-
Muse sleep band users weren’t told their brain data was training AI
Technology companies have spent years trying to get into your head for profit. Now they’re doing it …
-
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
The in-house Python script behind eMudhra’s October key compromise has now cost the company 8 more of its intermediate certificate …
-
Rubrik enhances DevOps Protection to preserve legitimate work during recovery
Rubrik has announced cyber recovery capabilities for DevOps platforms Microsoft Azure DevOps and GitHub. With built-in anomaly detection, …
-
We Built An Agent That Broke All of Our Security Rules. Here’s What We Learned.
We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and …
-
The supermarket fridge hack exposes the cracks in tech vision of an ‘internet of things’
Imagine opening a supermarket in the morning to find the freezer aisle dripping, the floor wet, and thousands of euros’ worth of food …
-
Shipping giant Maersk probes ‘IT security incident,’ data theft
Shipping behemoth A.P. Moller-Maersk says it is investigating “an IT security …
-
Microsoft Teams AI Phishing Detection: Rollout and Deepfake Warnings
Microsoft Teams is introducing AI phishing detection for external chats, while separate deepfake detection will require third-party …
-
NCSC scheme will help critical organisations test their cyber defences
New NCSC Cyber Adversary Simulation scheme will help critical organisations strengthen their resilience through rigorous, real-world …
-
Microsoft Patch Tuesday fixes Outlook flaw already under attack
Microsoft’s November Patch Tuesday fixes more than 1,000 Microsoft vulnerabilities, including an Outlook flaw that attackers are already …
-
How LinkedIn, Netflix & DoorDash Run Agents, Evals & Inference in Production: QCon AI New York 2026
QCon AI New York 2026 has published its full schedule for December 15–16. Engineers from LinkedIn, Netflix, DoorDash, Figma, and other …
-
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
We break down the Citrus Ransomware group’s attacks: the attackers’ TTPs and tooling, including VLESS traffic tunneling and LLM use, plus …
●●●
NVD
- CVE-2026-126627 – Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics …
- CVE-2026-126496 – 1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in …
- CVE-2026-126497 – LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the …
- CVE-2026-126495 – MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that …
- CVE-2026-126188 – Active Storage makes it simple to upload and reference files in cloud services and attach …
EXPLOITS
- Ruflo MCP Bridge 3.16.2 – Remote Code Execution
- PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- South River Technologies Titan MFT Server 26.0.0 – code execution
SECURELIST
- Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
- IT threat evolution in Q3 2026. Mobile statistics
- IT threat evolution in Q3 2026. Non-mobile statistics
- Virtualization security: attack layers and misconfiguration impact
- The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603