Code Defender

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.

The vulnerabilities are listed below –

CVE-2026-111357 (CVSS score: 8.8) – A missing authentication for a critical function vulnerability that could allow a

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.

The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October

TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host.

A malicious or compromised host can exploit the flaw to crash the viewer’s TeamViewer and, depending on the platform, may also run

Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously.

The activity has been attributed by CrowdStrike to a China-based “targeted intrusion adversary” it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in

Ahmad Umar Agha, known online as “Th3Pr0,” was sentenced Thursday in federal court in Virginia to 42 months behind bars for his role in a conspiracy that was organized by former Syrian President Bashar al-Assad’s closest advisers.

The company, billing itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” said a recent hack exposed customer payment card numbers.

The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms.

It allowed customers to host hack-for-hire services, supported ransomware and infostealer operators, and accepted crypto payments.

The post Bulletproof Host Virtualine Loses Its Domain to FBI Seizure appeared first on SecurityWeek.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.

The post Passkeys Are Better Than Passwords. But They Are Not Enough. appeared first on SecurityWeek.