploited since at least December 2025. The vulnerability allows threat actors to execute privileged Acrobat APIs via specially crafted malicious PDF files that execute obfuscated JavaScript when opened. Exploitation allows attackers to steal sensitive user and system data and to potentially launch additional attacks and remotely execute code.
Read Post
nucleus

The NVD Funding Crisis Was Bigger Than Mythos

Apr 9, 2026 By Scott Kuffer In Nucleus
Everyone is calling Claude Mythos a watershed moment. I’d like to offer a slightly different take. Not because the capability isn’t real, it is. But if Mythos is the moment that finally convinced your organization that rapid vulnerability discovery is an existential threat, you’ve been watching the wrong thing. We saw this coming. Vulnerability Management has been moving in this direction for years, and we built Nucleus with this trajectory in mind. What surprises me is the surprise.
Read Post
seemplicity

New Data Shows Why Security Teams Can't Keep Up With AI-Driven Attacks

Apr 9, 2026 By Jessica Amado In Seemplicity
AI is changing how attacks happen, and how fast they happen. Seemplicity’s 2026 State of Exposure Management report shows why most security teams aren’t struggling to find risk, but to fix it quickly enough. Based on insights from 300 security leaders, it highlights where remediation breaks down, how AI is being used today, and why execution is becoming the real bottleneck.
Read Post
seal security

Complete Guide to Patch-in-Place SCA Remediation

Apr 9, 2026 By Alon Navon In Seal Security
A definitive guide to how automated and human-reviewed patch-in-place remediation solves both direct and transitive open source vulnerabilities - without forcing risky upgrades. Learn why traditional tools miss transitive risk, and how to evaluate modern platforms based on SLA, provenance, and CI/CD fit.
Read Post

Stop Drowning in Container CVE Alerts: Reachable Risk & Docker VEX with Mend.io

Apr 8, 2026 By Mend In Mend
Developers are often overwhelmed by thousands of container CVE alerts, most of which are unfixable base image noise. This walk-through covers how to use reachable risk factors and Docker VEX statements within the Mend.io platform to streamline your vulnerability management.
View Video
aikido

Aikido Attack finds multiple 0-days in Hoppscotch

Apr 8, 2026 By Robbe Verwilghen In Aikido
Hoppscotch is an open-source API development ecosystem, similar to Postman, with over 100,000 monthly users. Two weeks ago, we set up a self-hosted instance and ran our AI pentest agents against it. They found two high-severity vulnerabilities and one medium-severity vulnerability, all present in versions up to and including 2026.2.1, and all patched in 2026.3.0: All three were responsibly disclosed and have been resolved. Note: We accidentally grouped the XSS and an Access Control issue into one report.
Read Post
Snyk

Secure What Matters: Scaling Effortless Container Security for the AI Era

Apr 7, 2026 By Pratip Banerji In Snyk
In November, we shared our vision for the Future of Snyk Container, outlining a fundamental shift in how teams secure the modern container lifecycle. We promised a future where security doesn’t just “scan” but scales effortlessly with the speed of the AI-driven, agentic world. Today, we are thrilled to announce that we are moving from vision to reality.
Read Post
nucleus

You Can't Patch Your Supply Chain So Why Treat It Like a Vulnerability Problem?

Apr 7, 2026 By Doug Drew In Nucleus
For years, vulnerability management has followed a familiar pattern: discover assets, scan for CVEs, prioritize by severity, and remediate what you can. That model works, at least within the boundaries of systems you own. The problem is that most organizations no longer operate within those boundaries. Federal agencies especially depend on a complex ecosystem of SaaS platforms, software vendors, contractors, and open-source components.
Read Post

How Forward Helps You Respond to CISA Emergency Directive 26-03

Apr 6, 2026 By Forward Networks In Forward Networks
CISA issued Emergency Directive 26-03 in response to active exploitation of vulnerabilities in Cisco SD-WAN management systems, specifically Cisco Catalyst SD-WAN Manager and SD-WAN Controller platforms. The vulnerabilities include an authentication bypass flaw (CVE-2026-20127) that allows unauthenticated remote attackers to gain administrative privileges and manipulate network configuration, and a path traversal vulnerability (CVE-2022-20775) that enables local privilege escalation to root.
Read Post
Arctic Wolf

CVE-2026-35616: Fortinet Releases Hotfix for Critical Exploited Vulnerability in FortiClient EMS

Apr 6, 2026 By Andres Ramos In Arctic Wolf
On April 4, 2026, Fortinet released a hotfix for a critical vulnerability in FortiClient EMS (CVE-2026-35616) that allows unauthenticated remote threat actors to execute unauthorized code or commands via crafted requests. The flaw stems from improper access control in the API authentication. Fortinet has confirmed observing exploitation of CVE-2026-35616 in the wild. The vulnerability was responsibly disclosed by Defused, which had observed exploitation prior to Fortinet’s official disclosure.
Read Post
How Minimal Container Images Are Reshaping the Fight Against CVE Exposure in Modern Cloud Environments

How Minimal Container Images Are Reshaping the Fight Against CVE Exposure in Modern Cloud Environments

Apr 6, 2026 By SecuritySenses In SecuritySenses
As the adoption of containers grows across Cloud infrastructure, Cybersecurity experts and DevSecOps leaders continue to deal with the persistent surge of publicly available software vulnerabilities. The National Vulnerability Database documented an alarming figure of 29,000 CVEs for 2023, and the numbers since then show no signs of slowing down. Research shows that the majority of production container images have known vulnerabilities. This article explores the relationship between container images and CVE vulnerabilities (exposure), the growing burden of compliance, and the target risk reduction of minimal-image strategies.
Read Post
cycognito

Emerging Threat: (CVE-2026-27876) Grafana Remote Code Execution via SQL Expressions

Apr 5, 2026 By Igal Zeifman In CyCognito
CVE-2026-27876 is an arbitrary file write vulnerability in Grafana's sqlExpressions feature that can be chained with a Grafana Enterprise plugin to achieve remote code execution (RCE) on the underlying host. The flaw exists because Grafana's SQL expressions feature permits writing arbitrary files to the server filesystem. An attacker can exploit this to overwrite a Sqlyze driver or write an AWS data source configuration file, ultimately obtaining an SSH connection to the Grafana host.
Read Post
cycognito

Emerging Threat: (CVE-2026-20093) Cisco IMC Authentication Bypass

Apr 5, 2026 By Igal Zeifman In CyCognito
CVE-2026-20093 is an authentication bypass vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC), caused by improper input validation (CWE-20) in how the IMC XML API processes password modification requests. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). Exploitation is fully pre-authentication and requires no privileges and no user interaction.
Read Post
Snyk

You Patched LiteLLM, But Do You Know Your AI Blast Radius?

Apr 2, 2026 By Rudy Lai In Snyk
For a brief window, a widely used open source package in the AI ecosystem was compromised with credential-stealing malware. LiteLLM, a model gateway used to route requests to more than 100 LLM providers, has been downloaded millions of times per day. In that short window, the malicious versions were likely pulled tens of thousands of times before being caught.
Read Post
Secure Coding Techniques that Is Critical for Modern Applications

Secure Coding Techniques that Is Critical for Modern Applications

Apr 2, 2026 By SecuritySenses In SecuritySenses
Let's be honest: software ships faster today than most security teams can comfortably keep up with. Microservices, sprawling APIs, cloud-native deployments, and AI-assisted code generation have accelerated development at an unprecedented pace. But buried within that speed are small, overlooked coding mistakes that quietly open the door to serious breaches.
Read Post
tac security

Cybersecurity Firm TAC Security Hits 10,000 Clients, Enters Top 5 in Global VM & AppSec

Apr 1, 2026 By TAC Security
TAC Infosec, a global leader in cybersecurity (NSE: TAC), with presence across 100+ countries, announced a historic milestone by crossing 10,000 clients - 6,500+ of TAC Security and 3,500+ of CyberScope, since April 2024, delivering on its commitment to shareholders to achieve this by 2026.
Read Post
Snyk

Building AI Security with Our Customers: 5 Lessons from Evo's Design Partner Program

Apr 1, 2026 By Rudy Lai In Snyk
In 2025, we embarked on a new journey to secure the most important technology transformation of this decade – generative AI. Our vision is to help companies secure their AI fast, so that they can innovate on the cutting edge and put AI and agentic use cases into production. To do this, we built Evo, the world’s first agentic orchestrator for AI security. The foundation of any product is customer needs.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.