Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Sep 5, 2026, 4:37 PM EDT · Research · Cve 2026 600047 minGitea RCE Flaw CVE-2026-60004 Added to CISA KEV: How Default Settings Enable Host Takeover

CISA adds critical Gitea RCE CVE-2026-60004 to its KEV catalog. Discover how default registration settings enable Git hook exploitation and host takeover.

Sep 5, 2026, 4:37 PM EDT · Research · AI Gateway Security7 minAI Gateway Compromise: Chained Starlette and LiteLLM Flaws Expose Foundation Model Keys

Threat actors chain Starlette and LiteLLM flaws to achieve unauthenticated RCE and steal enterprise AI keys. Discover key forensic details and patch steps.

Sep 4, 2026, 3:27 AM EDT · AI Security · Agent Control Plane12 minThe Agent Control Plane: Engineering Runtime Authorization for MCP and AI Tool Calls

Prompt injection resists a model-layer fix. Inside the agent control plane: workload identity, brokered credentials and blast-radius caps at the tool call.

Aug 29, 2026, 10:51 AM EDT · Research · Cve 2024 369716 minCommercial Spyware Weaponizes Linux Kernel Privilege Escalation Flaw to Hijack Android Devices

Commercial spyware exploits Linux kernel flaw CVE-2024-36971 to hijack Android devices. Learn the technical mechanics, exploit chain, and how to patch now.

Aug 29, 2026, 10:48 AM EDT · Research · Apache Ofbiz Vulnerability6 minCritical Apache OFBiz Flaws Expose Enterprise ERPs to Unauthenticated Remote Code Execution

Critical Apache OFBiz vulnerabilities CVE-2024-38856 & CVE-2024-45195 allow unauthenticated RCE. Discover how attackers exploit them and how to mitigate now.

Aug 29, 2026, 10:47 AM EDT · Research · Cve 2024 382136 minInside Copy2Pwn: The Windows SmartScreen Zero-Day Exploited by DarkGate

Explore CVE-2024-38213 (Copy2Pwn), the Windows SmartScreen zero-day bypass exploited by DarkGate via WebDAV UNC shares, plus detection and mitigation rules.

Aug 29, 2026, 10:43 AM EDT · Research · Cve 2024 68007 minCritical SAML Signature Wrapping Flaw Exposes GitHub Enterprise Server to Unauthenticated Admin Takeover

A critical SAML flaw (CVE-2024-6800, CVSS 9.5) lets attackers gain admin access on GitHub Enterprise Server. Learn the exploitation mechanism and patch steps.

Aug 29, 2026, 10:43 AM EDT · Research · Qwen 3 8 Flash Next6 minQwen 3.8 Flash Next vs DeepSeek V4 Flash Benchmarks: Inside Alibaba’s 6B-Active Architecture and the Shift in Open-Weight Economics

Alibaba’s Qwen3.8-Flash-Next beats DeepSeek-V4-Flash on SWE-bench Pro with 6B active parameters. Explore full benchmarks, architecture, and enterprise TCO.