⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a maximum-severity (CVSS 10.0) security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its KEV catalog, citing evidence of active exploitation. The vulnerability, CVE-2026-21962, allows an unauthenticated attacker with network access via HTTP to compromise instances or modify critical data.
The U.S. sanctioned several Iranian nationals for cyberattacks on critical infrastructure just days after reports emerged of a cyber intrusion on a small power plant in the United Kingdom.
CISA has issued a three-day deadline for agencies to patch CVE-2026-73570, a critical Zimbra vulnerability that allows full takeover of user communications. The flaw is actively exploited in the wild, with CISA adding it to the KEV catalog.
An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers used by multiple U.S. broadband providers allows remote, unauthenticated attackers to create port-forwarding rules that can expose local network devices to the public internet.
ClickFix-style threat campaigns are using a new trick to evade detection and deliver Amatera, an increasingly prevalent infostealer.
The legislation would mandate that high-risk social media platforms such as Instagram, TikTok, Snapchat and Facebook take “reasonable steps” to ensure users are over age 16 by using tools like facial age estimation, digital ID services, formal IDs and existing account information for verification.