Apple CoreGraphics PoC Highlights Urgency of CVE-2026-86950 Patching
A public proof-of-concept has been released for CVE-2026-86950, an Apple CoreGraphics vulnerability that Apple says may have been used in highly targeted attacks. The research demonstrates a crash triggered by…
KillSec Takedown: Police Arrest Suspected Teen Operator and Seize Infrastructure
European law-enforcement agencies have arrested three people in an operation targeting the KillSec ransomware group, including a 16-year-old in Spain whom investigators suspect was the group’s main operator. Authorities also…
Attackers Abuse ChatGPT Custom GPTs in ClickFix Malware Campaign
Threat actors are abusing ChatGPT Custom GPTs to make malicious destinations look like legitimate AI product offerings, according to reporting based on Huntress research. The campaign directs victims to a…
Cisco Catalyst SD-WAN Manager Authentication Bypass CVE-2026-76504 Is Under Active Exploitation
Cisco’s Catalyst SD-WAN Manager is affected by CVE-2026-76504, a critical API authentication-bypass vulnerability that Cisco says has been exploited in the wild. Rapid7 reports that the flaw has a CVSS…
Citrix Warns That NetScaler CVE-2026-88771 and CVE-2026-88772 Are Being Exploited
Citrix has warned that exploitation of CVE-2026-88771 and CVE-2026-88772 has been observed on unmitigated NetScaler deployments. The vendor’s security bulletin covers multiple NetScaler ADC and Gateway vulnerabilities, with the two…
Microsoft Tracks Unauthenticated Command Injection on Internet-Facing Mail Servers
Microsoft published new tracking guidance for CVE-2026-73570, an unauthenticated command-injection vulnerability affecting internet-facing mail servers. The advisory underscores a familiar but high-impact operational risk: exposed infrastructure can move quickly from…
Microsoft Details Star Blizzard’s RedFlick Phishing and Malware Delivery Technique
Microsoft says the Russian state threat actor it tracks as Star Blizzard has expanded its operational playbook with large-scale phishing, compromised-website accounts, and a malware-delivery technique it calls RedFlick. Microsoft…
Anthropic: GLM-5.3 Raises the Bar for Open-Weight Cyber Capability
Anthropic has published a new assessment of Zhipu AI’s GLM-5.3, arguing that the open-weight model has crossed an important threshold in cyber capability. The report says GLM-5.3 can autonomously develop…
OpenAI Proposes Safety Cases for Frontier AI Training
OpenAI has proposed safety cases for frontier AI training: structured evidence, incident-derived regression tests, postmortems, and disclosure after investigations conclude. Why it matters A safety case connects risk claims to…
OpenAI Introduces GPT-6.1 Sol With Agentic Safety Claims
OpenAI says GPT-6.1 Sol shows lower failure rates than GPT-6 Sol in evaluations of tool transparency, explicit restrictions, and avoidance of unauthorized agentic outcomes. Security implications Vendor evaluations are evidence,…