Daily news, analysis and practical guides explaining what happened, who is affected and what to do next. We also turn this knowledge into practical training for organisations.
Supply Chain Security CVE-2026-82417 and CVE-2026-82562 show how a hostile object shape and commas under a[] can violate parser assumptions, causing exceptions or memory pressure.
Cloud, Infrastructure and DevSecOps A certificate-validation flaw lets an on-path attacker capture vCenter administrator credentials during routine CPI calls.
AI Security CVE-2026-19286 and CVE-2026-19295 show how a public agent, type evaluation and inconsistent authorization can compromise an AI platform server.
Cloud, Infrastructure and DevSecOps CVE-2026-81490, 81517, 81518 and 81520 show how a SQL-to-MongoDB bridge can expose data or lose availability before authentication completes.
Threats and Incidents A technical analysis of the GRU-linked campaign: backdoored installers, OpenSSH/Tor tunnels, smart-contract infrastructure and Android data theft.
Cloud, Infrastructure and DevSecOps CVE-2025-30156, CVE-2026-39944, CVE-2026-50152 and CVE-2026-54330 show how encryption without integrity and inconsistent authorization lead to cluster compromise.
AI Security Missing authorization in the iLink integration lets an attacker sign out a bot or bind their account to another tenant's application. FastGPT 4.15.2 fixes it.
Vulnerabilities and CVEs Fireware OS 2026.2.2, 12.12.2 and 12.5.20 fix overflows, type confusion and double-free bugs in IKE handling plus a critical Mobile Security flaw.
Cloud, Infrastructure and DevSecOps Six CVEs cover two cluster.key leaks, worker file writes, path traversal and argument injection in Active Response, plus an agent-enrolment crash.
Identity and Access KubePi through 1.6.15 mixed public login routes with OIDC and SAML administration. Analysis of takeover, SSRF, version 2.0.0 and safe migration.
Cloud, Infrastructure and DevSecOps CVE-2026-77298, CVE-2026-77317, CVE-2026-77368 and CVE-2026-77611 show how separate data paths can bypass a shared authorization policy.
AI Security CVE-2026-47851 and CVE-2026-47852 affect document ingestion and model caching. Analysis of RAG availability, artifact integrity and Spring AI fixes.
Vulnerabilities and CVEs Tomcat 11.0.25, 10.1.58 and 9.0.121 close constraint bypasses, a fail-open Realm path, RewriteValve errors, HTTP/2 DoS and persistent WebSocket sessions.
Identity and Access OSSA-2026-037 covers CVE-2026-80182 and CVE-2026-80184: delegated tokens could extend access lifetime and cross an intended project boundary.
Identity and Access DPoPProofJwtDecoderFactory could forget a used jti after cache pressure. We explain replay preconditions, fixed versions and OAuth 2.0 monitoring.
Once a month, a concise summary of the vulnerabilities and threats that matter. No spam, unsubscribe anytime.
