CVE-2026-42016 Puts Artifact Authz on the KEV Clock
CISA put CVE-2026-42016 and four peers on the cybersecurity KEV clock. Authz bugs in your admin planes are exploited now. Check owners today.
September 2026
Attackers Published First. You Paid Longer.
CISA wants less spin as cybersecurity outages climb. Hedged notices and AI alert noise stretch downtime. Audit your IR clock.
Please Stop Pretending the VPN Is Internal
Critical VPN RCE is still a cybersecurity problem because your concentrator is public. Steal this week's hardening list before the next advisory.
GitLab’s Commits API Became a File Server
GitLab's CVSS 10 file-read hit cybersecurity teams within a day of disclosure. See which secrets to rotate first.
Who Still Grades Phishing by the Click?
Click rates still run most cybersecurity awareness programs. This week's research, plus a million AI lures, says score the password. Fix the metric.
Twenty Agencies Faced a Model Operator
Russia-linked spies used Claude against 20+ agencies. See what model-paced ops mean for your cybersecurity program, then close the gaps.
The ID Vendor Was Production
IDScan's 153 million license dump is a cybersecurity problem you outsourced. Inventory the copies before the next vendor call.
Rumor Is Enough to Own You
A rumor now yields a working exploit before the patch. See how that breaks cybersecurity embargoes, and what to change this week.
Someone’s Personal Phone Just Became Prod
Voice callers used BYOD to walk Microsoft 365 while cybersecurity stacks watched the laptop. See what to lock down first.
Stolen SPIFFE IDs Outlived the Isolated Worker
Root on one Kubernetes node can steal SPIFFE identities across the mesh. Tighten your cybersecurity IR before the next worker falls. Check the runbook.