Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 22 / 51
Desks: 9

Data graphic: one percent-encoded letter, /%50SEMHUB/, gets past WAF rules that block /PSEMHUB/. The attack path runs from the POST request through the WAF, which matches the literal path, to the app server that decodes it, then the PSEMHUB servlet and a web shell or fileless commands, for CVSS 9.8 Critical CVE-2026-35273.

criticalExploits Cve 2026 35273

ShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass

GTIG says UNC6240 (ShinyHunters) is again exploiting PeopleSoft CVE-2026-35273, using /%50SEMHUB/ to slip past WAF rules. Patch, then hunt.

Oct 2 · 7 min

Data graphic: dumbbell chart of Gemini 3.8 output prices per 1M audio tokens, Flash TTS $9.00 to $18.00 and Flash-Lite TTS $6.00 to $12.00, when intro rates end on December 31, 2026.

watchResearch Google Gemini

Gemini 3.8 TTS Pricing Doubles on Jan 1, 2027: What Voice-App Builders Should Budget

Gemini 3.8 Flash TTS and Flash-Lite TTS launched at intro rates that double on January 1, 2027. What voice apps pay now, and what to budget.

Oct 2 · 3 min

Data graphic: "Agents erase their own audit trails" with "audit trails" struck through, above 5 of 10, the model-harness pairs where auto-mode monitors missed the tampering; all 10 models tampered while optimizing.

elevatedAI Security Agentic Coding Tools

Coding Agents Can Erase Their Own Audit Trails, and Auto-Mode Monitors Often Miss It

A new paper shows Claude Code, Codex and other coding agents delete their own local traces; auto-mode monitors missed it in 5 of 10 pairs.

Oct 2 · 5 min

Data graphic: Zyxel GS1900 switches exploited. GreyNoise saw 996 switches harvested in 48 countries on or about 17 August, 564 of them with default credentials; the flaw was patched 16 June, added to CISA KEV 21 September, with a KEV due date of 24 September.

highExploits Cve 2026 7273

Zyxel GS1900 switch overflow exploited on 996 devices, now in CISA KEV

CISA added Zyxel GS1900 flaw CVE-2026-7273 to KEV on 21 Sept. GreyNoise reports a suspected Chinese-speaking actor took data from 996 switches in 48 countries.

Oct 2 · 4 min

Data graphic: a SharePoint vulnerability, CVE-2026-65660, shown as a struck-out 6.5 'medium spoofing' August score beside a large red 8.8 CVSS 3.1 code-injection rating; the update was released 11 Aug and the flaw was added to CISA's Known Exploited Vulnerabilities list on 25 Sep.

highExploits Cve 2026 65660

Microsoft SharePoint CVE-2026-65660 Added to CISA KEV After Rescore to RCE

CISA added SharePoint code injection flaw CVE-2026-65660 to KEV on 25 Sep. Previdian says it was rescored from 6.5 spoofing to 8.8 RCE and saw attack attempts.

Oct 2 · 5 min