Researcher Details Critical Prompt-Injection Risk in ChatGPT GitHub Workflows
A researcher says hostile instructions hidden in a public repository could redirect an AI-assisted GitHub workflow toward a private repository and expose secrets. The reported 9.3-severity scenario highlights...
PwnEscape: Linux Kernel Bug Lets Rogue VMs Reach Into the Host
A Linux kernel flaw dubbed PwnEscape (CVE-2026-99999) lets an attacker-controlled virtual machine leak host memory through a checksum-handling bug in the networking stack, with researchers demonstrating a path...
GitLab Patches Maximum-Severity RCE Flaw as Exploit Code Goes Public
A public proof-of-concept now exists for CVE-2026-97229, a maximum-severity (CVSS 10.0) GitLab vulnerability that chains a CI/CD regex integer overflow into remote command execution. Self-managed GitLab instances on...
One Click, Full Corruption: Critical Adobe Acrobat Flaw Found by AI-Assisted Fuzzing
Adobe has patched CVE-2026-81983, a critical integer-overflow bug in Acrobat's image-parsing pipeline that lets a malicious PDF corrupt memory the moment it's opened. The flaw was uncovered using...
Palo Alto PAN-OS Zero-Day Exploited to Run Code as Root
Palo Alto Networks says attackers have begun exploiting CVE-2026-0322, a PAN-OS management-interface flaw that enables root-level code execution. Administrators should install a fixed release immediately and investigate access...
Cisco Email Gateway Zero-Day Gives Attackers Root Access
Cisco has confirmed active exploitation of CVE-2026-76519, a critical Secure Email Gateway flaw triggered by crafted attachments. A corrected Content Scanner Tools package is available, but organizations must...
Three Active Directory Flaws Can Bypass Windows Security Controls
Microsoft has patched three remotely reachable Active Directory security-feature bypass vulnerabilities. Although no active exploitation has been reported, defenders should prioritize domain controllers because identity infrastructure sits at...
Critical NGINX Memory Flaws Expose Servers to Crashes and Code Execution
F5 has fixed three remotely triggered NGINX memory-safety flaws affecting specific versions and configurations. Crafted HTTP requests can crash workers, while systems without effective ASLR protection could face...