Vulnerabilities
19 articles RSS
Google Patches Qualcomm Zero-Day Exploited in Targeted Android Attacks as March Update Fixes 129 Vulnerabilities
Google's March 2026 Android security update addresses 129 vulnerabilities including an actively exploited Qualcomm graphics flaw affecting 235 chipsets and a critical remote code execution bug in Android 16.
CISA Adds Actively Exploited VMware Aria Operations Flaw to KEV Catalog, Gives Federal Agencies Three Weeks to Patch
A command injection vulnerability in Broadcom's VMware Aria Operations is under active exploitation, prompting CISA to set a March 24 federal remediation deadline.
Cisco SD-WAN Zero-Day Exploited for Three Years Before Patch, CISA Issues Emergency Directive
A maximum-severity authentication bypass in Cisco Catalyst SD-WAN has been actively exploited since 2023 by a sophisticated threat actor, prompting a CISA emergency directive requiring federal agencies to patch or disconnect affected systems.
AI-Augmented Threat Actor Breached 600 FortiGate Firewalls in Five Weeks Using Commercial LLMs, Amazon Warns
Amazon Threat Intelligence tracked a low-skill actor who used DeepSeek and Claude to compromise 600+ FortiGate devices across 55 countries, signaling AI is lowering the barrier to large-scale cyberattacks.
Microsoft Patches Six Actively Exploited Zero-Days in February 2026, Matching Last Year's Record High
Microsoft's February Patch Tuesday fixes 58 flaws including six zero-days already under attack, with CISA ordering immediate federal remediation.
OpenAI Introduces Trusted Access for Cyber, Gates Its Most Capable Security Model Behind Identity Verification
OpenAI launches a tiered access framework for cybersecurity professionals alongside $10 million in API grants, as GPT-5.3-Codex becomes the company's first model rated 'high' for cyber risk.
BeyondTrust Patches Critical Pre-Auth RCE Flaw Rated 9.9 as 11,000 Instances Sit Exposed on the Internet
A CVSS 9.9 command-injection bug in BeyondTrust Remote Support and Privileged Remote Access lets unauthenticated attackers execute OS commands, echoing the zero-days that gave Chinese state hackers access to the U.S. Treasury in 2024.