Every Cybersecurity story tagged Vulnerabilities.
Anthropic has expanded its Cyber Verification Program, offering vetted cybersecurity professionals reduced safeguards on advanced AI models like Claude Opus 5.5 for vulnerability discovery. The move follows Project Glasswing's identification of over 129,000 verified software vulnerabilities.
LibreOffice and Apache OpenOffice contain a critical vulnerability allowing malicious spreadsheets to execute arbitrary Java code without macro warnings.
A new Linux backdoor named ClingSTUN hijacks internet-facing IoT devices by exploiting two dozen known, unpatched vulnerabilities.
Fortra has released patches for eight vulnerabilities in its BoKS Privileged Access Manager, three of which are critical.
GitLab has patched a critical 9.9-rated RCE vulnerability, CVE-2026-90970, in its self-hosted AI Gateway.
Five threat clusters exploited a critical remote code execution flaw in BeyondTrust products within a week of its disclosure.
A DARPA-backed AI security startup, Xint, identified three critical vulnerabilities in Signal's Android app during a one-hour scan.
Two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway appliances are under active exploitation.
Zenity Labs disclosed three critical zero-click vulnerabilities in Salesforce Agentforce, collectively named SalesBleed.
F5 has released hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in BIG-IP APM. The flaw, a heap-based buffer overflow with a CVSS score of 9.8, allows unauthenticated remote code execution on systems where APM serves as an OAuth authorization server.
Siemba has launched automated testing for insecure direct object reference (IDOR) vulnerabilities in REST, GraphQL, and SOAP APIs.
A malicious npm campaign impersonating a legitimate library evades GitHub's latest security measures by hiding malware in runtime code, not install scripts.
A critical vulnerability in SAP's Extended Passport processing allows unauthenticated attackers to achieve remote code execution.
The U.S. Cybersecurity and Infrastructure Security Agency has released new guidance for critical infrastructure operators on deploying decoy systems.
CISA has revised its Insider Threat Mitigation Guide with new case studies and guidance addressing hybrid work, AI deception, and employee separations.
Acting CISA Director Nick Andersen warns that decades of bad decisions and overwhelming technical debt have left the U.S.
Akeyless has released Agentic Runtime Authority, a real-time enforcement layer that blocks unauthorized AI agent actions in production environments.
North Korean-aligned threat actors have deployed a new Linux espionage toolkit targeting automotive and media organizations in South Korea.
Anthropic's Claude Mythos Preview AI identified over 23,000 potential vulnerabilities in open-source projects.
The FulcrumSec threat group claims to have leaked 550GB of stolen customer data from the Manchester Airports Group.
Attackers are exploiting an unpatched critical vulnerability in Magento Open Source and Adobe Commerce, installing persistent backdoors.
OpenAI announced a $1 billion subsidy program on September 3, 2026, to provide its Daybreak AI security platform to under-resourced critical infrastructure.
Threat actors have launched numerous exploit attempts against critical remote code execution flaws in the WordPress plugins Super Forms and Elementor.
OpenAI is providing $1 billion in credits for its Daybreak cybersecurity models to support defenders in critical infrastructure sectors like water and power.
Google, Anthropic, and OpenAI have each announced new AI models and access programs focused on cybersecurity. Google's Gemini 3.8 Flash Cyber is offered to trusted defenders, Anthropic detailed safeguards for its Claude models, and OpenAI said its Astra model meets a 'Critical' capability threshold for autonomous cyber operations.