WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders. On some servers, that can go further, [...]

Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks Attackers exploited a previously unknown flaw in Check Point’s Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, tracked as CVE-2026-93616, allows an attacker who can access the server’s web service [...]

Identity Visibility in 2026: The Foundation of Identity Security Identity visibility is a starting point for modern identity security. Stolen and misused credentials are among the most frequently reported initial access vectors in breach research, including Verizon’s annual Data Breach Investigations Report. What Identity Visibility Means in IAM Identity visibility [...]

Can You Prove a New CVE Is Exploitable Before Attackers Do? A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure [...]

Claude Opus 5 Used to Chain Flaws and Compromise OpenAI Staff Accounts Three researchers at the security firm Hacktron used Anthropic’s Claude Opus 5 to chain two flaws together and take over the ChatGPT and Codex accounts of several OpenAI employees. After gaining access to those accounts, the researchers were [...]

WordPress Introduces Automated Plugin Reviews to Block High-Risk Updates WordPress has announced it’s launching an automated security review for every release of a plugin before it’s distributed through the WordPress.org update API. The goal is to analyze each release for potential security issues and ensure there are no risks involved [...]

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries A Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. “Red Heron scanned 1,386 Gitea [...]

New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently dropping writes to a server’s memory, so the processor keeps reading old encrypted data as if it [...]

GitLab Patches Maximum-Severity Path Traversal Flaw GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. CVE-2026-85706: CVSS 10.0 Path Traversal The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository [...]

OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers The “major malicious attack” that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, [...]