TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESSPage 3 of 5: earlier stories.
CVE-2026-21589 lets attackers without a login read files in the web root of self-hosted Jira, Confluence and Bitbucket, and Atlassian says exposed servers should come offline until patched.
An insider with any valid account could read other users' mail and attachments on unpatched on-premises servers; Microsoft rates exploitation as more likely.
The foundation says the agents tried to turn a citation tool and its public note pad into proxies and flooded Wikidata with queries that contributed to a May outage.
The count reflects both a surge in machine-found bugs and the kernel team's policy of tagging nearly every stable fix with a CVE, not 1,313 serious holes.
A path traversal bug in the command-line tool admins use to push firmware and BIOS updates is fixed in version 2.3.0.0, along with four high-severity flaws.
The Linux malware turns hijacked routers, cameras and DVRs into proxy nodes and talks to its operators through public NAT-traversal servers used by VoIP and video apps.
Appliances patched days earlier for two other zero-days began crashing, and CISA gave federal agencies until Oct. 7 to deal with the new bug.
The company paused its open-source rewards program Oct. 1 after maintainers were flooded with AI-generated findings that did not hold up.
Anthropic's bug-hunting model worked out how to crack the file server's session keys with a math solver, and exploitation began within a day of disclosure.
The worst flaw stems from service account passwords seeded with a timestamp, while another lets authenticated users run commands as root on the BoKS Master.
A crafted flow configuration could break out of the prompt template sandbox and run commands on a server that holds JWT signing keys.
The health records vendor expects a roughly six-week freeze after the AI model found configurations that could let outsiders read patient files without leaving log entries.
Missing authentication in Container Storage Modules could let attackers seize storage admin credentials, forge tokens, read cluster Secrets or gain root on nodes.
Symantec says the group behind the 2025 ToolShell attacks has turned to Portuguese- and Spanish-speaking countries, disabling security tools on 40 machines in about two hours.
Google's high-security mode will keep a year of encrypted forensic logs that even it cannot read, and will stop unverified apps from using the accessibility API that banking trojans rely on.
Fixed builds are listed but not yet released, CISA has given federal agencies until Oct. 4 to act, and the 7.2 branch will get no fix at all.
Archived traffic shows agents hunting for school statistics and century-old divorce records slipped basic attack payloads into their requests, though the probes appear to have failed.
Seven months after its public launch, the Mandiant founder's startup is valued above $2.5 billion and says its agents already run attack campaigns for Fortune 500 and government customers.
Rob Bonta's office escalated an inquiry that began with the Hugging Face breach, saying frontier developers can be held legally accountable for attacks their models carry out.
Version 9.4.1 of the Email Protection Gateway closes an unauthenticated route to root, days after the company's unusual weekend shutdown advisory over a separate product.
The disclosure nonprofit says the flaws in its open-source helpdesk let an autonomous agent move from session hijacking to root in seconds, and urges users to upgrade.
CISA rates CVE-2026-84411 at 9.8 and says no attacks are known yet, but MikroTik routers have been a recurring botnet target.
Vetted security teams get the new model without its cyber guardrails first, while developers and Ultra subscribers wait for a rollout Google has not dated.
A URI-encoding trick lets unauthenticated requests slip past an API login check, and CISA has given federal agencies three days to fix it.