16 articles tagged
CVE-2026-20253 is the first Splunk vulnerability ever added to CISA's KEV catalog: an unauthenticated RCE via the PostgreSQL sidecar. Here is the version matrix, the temporary workaround, and an hour-by-hour SOC runbook.
OpenAI is deprecating Atlas and moving browser agents into ChatGPT and Codex. Atlas stops working on 9 August 2026, bookmarks and cookies do not transfer, and the browser stops receiving security updates.
Two unauthenticated SharePoint Server RCEs, CVE-2026-50522 and CVE-2026-58644 (both CVSS 9.8), are exploited in the wild. Patching alone will not evict an attacker who stole your machine keys.
On July 27, 2026, Node.js patched HIGH-severity flaws across the 26.x, 24.x and 22.x lines, days after Next.js shipped its own. Here is which version to run and how to patch fast without breaking production.
OpenAI's Secure MCP Tunnel lets ChatGPT, Codex and the Responses API reach a private or on-prem MCP server over an outbound-only HTTPS path, with no inbound ports. How it works, how to set it up, and how to harden it.
MCP Apps shipped on 26 January 2026 as the first official MCP extension. Here is how the ui:// resource, the _meta.ui.resourceUri link, the sandbox CSP and the stateless 2026-07-28 core fit together.
The first scheduled Next.js security release landed on 20 July 2026 with nine CVEs across App Router, Server Actions, rewrites and the image endpoint. Here is who is actually exposed and how to patch.
Penalties reach ₹250 crore and full compliance is due 13 May 2027. Vendors quote ₹15 lakh to ₹2 crore. Here is what DPDP compliance actually costs a startup, and which line items you can build yourself.
Kubernetes 1.35 shipped Pod Certificates at Beta and constrained impersonation at Alpha. Neither is the zero-trust mTLS upgrade the headlines promised, and the KEP says so directly. Here is the real scope.
CISA added SharePoint RCE CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog with a July 4, 2026 federal deadline. Here is the defensive patch-and-harden checklist for on-premises SharePoint Server.
iOS 27 brings real-time scam detection, monitorable Lockdown Mode, silent security patches, hardware integrity checks, and a stricter TLS requirement that can break enterprise MDM. Here are the five security features
Five engineering lessons from shipping AI delivery: treat the model as swappable, start with evals not vibes, budget tokens and latency, ground outputs with retrieval, and build security in from day one.
How the iOS 27 Passwords app fixes weak and compromised logins in one tap, using Apple Intelligence and Safari and the W3C change-password standard. What you need, where it works, and the key security questions.
iOS 27 turns Passwords into a security agent: Apple Intelligence and Safari replace weak or breached passwords in one tap. How it works, the standard behind it, and what developers must do.
With iOS 27, declarative device management becomes the standard, legacy MDM update enforcement is removed, and TLS 1.2 becomes mandatory. Eight fleet-readiness moves for CTOs before the ~September 14 release.
In iOS 27, the Passwords app uses Apple Intelligence and Safari to change weak or compromised passwords with one tap. How the auto-fix works, and five things enterprise security teams should change.
