en
CVE-2026-54121: Certighost and the AD CS Flaw That Lets a Standard Account Impersonate a Domain Controller
How the CertiGhost AD CS vulnerability enables standard domain accounts to forge DC certificates and achieve instant domain takeover.
Vulnerability Research
en
Security Roundup: SharePoint's Next Zero-Day, Oracle's Record CPU, and the EY Breach (Week of July 20, 2026)
Weekly briefing: SharePoint deserialization RCE, Oracle PeopleSoft zero-day chain (100+ breaches), EY breach, and Capital One VulnHunter.
en
VulnHunter: How Capital One Is Using Agentic AI to Hunt Vulnerabilities Before Attackers Do
Case study on Capital One's VulnHunter: autonomous agentic AI scanning codebases and identifying zero-day logic flaws.
en
CVE-2026-50522: Microsoft SharePoint's Next Deserialization RCE, Exploited Days After a Public PoC
Technical root cause of the SharePoint deserialization RCE exploited within days of public proof-of-concept release.
en
GhostApproval: How Wiz Research Found AI Coding Assistants Writing Files Before You Approve Them
Wiz Research uncovers GhostApproval: AI coding assistants pre-emptively executing file modifications before user approval prompts.
en
Security Roundup: SonicWall Zero-Days, Microsoft's Record Patch Tuesday, and the Klue Breach Fallout (Week of July 13, 2026)
Weekly briefing: SonicWall SMA 1000 zero-day chain, Microsoft 622-CVE Patch Tuesday, Accenture breach, and GhostApproval AI trust flaws.
en
Security Roundup: Adobe ColdFusion CVSS 10 Wave, SharePoint Warlock Ransomware, LoadMaster Pre-Auth RCE, Argo CD Kubernetes Zero-Auth — Week of July 3, 2026
Weekly briefing: Adobe ColdFusion 6x CVSS 10.0 wave, SharePoint Warlock ransomware, and Cursor IDE DuneSlide prompt injection.
en
DuneSlide: CVE-2026-50548 / CVE-2026-50549 — Zero-Click Prompt Injection to RCE in Cursor IDE
Cato AI Labs discloses DuneSlide: chaining prompt injection to sandbox escape and remote code execution in Cursor IDE.
en
Adobe ColdFusion: Six CVSS 10.0 RCEs in One Update — CVE-2026-48276, 48277, 48281, 48282, 48283, 48316
Technical analysis of Adobe's emergency bulletin addressing six simultaneous CVSS 10.0 unauthenticated RCE flaws.
en
CVE-2025-67038: Lantronix EDS5000 CVSS 9.8 Code Injection — CISA KEV, ICS/OT Alert, Federal Deadline Today
CISA issues urgent warning over critical CVSS 9.8 code injection in Lantronix industrial serial converters.
en
CVE-2026-25089: FortiSandbox Unauthenticated RCE + CISA KEV June 9 Additions (Arista, Cisco SD-WAN)
Technical root cause for the unauthenticated OS command injection vulnerability in Fortinet FortiSandbox appliances.
en
CVE-2026-11645: Chrome V8 Zero-Day — OOB Read/Write In-Browser RCE Analysis
Technical analysis of the Chrome V8 out-of-bounds read/write memory corruption zero-day exploited in targeted surveillance campaigns.