AI companies like OpenAI and Anthropic should play a bigger role in software vulnerability disclosures in the future, according to a leader of the world’s largest vulnerability disclosure scheme. Speaking at the opening of VulnCon26 in Scottsdale, Arizona, on April… Read More "AI Companies To Play Bigger Role in CVE Program, Says CISA"
The contours of business disruption are changing. It can start with a ransomware incident, an identity compromise, a supplier outage, or a prolonged cloud failure in one unit, then spread across connected systems. Disruption can simultaneously affect operations, customer access,… Read More "Cyber Resilience is the New Business Continuity Plan"
A critical authentication bypass in nginx-ui, a widely used open-source web interface for managing nginx servers, has been actively exploited in the wild. The vulnerability, tracked as CVE-2026-33032 with a CVSS score of 9.8, was discovered by Pluto Security and… Read More "Critical Nginx-ui MCP Flaw Actively Exploited in the Wild"
Microsoft announced on Tuesday that it has disrupted a cybercrime service that has been helping threat actors distribute ransomware and other malware. According to the tech giant, a threat actor it has named Fox Tempest has been running a malware-signing-as-a-service… Read More "Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ "
Ravie LakshmananMay 19, 2026Malvertising / Mobile Security Cybersecurity researchers have disclosed details of a new ad fraud and malvertising operation dubbed Trapdoor targeting Android device users. The activity, per HUMAN’s Satori Threat Intelligence and Research Team, encompassed 455 malicious Android… Read More "Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps"
A signed software operation linked to a company called Dragon Boss Solutions LLC has reportedly been silently disabling antivirus products on more than 23,000 endpoints worldwide According to research published by Huntress on Tuesday, the campaign used a legitimate code-signing certificate… Read More "Signed Adware Operation Disables Antivirus Across 23,000 Hosts"
Drupal is warning users that it’s preparing a patch for a ‘highly critical’ vulnerability that may be exploited by threat actors shortly after its disclosure. In a notice posted this week, the developers of the open source content management system… Read More "Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation"
Ravie LakshmananMay 19, 2026Vulnerability / Website Security Drupal has issued an alert stating that it intends to release a “core security release” for all supported branches on May 20, 2026, from 5-9 p.m. UTC. “The Drupal Security Team urges you… Read More "Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare"
“Not every valid submission represents a meaningful security risk. Some reports identify hardening opportunities or documentation gaps,” Jarom Brown, a senior security researcher at GitHub, wrote in a blog post. On top of that, he said, many of the reports… Read More "GitHub scales back bug bounties, reminds users security is their responsibility too"
Microsoft has cracked down on Fox Tempest, a cyber threat actor that fueled Rhysida ransomware attacks and developed tools for major malware strains like Oyster, Lumma Stealer, and Vidar. On May 19, the tech giant unsealed a legal case in… Read More "Microsoft Takes Down Group Operating Ransomware-Enabling Signing Tool"
