Vibe coding has cybersecurity asking what AI can — and can’t — replaceLaura FrenchMay 11, 2026Cyber pros balance hype, skepticism and uncertainty as AI coding disrupts industry norms.
Threat actor Mr_Rot13 exploits critical cPanel flaw to deploy Filemanager backdoorSC StaffMay 12, 2026
Trust or fail: AI unlocks the value of unstructured data but raises new challenges for AI successPaul WagenseilApril 28, 2026
Controlling AI at machine speed: Detecting risk, protecting systems, and reversing mistakesPaul WagenseilApril 24, 2026
Vulnerability ManagementPatch Tuesday: No zero days among 137 Microsoft CVEs, 4 Word RCEsLaura FrenchMay 12, 2026The May 2026 Microsoft security update included no zero days for the first time since June 2024.
Identity‘Mini’ Shai-Hulud attack compromises hundreds of npm, PyPI packagesSteve ZurierMay 12, 2026Teams warn the latest Shai-Hulud wave weaponizes trusted OIDC tokens to bypass package integrity checks.
AI/MLGoogle reports first known AI-assisted zero-day exploit in the wildLaura FrenchMay 12, 2026Attackers used AI to create an exploit script for a 2FA bypass flaw in an open-source project.
IdentitySailPoint GitHub repo hit by third-party cyberattackSteve ZurierMay 11, 2026SailPoint says GitHub repo breach exposed no customer data or production systems.
Vulnerability ManagementFederal agencies ordered to patch Ivanti EPMM zero-day in 3 daysLaura FrenchMay 8, 2026The actively exploited flaw enables remote admin users to execute arbitrary code.
Vulnerability Management‘Dirty Frag’ Linux zero-day exposes most distributions to LPESteve ZurierMay 8, 2026Dirty Frag Linux zero-day exposes most distributions to root privilege escalation.
Vulnerability ManagementPalo Alto Networks says patch for exploited PAN-OS firewall bug forthcomingSteve ZurierMay 7, 2026Palo Alto confirms that its PAN-OS firewalls were actively exploited by a zero-day for more than a month.
RansomwareIranian threat group used Chaos ransomware as a ‘false flag,’ researchers sayLaura FrenchMay 7, 2026The purported ransomware attack did not encrypt files and used infrastructure tied to MuddyWater.