SecurityCyber Insurance Claims Costlier Despite Drop in Frequency
Chubb's 2026 Cyber Claims Report finds fewer claims but soaring average costs, driven by litigation and business interruption.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityPatch windows collapse, network defense urged
Microsoft says the time to patch vulnerabilities is shrinking, urging network-level controls to bridge the gap.
SecurityWho answers for rogue AI agents?
A new wave of AI misbehavior raises a thorny question: when an agent goes rogue, who's legally accountable?
SecurityLACMA Breach Exposed Sensitive Data
LACMA's 2025 breach exposed social security and medical data; notifications sent.
SecurityNVIDIA AI Agent Flaw Opens Door to Model Poisoning
A NemoClaw weakness lets a webpage hijack local Ollama and inject persistent instructions into models.
SecuritySilent Patch Leaves WordPress Admins Exposed
Critical MiniOrange SAML SSO flaws exploited in wild; silent patch raises risk for WordPress sites.
SecurityReal-time phishing platform steers attacks
A phishing platform gives attackers live control over victim sessions, adapting prompts as credentials are harvested.
SecurityIdentity Checks Become the Weak Link
Attackers shift focus from login to onboarding and account recovery, exploiting weak identity verification.
SecuritySLEEPWALKER malware waits for a custom signal
A new Windows implant stays dormant, hiding as ESET's agent, until a crafted network command activates it.
SecurityZimbra attacks breach 270+ servers
Threat actors compromised over 270 Zimbra instances in ongoing RCE attacks, prompting CISA to order urgent patching.
SecurityWhatsApp Tightens Account Security With Passkeys, Stronger 2SV
WhatsApp expands passkey support, upgrades 2SV to full passwords, and tests caller context for Android.
SecurityCourse Weighs Attackers' View of Cyber-Physical Systems
SecurityWeek and MTSI repeat hands-on CAM training at the 25th ICS Cyber Security Conference.
SecurityMemory Poisoning: The New AI Attack Frontier
InjecMEM lets attackers plant persistent instructions in AI agents' memory with a single prompt.
SecurityAI tools shrink attack timelines for UAT-10147
Chinese-speaking group automates post-breach ops, slashing response windows for defenders.
SecurityOracle WebLogic Flaw Under Active Attack
CISA adds CVE-2026-21962 to KEV catalog, citing active exploitation and urging federal agencies to patch by August 27.
SecurityWeedhack Malware Poses as Minecraft Clients
Fake Minecraft sites spread Weedhack malware via SEO poisoning, with thousands of blocked attempts reported.
SecurityAliExpress caught using inaudible audio to fingerprint browsers
Researcher discovers AliExpress using obsolete WebAudio fingerprinting; Firefox fix likely neutralizes it.
SecurityLimited Breach: ReliaQuest Confirms Hack
ReliaQuest says ShinyHunters accessed an identity dashboard briefly but no customer data was compromised.
SecurityNIST Flags Multi-Cloud Security Pitfalls
New NIST report outlines 23 unique challenges in multi-cloud environments, urging community-driven solutions.
SecurityAI Coding Piles Up Remediation Debt
Enterprises face growing open-source vulnerability backlogs as AI tools accelerate code output.