Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions.

The post Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Microsoft rolled out patches for cloud services, hackers compromised 5,000 Dropbox accounts, and Guardio is now valued at $1.1 billion.

The post In Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B Valuation appeared first on SecurityWeek.

Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.

The post HPE Patches Critical RCE Vulnerabilities in AOS-CX appeared first on SecurityWeek.

The Daybreak initiative will provide subsidized AI cyber capabilities, training and technical assistance, though OpenAI has disclosed few details about costs and eligibility.

The post OpenAI Pledges $1 Billion to Bring Frontier AI to Critical Infrastructure Defenders appeared first on SecurityWeek.

Tracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.

The post Sangoma Switchvox Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.

Dubbed PostGREShell, CVE-2026-6471 turns low-level replication access into code execution, permanent superuser privileges and a persistent database backdoor.

The post 12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover appeared first on SecurityWeek.

Catch promises the capabilities of a trusted executive assistant, with built-in controls governing what data and systems it can access.

The post Catch Raises $5 Million for AI Executive Assistant With Guardrails appeared first on SecurityWeek.

The flaws could allow attackers with administrative access to a virtual machine to execute code on the host system.

The post VMware Workstation and Fusion Updates Patch Critical Vulnerability appeared first on SecurityWeek.

Google’s Chrome 152 security update resolves 12 vulnerabilities, including a high-severity type confusion flaw in the V8 engine.

The post Google Patches 6th Chrome Zero-Day of 2026 appeared first on SecurityWeek.

The deal highlights Nvidia’s push to champion increasingly popular open-source AI models.

The post Nvidia Is Buying AI Platform Hugging Face for $13 Billion appeared first on SecurityWeek.

Midnight Blizzard has been stealing Microsoft account credentials via compromised Wi-Fi networks at hospitality organizations.

The post Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking appeared first on SecurityWeek.

Michigan, South Dakota, and Georgia are reportedly on the list of states whose water systems have been targeted by Iran-linked hackers.

The post US Water Cyberattacks Extend Beyond Minnesota to at Least 6 Other States appeared first on SecurityWeek.

The funding round was led by SYN Ventures, with participation from existing investors DataTribe and TEDCO.

The post Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments appeared first on SecurityWeek.

The flaw can be exploited by unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (RCE).

The post Ruby on Rails Patches Critical Vulnerability appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: parcel delivery company OnTrac hacked, Adobe patches, UK Department for Education loses 607,000 records.

The post In Other News: OpenAI Open Source Tool, AWS Links Hacks to North Korea, Mythos Crypto Research appeared first on SecurityWeek.

Iran has the “geopolitical motivations” and a recent history of targeting water systems, experts pointed out.

The post Cyberattacks on Minnesota Water Systems Investigated as Officials Warn About Iranian Hackers appeared first on SecurityWeek.

The internet giant has built an agent harness to find vulnerabilities across Chrome’s codebase.

The post Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace appeared first on SecurityWeek.

When the AI Act comes into force, AI companies will be required to make clear to consumers with labels or digital watermarks that chatbots or imagery are generated with AI.

The post EU to Crack Down on AI Deepfakes, Illicit Imagery and Hacking With New Team in Brussels appeared first on SecurityWeek.

A security company’s systems were hacked after it installed a malicious Python package deployed by Claude. 

The post Prompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations appeared first on SecurityWeek.

Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access.

The post Critical Flaw Allowed to Azure Cosmos DB Pwnage appeared first on SecurityWeek.