A large-scale GitHub campaign abused stolen access tokens to target 13,500+ branches and repositories with secret-stealing workflows

Six Linux flaws were made public, including one with a working root exploit and no merged fix

Microsoft’s updates address two newly disclosed vulnerabilities in the .NET developer platform, as well as flaws not fully addressed in an earlier release

Blue Initiative launches a new vulnerability database for IT and OT CVEs relevant to the maritime industry

PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected

Booking.com's systems were never breached. Its name was. Storm-1865 spent months borrowing Booking.com's identity to get into hotel computers, and every step of that borrowing left traces on the open internet.

CISA’s new strategy, CISA 2030, will focus on rapid detection and response and resiliency of critical services ahead of “passive defense”

At the association’s recent European conference, it was clear that security and governance professionals are having to move faster than ever just to keep up

An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.

Nvidia's Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.

Nvidia's Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.

AI coding agents may act on instructions embedded in local markdown files, exposing new risks around trust, configuration, and credentials.

Measuring AI model security gets complex, fast, thanks to a growing patchwork of benchmarks targeting different variables in the equation.