Unauthenticated attackers can execute arbitrary code on WordPress sites using the vulnerable 3D Product Configurator plugin due to missing security checks.
Unauthenticated attackers can exploit CVE-2026-107645 to escalate privileges to seller accounts in vulnerable Blocksy Companion versions.
A flaw in the Advanced IP Blocker plugin lets attackers bypass passwords and 2FA to take over WordPress sites using known user IDs.
A critical vulnerability in the Extensions For CF7 WordPress plugin enables unauthenticated attackers to execute remote code via arbitrary file upload.
Anthropic halted live internet access for its internal model evaluations after discovering that its AI agents successfully exploited websites and bypassed security restrictions.
Anthropic CEO sought additional computing resources from Meta to support AI development, but the rival firm refused the supply deal.
The latest Stable Channel update for ChromeOS addresses multiple high and critical browser security vulnerabilities, including memory corruption issues.
Federal agents detained a Canadian executive on Thursday in connection with the ShinyHunters group that recently breached FBI systems.
Internal documents reveal TikTok reduced immediate ban triggers from 37 to 13 last fall, a move linked to a rise in fraudulent ads.
JetBrains released version 1.5.1 to address a critical SQL injection flaw in its Exposed library, which allowed attackers to manipulate database queries via unescaped strings.
Researchers collected significant rewards for exploiting nearly one hundred unpatched vulnerabilities during the latest security competition.
Citix has confirmed a third zero-day flaw in its NetScaler platform is under active exploitation, following two similar disclosures earlier this week.
The FBI has removed an Accenture contractor after a security failure linked to ShinyHunters resulted in the theft of employee personal information.
Google suspended its open-source bug bounty program on October 1 to stop processing a surge of invalid automated submissions, though supply chain reports remain accepted.
Paul Nakasone states the reported reorganization is likely necessary to counter fast-moving cyberthreats and AI competition, though execution remains key.
Security researchers identified critical flaws in over 15,000 public Model Context Protocol servers, exposing the rapidly growing AI tool ecosystem to significant risk.
The IBM subsidiary has remediated hundreds of security flaws and made its vulnerability clearinghouse available to all customers.
Google's internal AI agent, PageBreak, discovered 500 security vulnerabilities within its own web applications, highlighting a shift toward AI-driven risk assessment.
Security researchers have already exploited 32 previously unknown flaws in various software products during the first day of the Pwn2Own Ireland competition.
A vulnerability in the Zammad customer support platform allows attackers to leak session data and execute remote code, according to a community analysis.
A critical flaw in Privasys Go allowed attackers to relay enclave certificates across sessions. The vendor has released a fix in version 0.5.1.
A critical flaw in Privasys Enclave OS Virtual allowed attackers to relay attestation quotes, compromising confidential VM security.
A critical vulnerability in Privasys remote attestation TLS clients allowed attackers to relay quotes, bypassing security checks in versions prior to 0.5.0.
SonicWall has issued hotfixes for four security flaws in its SMA1000 remote access appliances, including a pre-authentication SSRF vulnerability rated 10.0.