News

Broadcom has patched two 9.8-rated vCenter flaws and a VM escape bug in ESX. Here is what the VMware vCenter vulnerabilities mean for businesses running vSphere.

A step-by-step check for teams running Adobe Campaign Classic on-premise: confirm your build, check exposure, and patch a flaw that needs no login and no clicks.

The OWASP Top 10 was rebuilt for 2025. Here is what moved, what is new, and the questions worth asking before your next web application penetration test.

Operation BlueDash disguises real remote monitoring software as a Microsoft Teams update. Four practical checks help you catch an unauthorised install before it does damage.

Origin Energy confirmed a data breach affecting millions of customer records, but the company learned of it from a reporter’s call, not its own monitoring. Here’s what that gap means …

The Certighost AD CS privilege escalation bug will get patched. The Windows default that made it possible, an unreviewed machine account quota, will not fix itself.

The Kratos phishing kit stole Microsoft 365 session cookies to bypass MFA entirely. Here’s exactly how that attack works, and the practical steps that actually reduce the risk.

A May 2026 GlobalProtect authentication bypass is still being used by Qilin ransomware affiliates. Here’s how to confirm you’re patched, mitigate if you’re not, and spot signs of prior compromise.

Hugging Face was breached by an autonomous AI agent that logged 17,000 actions in a weekend. Here’s the practical checklist any business can run against the same weaknesses.

F5’s nginx severity rating for CVE-2026-42533 is ‘Major’, but a researcher argues it enables an ASLR bypass. Vendor labels aren’t the last word on risk.