CISA’s Own GitHub Leak Offers a Candid Lesson in Secrets Management
A six-month exposure of AWS GovCloud credentials and plaintext passwords in a public repository has…
Year: 2026
CISA Adds Two Maximum-Severity Joomla Extension Flaws to Known Exploited Vulnerabilities Catalog
Zero-day exploitation of critical vulnerabilities in the iCagenda and Balbooa Forms Joomla extensions has prompted…
AI Agents Cannot Be Accountable: Why Human Ownership of LLM Projects Remains Non-Negotiable
A long-standing principle from Apple's management playbook has fresh relevance as organisations deploy autonomous AI…
Progress Software tells ShareFile customers to shut down servers amid undisclosed security threat
Progress has issued an emergency directive instructing organisations running ShareFile Storage Zone Controllers to manually…
jscrambler npm Package 8.14.0 Delivers Rust-Based Infostealer at Install Time
A compromised release of the jscrambler npm package executes malicious native binaries automatically during installation,…
Balbooa Forms Vulnerability Added to CISA Known Exploited List, Patch Deadline Set for July
An unauthenticated file upload flaw in the Balbooa Forms component can lead to full remote…
AI Uncovers 15-Year-Old Root Vulnerability in Linux Kernel
An AI-assisted audit surfaced a long-dormant privilege escalation bug in Linux, raising questions about what…
CISA Built Its Incident Response Playbook Mid-Breach After Contractor Leaked Credentials on GitHub
The US cybersecurity authority's own credential exposure incident revealed a gap in its internal playbook…
Microsoft patches seventh Nightmare Eclipse zero-day as Defender race condition gets a quiet fix
CVE-2026-50656 closes the RoguePlanet chapter, but the broader tensions over vulnerability disclosure and bug bounty…
GhostApproval: Symlink Flaw Exposes AI Coding Agents to Workspace Escape and Remote Access
A vulnerability pattern affecting six major AI coding assistants lets attackers use decades-old symlink tricks…