Aggregator

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks. [...]

It includes the new agentic model MAI-Cyber-1-Flash and the Project Perception platform, with the tech giant claiming it’ll do a better job than its rivals at half the cost.

The post Microsoft debuts AI cybersecurity offerings as competition heats up appeared first on CyberScoop.

In a Monday filing, the Justice Department said states sued before agencies even decided how the order would work.

The post Trump asks Supreme Court to let him curtail mail-in voting ahead of midterms appeared first on CyberScoop.

Reuters says OpenAI failed to detect its AI agent hacking Hugging Face for days, discovering the breach only after FBI involvement. Reuters reported that the OpenAI agent responsible for the Hugging Face breach operated undetected for over a week before OpenAI realized what had happened, long after the FBI had been alerted and Hugging Face […]

PleaseFix class of flaws makes it easy to socially engineer agentic browsers and highlights weaknesses in how they handle cross-origin requests.

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. [...]

A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain. [...]

This category of vulnerabilities allows an attacker to easily acquire administrative level permissions and bypass cloud providers' access controls.

Certighost allowed a low-privilege domain user obtain a valid Domain Controller certificate through AD CS. Microsoft patched the issue in the July security updates.

Intelligence Committee member Ron Wyden wants CISA, OMB and NIST to lead a federal effort to rout out obsolete VPNs from the U.S. government.

An FBI agent explains how the mulitnational law-enforcement Operation Cronos was successful in disrupting the largest ransomware group of its time.

A forum user posting as ChimeraZ has published what they describe as the database of Allo.Solar, a French e-commerce platform selling photovoltaic and renewable energy equipment.

Microsoft has introduced MAI-Cyber-1-Flash, a security-focused AI model built into MDASH, the company’s multi-agent vulnerability identification and remediation system. MAI-Cyber-1-Flash is Microsoft’s first model built specifically for cybersecurity work, and the company stated that it went through review by its AI Red Team, adversarial testing, and an assessment by an outside party. Microsoft argues that advances in AI are giving attackers increasingly powerful capabilities to search large codebases for vulnerabilities, increasing the need for AI … More →

The post Microsoft unveils MAI-Cyber-1-Flash, promises cybersecurity AI at half the cost appeared first on Help Net Security.

A vulnerability categorized as critical has been discovered in Vercel Next.js up to 16.2.10. Affected by this issue is some unknown functionality of the file config.i18n of the component App Router. The manipulation of the argument locales results in improper authentication. This vulnerability was named CVE-2026-64642. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in Creativeitem Ekushey Project Manager CRM up to 5.0. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Ticket Title Field. The manipulation of the argument Ticket Title leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-66030. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in Creativeitem Ekushey Project Manager CRM up to 5.0. It has been declared as problematic. Affected is an unknown function of the component Edit Profile. Executing a manipulation of the argument client Name can lead to cross site scripting. This vulnerability is handled as CVE-2026-66029. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in Vercel Next.js up to 15.5.20/16.0.0-16.2.10. It has been classified as critical. This impacts the function rewrites/redirects. Performing a manipulation results in server-side request forgery. This vulnerability is known as CVE-2026-64645. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Vercel Next.js up to 15.5.20/16.2.10 and classified as problematic. This affects an unknown function. Such manipulation leads to resource consumption. This vulnerability is traded as CVE-2026-64641. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Roskus Prospero Flow up to 5.4.3 and classified as problematic. The impacted element is an unknown function of the component Email Module. This manipulation of the argument email causes cross site scripting. This vulnerability appears as CVE-2026-59239. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.