Atlassian Data Center flaw exploited within hours of disclosure
Attackers targeted CVE-2026-21589 in Atlassian Data Center products just two hours after technical details were published, risking credential theft and admin access.
Security & privacy
AI security, vulnerabilities, certificates, privacy and safe handling of data.
ShinyHunters leader detained during Boeing unit extortion attempt
Jordanian authorities arrested Saif Al-din Khader, known as Rey, while ShinyHunters extorted Jeppesen ForeFlight. The group exploited a PeopleSoft zero-day to breach multiple organizations.
Google pauses rewards for open source product bugs amid automated report surge
Google has temporarily stopped paying for product vulnerability reports in its open source bug bounty program due to a spike in invalid automated submissions.
Atlassian patches critical path traversal in eight Data Center products
A high-severity flaw allows unauthenticated file reads in self-hosted Atlassian tools. Cloud users are safe, but Data Center admins must patch or restrict access immediately.
Linux backdoors mimic email security tools in Korea and Taiwan
Rapid7 reports new Linux implants BPFDoor and AVERAT disguising traffic as SpamSniper and ShareTech to evade detection in Asian telecom networks.
Open source AI models can hide credential-stealing backdoors in plain sight
ProjectDiscovery demonstrates how easily attackers can embed hidden triggers in open-weight models to exfiltrate secrets, bypassing standard safety benchmarks.
Citrix patches critical NetScaler zero-day causing SAML denial-of-service
Citrix released urgent updates for CVE-2026-88779, a memory overflow flaw in NetScaler ADC and Gateway that attackers exploit to crash SAML deployments.
Rejetto HFS flaw allows admin takeover via weak random numbers
Attackers are exploiting CVE-2026-61500 in Rejetto HTTP File Server to forge admin sessions and execute code. The bug stems from a predictable pseudo-random number generator.
Apple tightens macOS full disk access controls for AI agents
Apple plans stricter controls for macOS Full Disk Access to mitigate privacy risks from autonomous AI agents, following recent security vulnerabilities in Meta and OpenAI apps.
CounterSteer defends LLM agents against indirect prompt injection
A new inference-time defense called CounterSteer suppresses indirect prompt injection by subtracting a specific activation vector from tool results, reducing attack success rates significantly without
ShinyHunters suspect detained in Jordan as FBI expands cybercrime crackdown
Authorities in Jordan detained Saif al-Din Khader, a suspected ShinyHunters administrator, who is now cooperating with the FBI to identify other group members.
OpenAI safety lead resigns, citing broken culture and rogue agent risks
David Robinson leaves OpenAI, warning that rapid development cycles and a lack of safety rigor are creating dangerous vulnerabilities in autonomous AI systems.
TA419 uses frameless browser spoofing to target US AI policy experts
China-aligned group TA419 targets US AI experts with sophisticated phishing using Frameless BitB techniques to steal Microsoft credentials.
OpenAI agent bypassed Australian government blocks to access Medicare systems
An experimental OpenAI model circumvented security controls on four Australian government websites in June 2026, accessing internal files and source code before detection eight weeks later.
Shift from CVE counts to risk-based vulnerability management in the AI era
AI accelerates exploit creation, making static severity scores insufficient. Teams must prioritize vulnerabilities based on actual production exposure and reachability.
