The Governance Gap: Why Policy Breaks Down at Scale
Join CyCognito’s CEO Rob N. Gurzeev and Commvault’s Ben Herzberg to uncover what enforcing data security at scale actually requires and how to close the gap between policy and ground truth.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Emerging Threat: (CVE-2026-3854) GitHub Enterprise Server RCE via Git Push Injection
CVE-2026-3854 is a command injection vulnerability in GitHub Enterprise Server. It lives in the git push pipeline. User-supplied push option values were not properly sanitized before being embedded in an internal service header. The header format used a delimiter that could also appear in user input. A crafted push option containing that delimiter let an attacker inject additional metadata fields. Downstream services treated those fields as trusted internal values.
Emerging Threat: (CVE-2026-40372) ASP.NET Core Privilege Escalation via Signature Bypass
CVE-2026-40372 is an elevation of privilege vulnerability in ASP.NET Core caused by improper verification of cryptographic signatures in the Data Protection library. The flaw sits in the HMAC validation routine of the managed authenticated encryptor, where a defective comparison lets an attacker submit a forged payload that the application accepts as legitimately signed. The vulnerability carries a CVSS v3.1 base score of 8.1 (Important), as assigned by Microsoft in the official advisory.
How Third-Party Development Partners Become Your Biggest Security Liability
Third-party development partners offer real advantages: faster delivery, specialised expertise, and lower costs than building an in-house team. They also expand your attack surface in ways most organisations never fully account for. When an external team builds or modifies your systems, they bring with them their own tools, practices, access levels, and vulnerabilities. The question is not whether that creates risk. It is whether your organisation is managing it deliberately or leaving it to chance.
Tired of hearing about Mythos? Your Board isn't.
And neither are attackers. Claude Mythos Preview has been public for less than two weeks. Vendor newsletters and LinkedIn feeds have covered it to exhaustion. Meanwhile, your Board has one question, in plain language, not acronyms: what does this mean for our company and are we prepared?
Emerging Threat: (CVE-2026-29145) Apache Tomcat Authentication Bypass
CVE-2026-29145 is an authentication bypass flaw in Apache Tomcat and Apache Tomcat Native affecting the CLIENT_CERT authentication path. When OCSP soft-fail is disabled, certain code paths fail to treat an OCSP check failure as a hard authentication failure, allowing a connecting client to reach protected resources without presenting a valid, revocation-checked certificate.
Emerging Threat: (CVE-2026-23869) React Server Components Denial of Service
CVE-2026-23869 is a denial of service vulnerability in React Server Components, caused by improper handling of cyclic data structures during deserialization of incoming HTTP requests. The vulnerability resides in the React Flight protocol's server-side reply handling, specifically in the createMap, createSet, and extractIterator functions within ReactFlightReplyServer.js. The vulnerability carries a CVSS v3.1 base score of 7.5 (High). Exploitation requires no authentication and no user interaction.
Mythos, MOAK, CTEM and the End of CVE Chasing
A few weeks ago the world was exposed to Mythos, Anthropic's new frontier model and the Project Glasswing announcement that came with it. The reaction across the industry was immediate. Cybersecurity stocks fell sharply. The Treasury Secretary convened an emergency meeting with major bank CEOs. 250 CISOs produced a response playbook over a single weekend. That is not a typical announcement or a PR "leak". That is a reckoning. Then, about a week later, I came across MOAK.
Are You Ready for the CVE Avalanche?
What the Anthropic Mythos findings mean for every security team, and the 90-day window you cannot afford to miss. Last week, Anthropic published something that should stop every CISO in their tracks. Its Mythos Preview model, running autonomously, without expert guidance, identified thousands of high- and critical-severity vulnerabilities across major operating systems, browsers, and open-source projects.
Emerging Threat: Axios npm Supply Chain Attack Drops Remote Access Trojan (RAT)
On March 31, 2026, two malicious versions of axios were published to npm, , using credentials stolen from a lead axios maintainer. The attacker injected a hidden dependency into both releases that drops a remote access trojan (RAT) on any machine that ran npm install during the exposure window. No CVE identifier has been assigned at the time of writing. The malicious dependency executes automatically at install time via a postinstall hook, without any action by the developer.