Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
1. Executive summary A critical arbitrary file upload vulnerability, CVE-2026-32475 (CVSS 9.0 CRITICAL per NVD; the vendor press coverage quotes 9.8 — we
1. Executive summary A critical arbitrary file upload vulnerability, CVE-2026-32475 (CVSS 9.0 CRITICAL per NVD; the vendor press coverage quotes 9.8 — we
1. Executive summary This is not a vulnerability or campaign advisory: it covers the release and hands-on evaluation of numbat, Perplexity AI's open-
1. Executive summary On 4 September 2026, the ransomware operator tracked as "lockbit5" publicly listed PSC Industries (pscindustries.com), a US industrial supplier of
1. Executive summary On 2026-09-04, the ransomware operator branding itself "lockbit5" listed the German company KALA Health (kalahealth.eu), an international manufacturer
1. Executive summary On 2026-09-04, the ransomware operator branding as "lockbit5" listed the Dutch primary-care medical practice Huisartsencentrum Klein Iterson (huisartsencentrumkleiniterson.
1. Executive summary Microsoft has published architectural guidance on securing edge AI deployments — inference workloads running on customer-owned devices, gateways, and on-premises infrastructure rather
1. Executive summary CVE-2026-85046 is a high-severity (CVSS 8.8) type confusion vulnerability in Google Chromium's V8 JavaScript and WebAssembly engine,
1. Executive summary Recorded Future has announced Automated Signature Creation, a new capability in its Attack Surface Intelligence (ASI) product that uses agentic AI processing to
1. Executive summary On 4 September 2026, the U.S. Department of Justice and the U.K.'s National Crime Agency (NCA) and Crown Prosecutor
1. Executive summary Beginning 1 September 2026, X users began receiving unsolicited, legitimate password-reset emails and codes they did not request, coinciding with the wider
1. Executive summary CVE-2026-6471 ("PostGREShell") is a missing-authorization flaw (CVSS 7.2 HIGH, CWE-862, not in CISA KEV, EPSS 0%
One spoofed "Ledger" email led to a 320-site phishing cluster, a deobfuscated seed-phrase harvester on Azure, a fake Ledger Identity API leaking its origin via CNAME, and a lesson in why vision models need a human in the loop.