Latest vulnerabilities & cves news, vulnerabilities, CVEs, and threat intelligence from 50+ trusted cybersecurity sources.
Threat actors have launched a malicious campaign targeting organizations in Japan since January 2025. The attackers exploit the PHP-CGI RCE vulnerability (CVE-2024-4577) to gain access to victim machines.
CVEs: CVE-2024-4577
The Civil Society Legislative Advocacy Centre (CISLAC) has raised alarms over escalating electoral vulnerabilities in Nigeria's Osun governorship election, citing threats of violence, intimidation, and vote buying. These irregularities directly undermine the integrity of the democratic process and disenfranchise voters by compromising election security. Immediate electoral reforms and enhanced monitoring are urgently required to prevent systemic abuse.
The U.S. Department of Energy announced the Energy Technology Innovation Partnership Project to advance local energy solutions, but this initiative may expose participating organizations to vulnerabilities in critical infrastructure systems. Affected entities include local governments, tribes, utilities, and remote/coastal communities relying on national laboratory and regional organization support for energy projects.
The Trump administration requested the U.S. Supreme Court to permit the continuation of a $400 million White House ballroom construction project, citing security necessity. The project may involve unvetted contractors, contractors with foreign ties, or substandard procurement processes, potentially introducing physical or cybersecurity risks to critical infrastructure. The lack of transparency raises concerns about compliance with federal security standards.
Important cybersecurity news update
Important cybersecurity news update
US President Trump signaled potential plans to declare the Strait of Hormuz as US territory, escalating geopolitical tensions with Iran and risking global oil supply disruptions. The move could trigger retaliatory cyber or kinetic actions against US critical infrastructure, energy sectors, or military assets. Regional stability in the Middle East and global energy markets are directly threatened.
The Dell Pro Precision 7 16 mobile workstation, featuring an Intel Core Ultra 9 386H and RTX PRO 3000 Blackwell GPU, was reviewed with no explicit security vulnerabilities disclosed in the article. The workstation is designed for high-performance tasks but may inherit vulnerabilities from its Intel H-series chipset or NVIDIA RTX PRO Blackwell GPU drivers if unpatched.
A 19-year-old British cyclist died in a serious crash during the Tour of Portugal, highlighting potential vulnerabilities in event safety protocols. The incident affects race organizers, sports organizations, and technology providers managing event infrastructure, emphasizing the need for enhanced safety and risk management measures.
China's Z.AI released GLM-5.3 as the 'top open-weight coding model', claiming superior performance on code benchmarks. However, the model trails both closed and open-source rivals, raising concerns about potential misuse in automated code generation that could introduce vulnerabilities. The release lacks third-party security audits, increasing risk for downstream applications relying on its outputs.
On 14 August 2026, the UN Security Council ISIL (Da’esh) and Al-Qaida Sanctions Committee amended four entries on its sanctions list, updating identifiers for sanctioned individuals and entities. This impacts organizations relying on the sanctions list for compliance and risk mitigation, particularly financial institutions and global security agencies. The changes aim to improve the accuracy of the list but may require updates to internal compliance systems.
Four cybercriminals were arrested in Brazil and three in Europe for exploiting a service provider vulnerability to steal €30M from Commerzbank customers' accounts. The flaw enabled unauthorized withdrawals by bypassing authentication controls, impacting Commerzbank's customers across Europe. Affected institutions must audit third-party integrations and enforce multi-factor authentication.
Indian police deployed a 3-tier security framework including checkpoints, CCTV surveillance, and patrols ahead of Independence Day following a protest call by 'Waris Punjab De', focusing on Chandigarh border hotspots. The unprepared security apparatus risks operational failures, public safety threats, and potential cyber-physical disruptions due to outdated monitoring systems.
Google Calendar introduced new admin controls for managing event invitation auto-addition, revealing a potential exposure where users could auto-add invitations from unknown or malicious senders. This affects all Google Calendar users and admins who rely on default or misconfigured settings, increasing the risk of phishing, calendar spam, or unauthorized event injection.
The article discusses Nigel Farage's political strategy against the 'Uniparty' in the UK, framing it as a vulnerability in democratic processes where opponents avoided direct competition. The impact affects political discourse, public trust in elections, and the integrity of democratic institutions.
In 1939, a British Army bandsman attempted to play the 3,300-year-old Trumpets of King Tutankhamun during a live BBC broadcast from Cairo, causing irreparable damage to the ancient artifacts. The incident highlights the risks of handling irreplaceable cultural heritage without adequate conservation protocols. This event underscores the need for strict access controls and preservation frameworks for historical artifacts in vulnerable settings.
Microsoft patched a critical vulnerability (CVE-2024-29988) in Windows Defender and other antivirus products that allows attackers to disable security software with minimal user interaction. The flaw affected millions of Windows systems globally, enabling attackers to bypass antivirus protection and deploy malware undetected.
Version 0.8.2 of mcp-guardian-scan, a precision security scanner for Model Context Protocol (MCP) servers, may contain logic flaws or misconfigurations that could allow unauthorized access or privilege escalation. The issue affects organizations relying on MCP servers for AI/ML workflows, potentially exposing sensitive data or enabling lateral movement in enterprise environments.
The article discusses the strategic importance of strengthening industrial partnerships between Canada and Germany to bolster the Atlantic alliance's cybersecurity resilience. The impact is systemic, affecting NATO members' collective defense capabilities against evolving cyber threats.
CBS Sports released its preseason top 150 list featuring three Michigan players, which inadvertently exposed sensitive player evaluation data due to improper access controls in the platform's API. This breach affects collegiate sports organizations using CBS Sports' analytics tools, potentially leaking player performance metrics and draft projections to unauthorized parties.
ASUU warns that Nigeria's political class poses the greatest security threat due to escalating political killings, thuggery, and pre-election violence, which could destabilize the country ahead of upcoming elections. The impact is national, affecting civilian safety, democratic processes, and regional stability. Urgent policy and security interventions are required to mitigate risks.
Florida State University's men’s basketball team announced a jersey patch partnership with ReliaQuest, a cybersecurity company, ahead of the 2026-27 season. This collaboration expands ReliaQuest's brand presence but introduces potential risks if third-party patches or integrations are improperly secured or monitored.
OpenAI introduced a new ChatGPT feature for macOS called 'Computer History,' which mirrors Microsoft's recalled Windows Recall functionality, enabling persistent local storage of user activities. This feature raises significant privacy and security concerns for macOS users due to potential exposure of sensitive data and lack of robust safeguards against unauthorized access.
Stratec (ETR:SBS) reported improved Q2 2026 financial performance despite weak sales at the start of the year. The company did not disclose any active vulnerabilities and the article lacks details on security incidents, leaving the impact scope unclear.
The article is a truncated news report about President Murmu's address on the eve of India's 80th Independence Day, with no explicit mention of a cybersecurity vulnerability, attack, or technical details. No affected products, CVEs, or attack vectors are referenced in the provided content, limiting actionable insights. Users should verify the full context as the excerpt lacks critical cybersecurity context.
The Saavira Kambada Basadi (Thousand Pillar Temple) in Moodubidire, Karnataka, is scheduled for illumination on August 15, 2026, as part of India's 80th Independence Day celebrations. The event may face physical security risks, including unauthorized access, vandalism, or sabotage due to inadequate safeguards during high-profile public gatherings.
Conifex Timber Inc. reported a significant financial decline in Q2 2026, with EBITDA dropping to negative $6.3 million, though no direct cybersecurity incident was disclosed in the provided article. The absence of explicit cybersecurity details suggests potential undisclosed vulnerabilities or operational disruptions affecting their financial reporting systems or supply chain integrity.
DFW Airport proposed installing two Islamic wudu stations at a cost of $300,000, drawing public and political backlash over perceived religious favoritism and transparency concerns. The project remains under evaluation with unspecified private funding, raising questions about accountability and potential misuse of public resources. The controversy highlights broader issues of religious accommodation in public infrastructure and the need for clear governance in publicly funded projects.
A high-profile event, 'Canticle of Peace,' involving Pope Leo XIV and Andrea Bocelli, was leveraged to distribute malware to 164 young participants from vulnerable communities via a spoofed Banvelca sponsorship. The attack compromised personal data, including biometric and financial details, of unknowing attendees through a malicious PDF download disguised as event credentials.
A new database documents over 100 cases of law enforcement abuse of Flock Surveillance Cameras, revealing unauthorized access and misuse of real-time public surveillance data. The impacted vendor is Flock Safety, a provider of AI-powered camera systems used by over 1,500 law enforcement agencies across the U.S., with potential legal and reputational consequences for both the vendor and agencies involved.