Glow found over 13,000 internal images from 300+ organizations exposed in public GitHub repos during AI-assisted code reviews.

Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Aikido found Graphalgo-linked Go malware in Terraform providers and Go Modules, using targeted triggers, Slack, and blockchain C2.

WordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable code execution.

CVE-2026-93485 is an unauthenticated stored XSS in WordPress core that can escalate to RCE through an administrator session. Fixed in WordPress 7.1.1.

WordPress 7.1.1 fixes Click2Shell, which can force theme installs from crafted links and was chained with a theme flaw for code execution.

CrowdSec says a TanStack-linked GitHub token was used to copy about 170 private repositories from a former employee’s account.

Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency.

Join us to learn from expert speakers, network with like-minded professionals and stay ahead in the ever-evolving world of Cyber Security

The OWASP GenAI Security Project Crosswalk is an open-source resource that connects OWASP GenAI security risks to established industry security, governance, and compliance frameworks. It maps 51 GenAI vulnerabilities across four  source lists to controls in 25 frameworks, including NIST, ISO, MITRE ATLAS, the EU AI Act and others. Organizations can use the crosswalk to […]

45 days of Signal history may be exposed by German police messaging surveillance using linked devices, Netzpolitik says. Read what the documents reveal

Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes.

A sandbox bypass in Microsoft Copilot Cowork let a malicious Skill read commands from an attacker's server and send back any data the agent could reach, including Outlook mail, SharePoint files, and c...

MikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider...

The bug is already being exploited in the wild, allowing attackers to generate admin tokens and gain access to Artifactory, the platform that powers many organization’s software supply chains.

Pillar Security researchers chained a leaked OIDC credentials file and a broken tool allowlist in Google's run-gemini-cli GitHub Action to escalate a public GitHub issue prompt injection into full Edi...

Next.js patches two critical unauthenticated RCE flaws affecting Windows deployments and sites with AVIF optimization enabled.

Company that runs Manchester, Stansted and East Midlands hubs says passenger safety is unaffected

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management - OWASP/Nettacker

New Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click

The government says at no point was there a risk to the UK's energy system during the attack in July.

The Rust crate arrayref 0.3.10 is compromised: it pulls in the typosquatted proc-macro1 1.0.107, whose build script downloads and runs a remote binary at build time. Full technical analysis: timeline,...

Wiz Red Agent finds its way into Snowflake's internal Jira through a flaw in a GitHub Copilot–Assisted PR.

WordPress has released version 7.0.4, a security-focused update that closes a remote code execution vulnerability affecting sites that process images with the Imagick extension and Ghostscript.

WordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under specific conditions.

OVSwrap is a 13-year-old Linux kernel flaw that lets local users gain root privileges on most distributions using Open vSwitch.

OWASP Top 10 for LLM Applications 2026 is the latest community-driven guide to the most critical security risks facing applications powered by large language models. Developed by hundreds of AI security experts, this edition introduces updated rankings, expanded threat coverage, and new research grounded in thousands of real-world AI security incidents. The guide provides practical […]

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account

Wiz Research details CosmosEscape, a critical vulnerability in Azure Cosmos DB that granted full read/write access to every database. Now fully remediated.

Learn how AI coding agents can expose credentials in supply chain attacks and how Docker Sandboxes keep secrets out of an agent's reach.

Broadcom has released security updates to fix five vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, including three critical flaws that allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host.

Russian hackers exploit CVE-2026-42897 in OWA to deploy OWAReaper, a browser implant that persists through credential rotation and device re-imaging.

TL;DR Noma Labs found a critical (10 CVSS) vulnerability in Ruflo, an open source AI agent orchestration platform with more than 67,000 GitHub stars at the time of this writing and ranked #2 on MCPMarket. Ruflo ships with a chat UI, agent swarms, persistent memory, and MCP-based tool calling. The platform’s MCP Bridge, the Express.js […]

A guide to open-source AI tools for finding code vulnerabilities, comparing exploit generation, skill-boosted auditing, and SAST+LLM hybrid approaches.

Anthropic’s Claude share links appeared in public search results, raising fresh privacy concerns for users who shared sensitive conversations.

An IDOR flaw in the Pope official prayer app data leak exposed the names, plaintext emails, and admin roles of over 700,000 Click to Pray users.

Certighost exploit lets a domain user obtain a Domain Controller certificate and reach DCSync through a vulnerable AD CS chase.

Research reveals that slopsquatting remains a threat to developers using AI to aid coding.

Zenity Labs reveals AgentForger, a ChatGPT Workspace Agents vulnerability that enables attackers to create autonomous agents within your organization.

WordPress 6.9.5 and 7.0.2 patch wp2shell, a pre-auth core RCE that lets anonymous attackers run code on default installs, even with no plugins.

On July 11, 2026, an attacker used a stolen npm token to publish malicious versions of the Jscrambler package. We caught it within seconds.

YouTube video by OWASP London