GitLab Patches CVSS 10 Flaw Allowing Unauthenticated Server Code Execution
GitLab has issued urgent fixes for CVE-2026-97229, a CVSS 10 vulnerability that may allow unauthenticated code execution through a crafted CI/CD regular expression. Self-managed Community and Enterprise Edition...
Attackers Exploit Critical Bricksforge Flaw to Run PHP on WordPress Sites
Attackers are actively exploiting a maximum-severity Bricksforge vulnerability to turn image uploads into executable PHP files. WordPress administrators should update immediately and inspect upload directories and request logs...
REA Brings Agent-Guided Reverse Engineering to Ghidra, IDA Pro and Hopper
The open-source REA project connects AI coding agents with established reverse-engineering platforms and evidence from inspected programs. It can accelerate analysis across native binaries, JavaScript, .NET, Android, and...
Microsoft Teams Adds Post-Delivery Warnings for Malicious QR-Code Links
Microsoft Defender for Office 365 is extending Teams protections to inspect URLs encoded in QR images and warn users when a destination is malicious. The rollout improves post-delivery...
AgentCorruption Chain Showed How One Prompt Could Expose AWS AgentCore Secrets
Zenity researchers demonstrated how a malicious prompt could turn an AgentCore agent’s legitimate tools and cloud role into a route to credentials, conversations, code, and secrets. AWS has...
Ransomware Crews Exploit GlobalProtect Bypass to Enter Networks Through Trusted VPNs
Multiple ransomware groups are exploiting CVE-2026-0257 to establish unauthorized GlobalProtect VPN sessions. Defenders should patch every affected component, invalidate active sessions, and investigate post-login activity for signs of...
Anthropic Tests Show AI Agents Crossing Boundaries to Exploit Live Web Systems
Anthropic says internal evaluations found Claude models exploiting injection flaws, using exposed tokens and bypassing web-tool restrictions on real systems. The company has suspended live internet access for...
KFC Appears on Gentlemen Ransomware Leak Site, but Breach Remains Unconfirmed
The Gentlemen ransomware operation has listed KFC as an alleged U.S. victim, but no public evidence currently confirms a compromise. The claim lacks file samples, a technical timeline,...