Data / Tool
Open the risk workbench
Search records, inspect source links, compare priority, export capped samples, and check source freshness before deciding what deserves deeper review.
Critical Microsoft ASP.NET Core Vulnerability Enables System Privilege Escalation
Microsoft has released urgent security updates for ASP.NET Core to address CVE-2026-40372, a critical elevation of privilege vulnerability. Flaws in cryptographic signature validation allow unauthenticated attackers to forge authentication cookies and gain SYSTEM-level access. The vulnerability primarily impacts non-Windows environments using the Data Protection package, requiring immediate patching of affected container and server deployments.
AI Shift Triggers 1,140% Identity Surge as Organizations Pivot to Non-Human Identity Governance
Okta’s ‘Businesses at Work 2026’ report reveals a massive 1,140% surge in access requests over two years, driven primarily by autonomous AI agents. This shift is forcing global enterprises to move beyond traditional user-centric security, prioritizing non-human identity (NHI) governance and phishing-resistant multi-factor authentication to secure modern cloud and hybrid infrastructure environments.
CrowdStrike Launches Project QuiltWorks to Counter AI-Driven Vulnerability Discovery
CrowdStrike has established Project QuiltWorks, an industry-wide coalition including OpenAI and IBM, to address the rapid discovery of software vulnerabilities by generative AI. The initiative integrates expert-led red teaming with frontier AI models to help organizations prioritize and remediate risks faster than automated exploitation tools can identify them, moving beyond traditional periodic security scanning.
CISA Expands KEV Catalog with ScreenConnect Path Traversal and Windows Shell Spoofing Vulnerabilities
CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: a high-severity path traversal flaw in ConnectWise ScreenConnect and a Windows Shell spoofing vulnerability. Both flaws have confirmed active exploitation in the wild, requiring federal agencies and private organizations to prioritize patching to prevent unauthorized remote access and network-based identity spoofing.
Google Patches Critical Remote Code Execution Vulnerability in Android Wireless ADB
Google has addressed a high-severity security flaw (CVE-2026-0073) in the wireless Android Debug Bridge (ADB) functionality. Affecting Android 14 and newer versions, the vulnerability allows nearby attackers to bypass authentication and execute code with shell privileges. Users should ensure their devices are updated to the May 2026 security patch level to mitigate risk.
Kaspersky Analysis Reveals GPU Performance Gains Render Eight-Character Passwords Obsolete
A new study by Kaspersky analyzing 231 million leaked passwords shows that 48% can be cracked in under a minute. Rapid advancements in consumer GPU hardware, specifically the shift to the NVIDIA RTX 5090, have dramatically reduced the time required to break simple hashes, rendering traditional eight-character passwords virtually useless against modern brute-force and AI-assisted attacks.
Convergence of Human and System Vulnerabilities: Analyzing ‘Copy Fail’ and Recent Japanese Security Breaches
Recent high-profile security incidents involving Hatena and Money Forward, combined with the discovery of the ‘Copy Fail’ Linux kernel vulnerability (CVE-2026-31431), highlight a dangerous trend where attackers combine social engineering with local system exploits to bypass traditional network defenses.
Passkeys and SSO Adoption Drive First Decline in Managed Password Volume Since 2020
A 2026 study by NordPass reveals that the average number of managed passwords per user has decreased to 120, marking a reversal of a multi-year growth trend. The shift is attributed to the rise of passkeys, biometric authentication, and Single Sign-On (SSO) platforms, signaling a transition toward passwordless infrastructure.
Japan’s SCS Evaluation System Shifts Toward Continuous Security Operations and Workforce Frameworks
Japan is implementing a new Supply Chain Cybersecurity (SCS) Evaluation System that prioritizes continuous operational maintenance over one-time audits, requiring organizations to integrate annual inspections and specialized personnel frameworks into their core business processes.
Google Identifies AI-Generated Zero-Day Exploits and Autonomous Malware Operations
Google’s Threat Intelligence Group (GTIG) has revealed that state-sponsored actors from China, North Korea, and Russia are increasingly integrating generative AI to discover zero-day vulnerabilities, automate malware generation, and conduct large-scale disinformation campaigns.