Security Feed
Curated advisories, threat briefs & field intel — attributed, dated & severity-tagged. Kept deliberately separate from my own writing.
1. Executive summary CVE-2026-48356 is an unrestricted file upload flaw (CWE-434) in Adobe Commerce and Magento, scored CVSS 9.3 critical
1. Executive summary TrendAI has disclosed three attacks against organizations in Japan in which AI was used either to drive the operation or to
1. Executive summary CVE-2026-21531 is a deserialization of untrusted data flaw (CWE-502) in the Azure AI Language Conversations Authoring client library
1. Executive summary On 2026-10-27 the ransomware leak-site indexer ransomware.live recorded a listing by a group calling itself "Booba
1. Executive summary An autonomous AI agent operated by Causal Security found four previously unknown memory-safety vulnerabilities in EPICS Base, the open source
1. Executive summary CVE-2026-21531 is a deserialization of untrusted data flaw (CWE-502) in the Azure AI Language Conversations Authoring client library
1. Executive summary His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published a report on 27 October 2026 stating
1. Executive summary LiteLLM, the open-source LLM gateway proxy, reuses a single encryption key (the salt key) both to seal secrets at rest
1. Executive summary Apache Tomcat contains an improper input validation flaw, CVE-2026-32990, that lets an HTTP/2 client omit the :authority pseudo-
1. Executive summary Arctic Wolf has documented more than 400 incidents in which actors used Microsoft Teams external access (federation) to pose as internal
1. Executive summary Nextcloud has published fixes for multiple vulnerabilities across its server product and several apps (Collectives, files_lock, Team Folders), with the
1. Executive summary BSI's Warn- und Informationsdienst published WID-SEC-2026-4169 on 27 October 2026, rated hoch, covering multiple vulnerabilities in