1. Executive summary CISA added CVE-2026-45659 (CVSS 8.8, HIGH) to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01, citing evidence of
1. Executive summary @apify/actors-mcp-server version 0.10.7 is vulnerable to URL authority injection via the webServerMcpPath field in Actor definitions fetched from
1. Executive summary The EvilTokens phishing-as-a-service (PhaaS) platform, which abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) to bypass
1. Executive summary The FortiBleed campaign — a large-scale credential-harvesting operation active since February 2026 — has been linked by SOCRadar's Threat Research Unit
1. Executive summary Palo Alto Networks Unit 42 has published research on "phantom squatting," a technique where attackers register domains that large language models
1. Executive summary A massive, ongoing automated password-spray campaign targeting Microsoft's Azure CLI has been observed by Huntress, with over 81 million login
1. Executive summary An anonymous researcher using the pseudonym "Bikini" has published proof-of-concept exploit code and write-ups for more than a
1. Executive summary Security researcher Bert-Jan Pals analysed approximately 3,000 live ClickFix payloads and revealed that the social-engineering delivery technique has matured into
1. Executive summary CVE-2026-24294 is an improper authentication vulnerability in Windows SMB Server that permits an authorized attacker to elevate privileges locally. The GitHub
1. Executive summary A critical vulnerability in Oracle E-Business Suite (EBS) Payments — CVE-2026-46817 (CVSS 9.8 CRITICAL, CWE-269 / CWE-287) — is being
1. Executive summary CVE-2026-33825 ("BlueHammer"), a local privilege escalation vulnerability in Microsoft Defender (CVSS 7.8 HIGH), has been added to CISA&
1. Executive summary Microsoft Incident Response has published a detailed attack pattern in which threat actors poison Model Context Protocol (MCP) tool descriptions to silently redirect