Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

September 23, 2026

Ravie LakshmananSep 23, 2026Data Breach / Cybercrime The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached...

Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks

Swati KhandelwalSep 22, 2026Network Security / Vulnerability Attackers exploited a previously unknown flaw in Check Point's Security Management Server in...

WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

Swati KhandelwalSep 22, 2026Vulnerability / Web Security WordPress has fixed a critical flaw in its core software that lets an...

Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials

Ravie LakshmananSep 22, 2026Supply Chain Attack / Malware Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731"...

Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI)...

Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials

Swati KhandelwalSep 22, 2026Artificial Intelligence / Vulnerability A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more...

Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates

Swati KhandelwalSep 22, 2026Vulnerability / Endpoint Security A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature...

AI Agents Are Rewriting the Rules of Lateral Movement

Security teams have spent decades asking whether an identity has too much access. AI agents raise a harder question: how...

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups