Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Companies rush to utilise the potential of large language models; however, every new use case of generative AI introduces attack vectors previously unknown in traditional web security. The present guide provides an overview of the official OWASP GenAI LLM Top 10 2026 list and explains the appearance of each vulnerability in practice along with mitigation recommendations.

Today, pub.dev joins the list of package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is the first compromised package we have detected on pub.dev, the official package repository for Dart and Flutter. Unlike the recent npm supply chain attacks you might be familiar with, this was not a case of someone deliberately targeting this package.

On 6 September 2026, researchers publicly described a Telegram zero-day crash. A group owner said a chat they own became unreachable: opening it crashed official clients on iOS, Android, Desktop and Web. A second researcher posted a short recording of a script sending one specially prepared sticker into a test chat. The harm is availability, not account takeover. If the sticker stays in chat history, the crash can happen again every time someone opens that conversation.

An old package or a misconfigured cloud storage bucket can be identified by a legacy scanner, but it does not account for the unique risk profile of autonomous systems. It cannot confirm that an AI agent with access to your production environment can chain together a CRM read, an email send and a production write using inherited credentials. Your agents are dynamic: they plan, call tools, and act across multiple environments, and some may retain context or long-term memory beyond the original request.

CVE-2026-67281 is an unauthenticated file read vulnerability in WebFig, the web-based management interface in MikroTik RouterOS. A newly allocated session on the /jsproxy path retains a stale, uninitialized principal pointer that WebFig then uses for file authorization decisions. The vulnerability carries a CVSS v4.0 base score of 8.7 (High). A CVSS v3.1 base score has not been assigned in the CVE record at the time of writing.

On September 3, 2026, a security researcher known as Nightmare Eclipse/Chaotic Eclipse publicly disclosed a zero-day dubbed ‘FalconFlank’ which abuses the Office malicious macro remediation workflow in CrowdStrike Falcon Sensor. The attack leverages a time-of-check to time-of-use (TOCTOU) race condition, allowing an attacker with code execution on a vulnerable system to hijack the Falcon macro remediation routine. This results in DLL side-loading and execution as NT AUTHORITY\SYSTEM.

What security teams need to know about an unverified local elevation-of-privilege proof of concept published against Falcon Sensor, and how to respond without overreacting. On 3 September 2026, an independent researcher publishing as MSNightmare / Chaotic Eclipse / Nightmare Eclipse released a public GitHub repository named FalconFlank. The project is described as a local privilege-escalation proof of concept against CrowdStrike Falcon Sensor on Windows.

You're almost out of time on an SLA on a critical dependency vulnerability, but you have no room in the current sprint for the manual testing needed to make sure you don't break production. Missing the remediation deadline itself is a finding in your next SOC 2 or ISO 27001 report, but the risk of exploitation is also growing with advancing AI models.

A critical remote code execution vulnerability has been identified in Langflow. The vulnerability was first reported to the vendor in mid-2025 and disclosed publicly as a zero-day in January 2026. Exploitation attempts rose sharply in late August 2026, moving from isolated probing to continuous, multi-source scanning within days.

When a vulnerability is urgent but the full fix isn’t immediately safe to deploy, security teams need another way to reduce risk fast. Seemplicity’s Response Options uses AI to identify and rank multiple ways to neutralize a threat – including patches, configuration changes, compensating controls, and network-level mitigations — based on risk reduction, effort, and operational impact.

Nucleus Insights flagged 14 vulnerabilities with real-world exploitation activity that looked risky before CISA added them to KEV. The key takeaway: all 14 were later listed in KEV. Acting on those signals would have been the right call every time, just earlier.

Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? To answer that question, Cloudflare is announcing early access to Vulnerability Discovery and Remediation, now part of Cloudflare Managed Defense. Vulnerability Discovery and Remediation is a new, invitation-only Cloudflare service that helps customers detect and mitigate vulnerabilities in their codebases.

Seemplicity’s new Response Options feature gives teams multiple ways to respond to a confirmed finding, not just a single full-fix recommendation. AI Analysts surface and rank fix, neutralization, and mitigation paths based on security impact, deployment risk, and effort, helping teams reduce exposure faster while making safer, more informed remediation decisions. Every exposure management program eventually hits the same wall.

On 26/05/2026, a security researcher at Astra Security found a critical Remote Code Execution (RCE) vulnerability in UpSnap, a web-based wake-on-LAN(WoL). The root cause is an OS Command Injection vulnerability(CWE-78) that exists in UpSnap’s device management functionality due to unsafe template interpolation of the IP and MAC fields.

CVE-2026-81891 is an unrestricted file upload vulnerability in Studio 42 elFinder, an open source web file manager embedded in a wide range of PHP applications and content management systems. The flaw sits in the checkExtractItems() function in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize().

Learn how the OWASP Top 10 CI/CD Security Risks map the modern software delivery attack surface, and why credential hygiene sits at the center of so many real-world failures.