Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,239 stories synthesized.
ISMG editors convened to discuss the persistent problem of sensitive data mishandling, the growing risks posed by cybersecurity debt amplified by AI, and escalating geopolitical tensions fueling concerns over Iranian attacks on U.S. critical infrastructure.
Stacklok releases ToolHive, an open-source platform designed to containerize and secure Model Context Protocol (MCP) servers, enhancing the safety of AI client interactions with external tools.
Traditional zero trust security models are insufficient for autonomous AI agents, requiring a new approach focused on trusted runtimes and continuous behavioral identity security, according to Teleport's Chris Webber.
Key findings • 13 npm packages disclosed in under a minute on September 7, 2026. • Many packages impersonate 'wallet' or 'base-account' related functionalities. • All packages were publis…
This week's cybersecurity news highlights critical zero-day exploits in Google Chrome and e-commerce platforms, alongside vendor advisories for VMware and an ongoing investigation into a potential privilege escalation flaw in CrowdStrike's Falcon Sensor.
Key findings • 40 malicious npm packages disclosed within a 2-minute window on 2026-09-06. • All packages share the common prefix eka-, indicating a coordinated campaign. • All advisories…
Key findings • Ten vulnerabilities disclosed for SourceCodester Class and Exam Timetabling System 1.0 between Sept 4-6, 2026. • Nine SQL injection flaws found across multiple administrative a…
MikroTik has released a patch for a critical vulnerability enabling SSH authentication bypass, which is actively being exploited by attackers to establish persistence on affected devices.
CrowdStrike launches SafeMind, an agentic AI system featuring dual offensive and defensive models designed to autonomously detect and remediate cyber threats.
A critical vulnerability (CVE-2026-75754) in ASUS Control Center Enterprise allows remote attackers to gain complete administrative control over managed systems.
Threat actors are exploiting internet-exposed MikroTik routers by gaining administrative control through unauthenticated SSH access, with attacks dating back to early September.
A critical zero-day vulnerability, dubbed StyleSmuggler, is being actively exploited in unpatched Magento Open Source and Adobe Commerce platforms, allowing unauthenticated attackers to execute arbitrary code and backdoor e-commerce stores.
Key findings • 40 malicious npm packages were disclosed on September 5, 2026. • All packages were disclosed within a rapid 23-minute window. • The burst includes packages under the shared…
JetBrains has reported a security incident where attackers exploited a critical vulnerability in its TeamCity CI/CD platform to breach its own Cadence environment, prompting urgent calls for credential rotation.
Key findings • Seven vulnerabilities disclosed for Grav CMS between 2026-09-04 and 2026-09-05, ranging from Medium to High severity. • Key risks include Remote Code Execution (CVE-2026-85604)…
Key findings • Five vulnerabilities disclosed for Grav CMS between 2026-09-04 and 2026-09-05, ranging from Medium to High severity. • Privilege escalation flaws in grav-plugin-api allow non-s…
Key findings • Critical stored XSS (CVE-2026-84803) due to incomplete extension blocklist in asset serving. • High-severity path traversal (CVE-2026-85175) allows access to sensitive TLS/CA k…
Key findings • 25 WWBN AVideo vulnerabilities disclosed between Sep 1-5, 2026, including critical flaws. • Critical vulnerabilities include indefinite password resets, auth bypasses, and path…
Microsoft is investigating a widespread issue causing its Windows desktop client for Teams to fail loading or experience significant delays, impacting user productivity.
Perplexity AI's open-source tool, numbat, provides critical observability for AI agents, addressing concerns about uncontrolled proliferation and excessive privileges.
European Parliament members are calling for Serbia's EU accession process to be slowed due to credible reports of state-sponsored spyware use against activists and opposition figures.
Microsoft outlines critical security considerations for organizations deploying AI systems on customer-owned infrastructure, emphasizing new attack vectors and necessary defenses.
An executive order aims to secure the U.S. bulk electric power market's supply chain against adversary nations, including China, citing risks of backdoors in critical infrastructure.
Key findings • 25 Linux kernel vulnerabilities disclosed together on September 4, 2026. • Vulnerabilities affect diverse subsystems including SELinux, graphics, and networking. • Fixes ad…