EEP || Cyber Investing Trendjacking (7d)

CVE-2026-97274 demonstrates how incomplete validation of OAuth tokens, states, or redirect URIs enables pre-auth remote bypass in SSO clients,...

Microsoft observed July 2026 phishing campaigns that drop a signed MSP360 installer which then stealth-installs ScreenConnect, creating redundant...

Cisco confirmed active exploitation of CVE-2026-76504, an unauthenticated auth bypass in SD-WAN Manager allowing full admin API access without...

AI agent security is shifting from model safety to identity and authorization risks, as shown by the OAuth credential theft flaw in Anthropic’s...

OpenInfra Europe’s self-hosted JFrog Artifactory was breached via CVE-2026-82329, exposing artifacts downloaded August 28–September 15, 2026. The...

Bitwarden Privileged Controls brings credential leasing, automated rotation, access rules, and audit logs directly into its password manager, enabling...

CrowdStrike's participation in Rig Security's $12M seed round underscores rising incumbent interest in AI-security infrastructure. This raises the key...

Stolen Azure service principals let Storm-3168 run 18-hour campaigns of reconnaissance and deletion across storage accounts, Key Vaults, and recovery...

Global exploitation of two Citrix NetScaler RCE flaws (CVE-2026-88771, CVE-2026-88772) shows why emergency response must go far beyond upgrades.

-...

A patch exists is not the same as an organization being protected. AI now compresses the window from disclosure to exploit from months to hours, yet...

CISA's quality-era CVE framework targets better vulnerability prioritization through stronger governance, global participation, data infrastructure...

The FCC has banned certain foreign-made drones, WiFi routers, and robotic vacuums from the U.S. market over cybersecurity and national-security risks,...

Attackers are closing the window between disclosure and exploitation on internet-facing control planes.

• NetScaler zero-days: Two CVSS 9.5 RCE flaws...

DOJ closure of its CrowdStrike investigation without enforcement action highlights the critical role of governance, procurement diligence, and evidentiary standards for major cybersecurity vendors in public-sector contracts.

Mandiant reports ShinyHunters (UNC6240) mass-exploiting CVE-2026-35273 in Oracle PeopleSoft with simple WAF bypasses, deploying backdoors like SIDEEYE...

Active exploitation continues on systems long after patches exist.

• WSO2 and Adobe flaws added to CISA KEV after in-the-wild attacks began weeks...

PamStealer now fetches a server-side decryption utility and completes an X25519 key exchange before unwrapping its payload, making static recovery...

1024-bit RSA signatures can now be forged without factoring, using an oracle and 1,380 core-years versus 500k–1M for traditional methods. Enterprises...

Runtime controls and verifiable execution are emerging as the new baseline for AI agent security.

CrowdStrike highlighted a Fortune 500 customer...

CISA has discontinued six free assessments—including ransomware readiness and cyber resilience reviews—after losing roughly a third of its workforce....