CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog in June 2026 — Android Framework RCE, Linux kernel privesc, Oracle WebLogic access, PAN-OS VPN bypass, and trojanized Daemon Tools builds. Here is what defenders need to know and do.
From AI-powered attacks to post-quantum cryptography, explore the five cybersecurity trends defining 2026 and what defenders must do now.
AI-powered attacks surged in 2026: autonomous attack agents, AI-generated phishing up 1,200%, and machine-speed exploitation. The top threat vectors and what AppSec professionals must do to defend.
Pwn2Own Berlin 2026 awarded $1.3M for 47 zero-days in three days - and AI coding assistants OpenAI Codex and Anthropic Claude Code were exploited on stage for the first time. DEVCORE took Master of Pwn with $505K. Full results, the AI-target analysis, and what AppSec teams must do now.
Five threat streams converged in May 2026: the actively exploited Ivanti EPMM zero-day, a fake OpenAI repo on Hugging Face dropping infostealers, cPanel CVEs reaching CVSS 8.8, TCLBANKER worming through WhatsApp and Outlook, and ShinyHunters hitting Canvas LMS. One briefing, one action plan.
Three AI-adjacent CVEs hit CISA’s KEV catalog in one month: the LiteLLM proxy auth bypass exposing every prompt your org ever sent, a Linux kernel privesc reaching GPU training clusters, and PAN-OS as the beachhead. Living off the LLM, explained.
Microsoft Defender's May 2026 triple zero-day: BlueHammer (CVE-2026-33825) steals SAM hashes, RedSun overwrites SYSTEM files, UnDefend blinds the EDR itself. One is patched, two are not.
Zero-days went from rare events to the 2026 baseline: the Chrome double zero-day, the APT28 re-exploited Windows Shell flaw, and Adobe's four-month window. The data, the CVEs, and a six-step defense playbook.
Microsoft’s April 2026 Patch Tuesday fixed 168 vulnerabilities — an exploited SharePoint zero-day (CVE-2026-32201), the BlueHammer Defender EoP, and a CVSS 9.8 IKE RCE. Complete breakdown and patching order inside.
April 2026 was one of the most volatile months in cybersecurity history: Microsoft’s 167-flaw Patch Tuesday, exploited SharePoint and IKE zero-days, ransomware at Rockstar and McGraw-Hill, and two CISA emergency directives — everything defenders need to know.