Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Webinar: SafeBreach Validate + Propagate = Better Together

Oct 10, 2025 By SafeBreach In SafeBreach
Webinar: SafeBreach Validate + Propagate = Better Together Discover how combining SafeBreach Validate and Propagate empowers security teams to continuously assess and strengthen their defenses. In this session, our experts will show how integrated breach and attack simulation (BAS) with automated attack path validation can help you.
View Video
squarex

SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution

Oct 9, 2025 By SquareX
As AI Browsers rapidly gain adoption across enterprises, SquareX has released critical security research exposing major vulnerabilities that could allow attackers to exploit AI Browsers to exfiltrate sensitive data, distribute malware and gain unauthorized access to enterprise SaaS apps. The timing of this disclosure is particularly significant as major companies including OpenAI, Microsoft, Google and The Browser Company have announced or released their own AI browsers. With Chrome and Edge alone representing 70% of the browser market share, it is very likely that the majority of consumer browsers in the future will be AI Browsers.
Read Post
bitsight

GeoServer CVE-2024-36401: Tailoring a Public PoC to Enable High-Confidence Detection

Oct 9, 2025 By Fábio Freitas In BitSight
At Bitsight, one of the responsibilities of the Vulnerability Research team is to develop fingerprinting methods to not only identify exposed services, but also vulnerabilities in those services. When it comes to detecting vulnerabilities, there are increased challenges depending on the complexity of both the vulnerability and the vulnerable service.
Read Post
salt security

Anatomy of a Modern Threat: Deconstructing the Figma MCP Vulnerability

Oct 9, 2025 By Eric Schwake In Salt Security
Threat researchers recently disclosed a severe vulnerability in a Figma Model Context Protocol (MCP) server, as reported by The Hacker News. While the specific patch is important, the discovery itself serves as a critical wake-up call for every organization rushing to adopt AI. This incident provides a blueprint for a new class of attacks that target the very infrastructure powering the AI Agent Economy. To understand the risk, we must first look at the mechanics of this emerging threat.
Read Post
bitsight

CVE-2024-36401 - GeoServer - tailoring a public PoC to enable at-scale high-confidence detection

Oct 9, 2025 By Fábio Freitas In BitSight
At Bitsight, one of the responsibilities of the Vulnerability Research team is to develop fingerprinting methods to not only identify exposed services, but also vulnerabilities in those services. When it comes to detecting vulnerabilities, there are increased challenges depending on the complexity of both the vulnerability and the vulnerable service.
Read Post
Feroot

How to Prevent Cross-Site Scripting (XSS) on Payment Pages

Oct 9, 2025 By Feroot In Feroot
Many teams believe that cross-site scripting, or XSS, is a problem of the past. Modern frameworks promise built-in protections, and developers often assume the browser will handle the rest. The reasoning sounds logical: if React auto-encodes output, XSS can’t happen. However, XSS prevention doesn’t work on assumptions; it works on visibility. We’ve learned that XSS prevention is about maintaining continuous control over the browser environment where your application runs.
Read Post
Arctic Wolf

SonicWall Concludes Investigation Into Incident Affecting MySonicWall Configuration Backup Files

Oct 8, 2025 By Stefan Hostetler In Arctic Wolf
On September 17, 2025, SonicWall released a knowledge base article detailing the exposure of firewall configuration backup files stored in certain MySonicWall accounts. As of October 8, 2025, the investigation has concluded and SonicWall has updated their advisory accordingly.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.