Malicious JPEG Images Could Trigger PHP Memory Safety Vulnerabilities

Two critical memory-safety vulnerabilities in PHP's image-processing functions could allow attackers to leak sensitive heap memory.

Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’

Multiple researchers using the same tools to find the same bugs are creating ‘unnecessary pain and pointless work’

ICO Publishes Five-Step Plan to Counter Emerging AI-Powered Attacks

The Information Commissioner’s Office has released new guidance on how to mitigate the risk of AI-powered attacks

New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption

Fragnesia CVE-2026-46300 corrupts Linux page cache via XFRM ESP-in-TCP, enabling local root access on major distros.

PraisonAI vulnerability gets scanned within 4 hours of disclosure

A newly disclosed authentication bypass flaw (CVE-2026-44338) in PraisonAI drew near-instant probing, exposing risks from default-insecure AI APIs.

Critical Next.js Vulnerability Exposes Cloud Credentials, API keys, and Admin Panels

A high-severity flaw in Next.js lets attackers exploit SSRF to steal cloud credentials, API keys, and access internal systems.

The time of much patching is coming

In this week’s newsletter, Martin reflects on what the next iteration of AI tools means for vulnerability discovery and our ability to manage large-scale patch releases.

Zero Day Initiative — Pwn2Own Berlin 2026 - Day One Results

Welcome to Day One of Pwn2Own Berlin 2026! Today, 22 entries took the Pwn2Own stage to target AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products, as the world’s...

Kazuar: Anatomy of a nation-state botnet | Microsoft Security Blog

Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused oper...

OpenAI asks macOS users to update after TanStack npm supply chain attack

The actions are being taken in light of an expanding supply chain campaign impacting the popular open-source library TanStack and additional npm and PyPI packages tied to several AI companies.

18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE

NGINX Rift CVE-2026-42945 scores 9.2 after 18 years, enabling unauthenticated RCE or DoS via crafted HTTP requests.

716,000 Impacted by OpenLoop Health Data Breach

The telehealth platform was hacked in January, and users’ personal information was exfiltrated from its systems.

Microsoft, Palo Alto Networks Find Many Vulnerabilities by Using AI on Their Own Code

Microsoft’s MDASH discovered 16 of the Patch Tuesday vulnerabilities, and Palo Alto used Mythos to find dozens of flaws.

Global Cyber Agencies Issue New SBOMs for AI Guidance

The G7 Cybersecurity Working Group releases new SBOM for AI guidance, outlining seven key data clusters to boost transparency and security across AI supply chains

Chipmaker Patch Tuesday: Intel and AMD Patch 70 Vulnerabilities

The two chip giants have published over two dozen advisories describing recently identified security defects.