Ivanti has alerted its customers about a severe vulnerability in its Endpoint Manager Mobile (EPMM) software that is being actively exploited in zero-day attacks. This security flaw allows attackers to execute remote code, posing a significant risk to organizations using this mobile device management solution. Companies utilizing EPMM should prioritize applying the necessary patches to protect their systems. The vulnerability affects multiple versions of the software, making it crucial for users to act quickly. Failure to address this issue could lead to unauthorized access and potential data breaches, emphasizing the importance of timely updates in cybersecurity practices.
Cisco's AI security researchers have discovered a vulnerability in vision-language models (VLMs) that could be exploited by attackers using subtle pixel-level changes in images. These small alterations can mislead the models into producing incorrect outputs without being noticeable to human observers. This poses significant risks for industries that rely on VLMs, such as autonomous vehicles and security systems, where accurate visual interpretation is crucial. The findings suggest that companies using these AI systems should review their security measures to prevent potential exploitation. As AI continues to integrate into various applications, understanding and mitigating such vulnerabilities becomes increasingly important.
A recent issue identified during the 'TrustFall' convention reveals that malicious repositories can execute code in several coding tools, including Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI, with little to no user interaction required. This vulnerability is concerning because it relies on inadequate warning dialogs that fail to sufficiently alert users about the risks. As a result, developers using these tools could unknowingly run harmful code, leading to potential data breaches or system compromises. The lack of effective safeguards means that both individual developers and organizations using these tools are at risk. It's crucial for users to be aware of this vulnerability to avoid falling victim to such attacks.
A vulnerability in the Gemini CLI tool could have allowed attackers to inject malicious prompts into GitHub issues, potentially taking control of an AI agent responsible for triaging those issues. This could lead to unauthorized code execution and create avenues for supply chain attacks. The flaw poses a risk to developers and organizations using Gemini CLI, as it could compromise the integrity of their software development processes. Users need to be aware of this vulnerability and take necessary precautions to secure their systems. Researchers have flagged this issue, emphasizing the need for immediate attention to prevent exploitation.
Instructure, the company behind the popular Canvas learning management system used by many educational institutions, suffered a significant breach attributed to the hacker group ShinyHunters. This incident raises serious concerns about how much trust schools place in their vendors' security practices. The attack not only compromises sensitive information but also highlights the vulnerability of educational institutions that rely heavily on third-party services. As these platforms become integral to online learning, the implications of such breaches can affect students, educators, and administrative operations alike. Schools may need to reassess their vendor relationships and security protocols to better protect their data in the future.
A serious vulnerability in the vm2 library, widely used for sandboxing in Node.js applications, has been discovered. This flaw allows attackers to escape the sandbox environment and execute arbitrary code on the host system, posing a significant risk to applications relying on vm2 for security. Developers and organizations using this library need to take immediate action to safeguard their systems, as this vulnerability could lead to severe breaches. The issue affects multiple versions of vm2, making it critical for users to update their systems promptly. Failure to address this vulnerability could leave systems exposed to potential attacks.
A serious vulnerability in MetInfo CMS, labeled CVE-2026-29014, has been discovered that allows unauthenticated attackers to execute arbitrary PHP code remotely. This flaw has a high severity rating of 9.8, indicating a significant risk to users of the platform. Organizations using MetInfo should be particularly vigilant, as this could lead to unauthorized access and control over their websites. As of now, there are concerns that this vulnerability is being actively exploited, which underscores the urgency for users to take action. It is crucial for affected users to apply any available patches and review their security measures to protect against potential intrusions.
Ransomware attacks are increasingly successful even when organizations have backups, primarily because attackers often target and destroy these backups before encrypting the main data. Acronis explains that this tactic leaves victims with little to no options for recovery, as the backups become unusable. This highlights a significant vulnerability in many organizations' cybersecurity strategies, as they may rely too heavily on backups without considering their protection. Companies need to bolster their defenses by securing backup systems and implementing strategies that can withstand ransomware attacks, ensuring they have a path to recovery even if their primary data is compromised.
Apache has released updates to address multiple vulnerabilities in its HTTP Server, including a serious flaw identified as CVE-2026-23918. This vulnerability, which has a CVSS score of 8.8, is a double-free error in the handling of HTTP/2 requests. If exploited, it could allow attackers to execute arbitrary code on affected systems. Organizations using Apache HTTP Server, particularly those enabling HTTP/2, should prioritize updating their software to mitigate this risk. The nature of the flaw makes it critical for system administrators to be proactive in applying the latest patches to safeguard against potential attacks.
Palo Alto Networks has issued a warning regarding a serious, unpatched vulnerability in the User-ID Authentication Portal of its PAN-OS. This flaw, categorized as a remote code execution (RCE) vulnerability, is currently being exploited in real-world attacks, putting users at significant risk. Organizations using affected versions of PAN-OS should be particularly vigilant as attackers may leverage this weakness to gain unauthorized access to systems. It's crucial for companies to assess their firewall configurations and implement necessary security measures to protect against potential breaches. The situation underscores the need for prompt action in addressing vulnerabilities as they arise.
Palo Alto Networks has issued a warning about a serious vulnerability in its PAN-OS, identified as CVE-2026-0300, which has a high severity score of 9.3. This flaw, a buffer overflow, allows attackers to execute remote code without authentication, making it particularly dangerous. The company reports that this vulnerability is currently being exploited in the wild, putting numerous users at risk. Organizations that rely on PAN-OS should prioritize addressing this vulnerability to prevent unauthorized access and potential system compromise. Immediate action is critical to mitigate the risks associated with this active threat.
Palo Alto Networks has announced a patch for a zero-day vulnerability, identified as CVE-2026-0300, that affects the Captive Portal service in its PAN-OS software. This vulnerability impacts both PA and VM series firewalls, allowing attackers to exploit the system and potentially gain unauthorized access. The existence of this zero-day exploit means that it is currently being used in the wild, putting users at risk. Companies using these firewalls should prioritize applying the upcoming patch to safeguard their networks. This incident underscores the need for organizations to stay vigilant and maintain their systems updated to protect against emerging threats.
A recent breach involving Trellix's source code has raised concerns about security in the software supply chain. Although details remain limited, such incidents can expose sensitive information about how security controls are implemented and detection mechanisms are structured. This type of vulnerability allows attackers to understand better how to bypass defenses, potentially putting users and organizations at risk. The incident serves as a reminder of the ongoing dangers associated with software supply chain security, emphasizing the need for companies to evaluate their security practices and monitor for potential exploitation. As these breaches become more common, it is crucial for developers and security teams to remain vigilant.
A critical vulnerability in the Weaver E-cology platform has been identified, allowing remote code execution (RCE) that could expose sensitive enterprise workflows and data. This flaw poses a significant risk to organizations using the software, as attackers can exploit it to gain unauthorized access to critical systems and information. The vulnerability is currently being actively exploited, which raises immediate concerns for businesses that rely on Weaver E-cology for their operations. Security experts are urging affected users to take swift action to mitigate the risks associated with this flaw. The situation underscores the need for organizations to remain vigilant and proactive in addressing security vulnerabilities.
In April 2026, Vimeo confirmed that hackers accessed the personal data of 119,000 users through a breach involving a third-party vendor, Anodot. The ShinyHunters group, known for targeting various companies, exploited this vulnerability to steal sensitive information. This incident raises concerns about the security of third-party services that companies rely on, as they can serve as weak links in the overall security chain. Users affected by this breach should be vigilant about their personal information and consider changing their passwords, especially if they use the same credentials across multiple platforms. The breach serves as a reminder for companies to evaluate their partnerships and ensure that vendors adhere to strict security protocols.