⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
A critical vulnerability (CVE-2026-59726, CVSS 10.0) in Ruflo, an open-source AI orchestration platform, allows unauthenticated attackers to execute remote commands and manipulate AI memory. The flaw, dubbed RufRoot, affects all versions before 3.16.3 and stems from an exposed Model Context Protocol (MCP) bridge that grants access to 233 tools, including shell commands and memory storage, without authentication.
A maximum-severity vulnerability (CVE-2026-59726, CVSS 10.0) was discovered in Ruflo, an open-source agent meta-harness for Claude Code and Codex. The flaw, named RufRoot, exposes 233 tools including shell command execution, database operations, agent management, and memory storage through an unauthenticated MCP bridge bound to 0.0.0.0 by default.
Broadcom released security updates for multiple critical VMware vulnerabilities affecting ESX, vCenter, Workstation, and Fusion. Three critical flaws include: CVE-2026-59309 (CVSS 9.8), an authentication bypass in vCenter allowing unauthorized network access; CVE-2026-59310 (CVSS 9.8), a directory-traversal vulnerability in vCenter enabling arbitrary code execution; and CVE-2026-47876 (CVSS 9.3), a use-after-free vulnerability in Workstation and Fusion allowing VM escape.
Broadcom has issued urgent security updates to address multiple critical vulnerabilities affecting VMware products, including ESX, vCenter, Workstation, and Fusion. Three of these flaws are rated critical, with CVSS scores ranging from 9.8 to 9.3.
This article examines the rise of AI-enhanced robocalls and the ongoing problem of caller ID spoofing. It notes that while major carriers have adopted STIR/SHAKEN standards, smaller providers are falling behind, leaving vulnerabilities for scammers to exploit.
Robocalls, increasingly enhanced by artificial intelligence (AI), remain a significant threat to consumers, with spoofed caller IDs making scams harder to detect. A recent investigation by Transaction Network Services (TNS) reveals that while major telecom providers have adopted the STIR/SHAKEN framework—a cryptographic system designed to authenticate caller IDs—many smaller providers lag behind.