SeverityCritical briefings
Only the stories rated critical: the flaws to patch first.
Bad Epoll Linux Kernel Flaw Grants Root to Unprivileged Users, Affects Android
A newly disclosed Linux kernel vulnerability tracked as CVE-2026-46242 allows an ordinary unprivileged user to gain full root control. The flaw affects…
Delta Electronics DVP12SE PLC Exposes Critical Unauthenticated Modbus Flaws
Two critical vulnerabilities in Delta Electronics DVP12SE PLCs allow unauthenticated remote attackers to manipulate control logic and flood the device into unavailability.…
Agentic AI Drives Real Ransomware Attack Through Langflow Flaw
A threat actor exploited a critical Langflow vulnerability to deploy an LLM agent that autonomously performed reconnaissance, lateral movement, and ransomware encryption…
Critical Cursor AI Editor Flaws Enable OS-Level Remote Code Execution
Two vulnerabilities in the Cursor AI code editor, collectively dubbed DuneSlide, allow attackers to escape the IDE sandbox and execute arbitrary code…
Medtronic Data Breach Exposes 3.8 Million Patients via ShinyHunters Attack
Medical device maker Medtronic is notifying nearly 3.84 million individuals after the ShinyHunters extortion group accessed corporate IT systems in April 2026,…
Progress Kemp LoadMaster Pre-Auth RCE Flaw Under Active Exploitation
A critical OS command injection vulnerability in Progress Kemp LoadMaster is being actively targeted, with exploitation attempts identified by eSentire's Threat Response…
Critical Cursor AI Editor Flaws Allow Prompt Injection to Escape Sandbox
Two near-perfect-severity vulnerabilities in the Cursor AI code editor, dubbed DuneSlide, can be triggered by a single malicious prompt to break out…
CISA Warns of Critical Hardcoded Credential Flaw in Gardyn IoT Hub
Three vulnerabilities in Gardyn's IoT Hub platform, including a CVSS 10 hardcoded credential bug, could let unauthenticated attackers access and control connected…
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
Adobe released security updates for ColdFusion and Campaign Classic addressing 12 vulnerabilities, including seven rated at maximum severity with CVSS scores of…
SimpleHelp Auth Bypass Exploited to Drop TaskWeaver and Djinn Stealer
Attackers are actively exploiting a maximum-severity authentication bypass in SimpleHelp to deliver two newly identified malware families, with the infostealer component targeting…
FBI Seizes NetNut Proxy Platform and Popa Botnet Infrastructure
The FBI, working with Google, Lumen, and Shadowserver, seized hundreds of domains tied to NetNut and the Popa botnet, a network of…
AI Agent Runs Autonomous Ransomware Attack Against Production Database
Sysdig researchers say they have identified what may be the first ransomware attack executed end-to-end by an AI agent, with a large…