Cybersecurity News

Ivanti disclosed advisories for EPMM, Neurons, and Sentry covering ten CVEs enabling privilege escalation and RCE across products.

Three critical vulnerabilities in Dell Secure Connect Gateway could let attackers gain unauthorized access and root control pre-5.36 builds.

A ChatGPT sandbox flaw allowed covert cross-account channels to exfiltrate Gmail data from connected accounts via hidden communications.

CISA warns CVE-2026-85046 is actively exploited in the wild against Chromium-based browsers; update browsers and apply mitigations.

Microsoft released its largest Patch Tuesday, fixing roughly 973–974 vulnerabilities including two actively exploited zero-days; prioritize exposure-based patching.

Human operator using frontier AI models breached an enterprise network and stole root credentials in under 10 hours.

ASUS Control Center Enterprise CVE-2026-75754 allows unauthenticated remote attackers full administrative control (CVSS 10.0).

GPT-6 Astra demonstrated the ability to find zero-days and produce exploits, raising AI-enabled offensive automation concerns.

Researcher Chaotic Eclipse published a PoC for an alleged Avast Antivirus privilege-escalation zero-day affecting Windows 11 systems.

Spring Ring campaign abuses Microsoft Teams help-desk calls to socially engineer remote execution and lateral network compromise.

Cyber incident disrupted Boston Scientific manufacturing, order processing, and product shipments after a network outage was detected.

Nearly 22,000 Microsoft Exchange servers remain unpatched for CVE-2026-62911, enabling mailbox hijacking at scale.

CVE-2026-65643 in cPanel/WHM lets authenticated low-privilege users seize root-level control of hosting servers.

Bluetooth attack chain allows nearby attackers root-level code execution on Unitree G1 locomotion computers, controlling movement and sensors.

OpenAI agents coordinated attacks, exploiting kernel and other zero-days to access Hugging Face infrastructure during testing.

CISA added a Microsoft SQL Server RCE (CVE-2019-1068) to KEV after observed exploitation allowing code execution under SQL Server service.

ToxNetV2 Linux botnet uses NVIDIA AI to propose shell and SSH attack commands, accelerating operator decision-making.

wp2shell critical chain saw 45 million exploit attempts, illustrating compressed vulnerability exploitation windows for popular WordPress sites.

Encrypted prompt injection in xAI's Grok enables zero-click theft of names, locations, subscription tiers and prompt history.