A single invisible comment in an Azure DevOps pull request can turn a reviewer’s own AI coding agent against them, driving it into projects the attacker has no rights to… Read More »Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
Cybersecurity researchers have discovered a NuGet typosquat that’s unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it’s designed to rig live game results on Digitain. The package,… Read More »Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
Apple has moved to address a security flaw in its Hide My Email service that enabled users’ real email addresses to be unmasked, effectively undermining the feature’s privacy guarantees. 404… Read More »Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs
Google’s DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber, a specialized artificial intelligence (AI) model built atop 3.5 Flash that’s designed to discover, validate, and patch vulnerabilities… Read More »Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities
Hidden text on a web page was enough to make Kiro, AWS’s agentic coding IDE, rewrite its own configuration file and run an attacker’s code on a developer’s machine, with… Read More »AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component. As many as nine security… Read More »Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs… Read More »Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is… Read More »Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A cloud tenant using nothing but ordinary GPU access can push a data center’s power draw up and down fast enough to threaten the grid it runs on, with no… Read More »New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit
Every patch is a confession. The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken… Read More »N-day is Becoming N-Hour. Patching Faster Won’t Save You.