Patch/Configuration Management

Anthropic launched “Project Glasswing” to restrict the availability of the new model to selected organizations.

The vulnerability, affecting versions up to 3.3.26, has a critical severity rating of 9.8 out of 10.

A crafted HTTP request can make restricted containers invisible to AuthZ plugins.

More than 12,000 internet-exposed instances of open-source AI agent builder Flowise could be compromised by the ongoing exploitation of the maximum-severity code injection flaw, tracked as CVE-2025-59528, which could lead to remote code execution, reports The Hacker News.

BleepingComputer reports that the Cybersecurity and Infrastructure Security Agency has called on federal civilian executive agencies to remediate Fortinet FortiClient Enterprise Management Server instances affected by the actively exploited pre-authentication API access bypass zero-day, tracked as CVE-2026-35616, by midnight of Apr. 9, as it added the flaw to its Known Exploited Vulnerabilities catalog.

Experts warn to apply hotfix right away for critical bug exploited in the wild.

The threat cluster, identified as UAT-10608 by Cisco Talos, has compromised at least 766 hosts across various regions and cloud providers.

Researchers at watchTowr identified an authentication bypass (CVE-2026-2699) and a remote code execution flaw (CVE-2026-2701) within the Storage Zones Controller (SZC) component of Progress ShareFile versions 5.x.