Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Arctic Wolf

Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory

Jun 23, 2026 By Arctic Wolf Labs In Arctic Wolf
FortiBleed is a large-scale credential compromise campaign that targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign does not depend on a malware payload; instead, it uses a credential pipeline that utilizes credential stuffing, password spraying, configuration harvesting, offline cracking, and post-authentication capture processing.
Read Post
tanium

Continuous vulnerability management: Is your program actually continuous?

Jun 23, 2026 By Tanium In Tanium
Continuous vulnerability management (CVM) is an ongoing, automated approach to discovering, analyzing, prioritizing, and remediating security weaknesses across an organization's IT environment. It replaces periodic scans with real-time visibility that shrinks attacker opportunity windows.
Read Post
indusface

CVE-2026-42271: Unauthenticated RCE in LiteLLM AI Gateway

Jun 23, 2026 By Deepak Kumar Choudhary In Indusface
LiteLLM, a widely deployed open-source AI gateway, is affected by a critical exploit chain that allows unauthenticated attackers to execute arbitrary commands on vulnerable hosts. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities (KEV) catalog on June 9, 2026, confirming active exploitation in the wild. The Qilin ransomware group has been linked to exploitation activity. What makes this especially dangerous is the chain: CVE-2026-42271 on its own required a valid API key.
Read Post
Snyk

The New Security Control Point: Governing AI Agents Inside the Execution Loop

Jun 23, 2026 By Agnieszka Koc In Snyk
As organizations adopt AI agents to build software, security teams face a new challenge: risk is no longer introduced only through the code that gets produced. It emerges continuously through the tools agents use, the actions they take, and the code they generate. This is the problem Evo Agentic Development Security (ADS) was designed to solve. ADS secures all three layers of the agentic development system—what agents use, what they do, and what they generate.
Read Post
Snyk

Announcing Agentic Development Security (ADS)

Jun 23, 2026 By Daniel Berman In Snyk
Today, we're announcing Agentic Development Security (ADS), a new Evo solution designed for securing AI-driven software development. AI agents are now active participants in the software development process, selecting tools, executing actions across systems, and generating production-ready code at machine speed.
Read Post
seemplicity

How to Use AI for Vulnerability Management

Jun 22, 2026 By Jessica Amado In Seemplicity
With over 48,000 CVEs published in 2025 and attackers weaponizing vulnerabilities in as little as 20 hours, traditional vulnerability management is no longer enough. This post breaks down the key findings from the SANS whitepaper The Exposure Gap: From Vulnerability Management to AI-Driven Control, and what it means for security teams trying to get ahead of risk. In 2025, over 48,000 CVEs were published. That’s roughly 130 new vulnerabilities every single day.
Read Post
jfrog

PixelSmash - Critical FFmpeg Vulnerability Turns Media Files into Weapons

Jun 22, 2026 By Yuval Moravchick In JFrog
JFrog Security Research recently discovered and disclosed a critical vulnerability in FFmpeg, the world’s most widely deployed media processing framework. The discovered vulnerability, which we’ve named PixelSmash, is CVE-2026-8461 – a heap out-of-bounds write in the MagicYUV decoder (CVSS 8.8 High). We escalated this vulnerability from a simple crash all the way to reliable remote code execution – all it takes is processing a single malicious media file.
Read Post

How to Setup AI Rules, Skills, Hooks and MCPs

Jun 22, 2026 By Snyk In Snyk
In this video, we break down how to properly set up and use AI extension points - specifically MCP (Model Context Protocol) servers, Rules, Skills, and Hooks - to supercharge your development workflow. Using practical, security-flavored examples with Claude Code and Snyk, you'll learn how to configure a local project environment that automatically catches vulnerabilities before they ever hit your codebase. Whether you use the Claude CLI, VS Code extensions, or alternate AI ecosystems like Cursor or Gemini, you can use these exact steps as a blueprint to automate any workflow in your project.
View Video
outpost 24

Why Annual Penetration Testing No Longer Matches Modern Application Risk

Jun 19, 2026 By Dominique Adams In Outpost 24
Penetration testing remains one of the most effective ways to identify exploitable vulnerabilities, validate security controls, and provide assurance that applications can withstand real-world attack techniques. For years, annual penetration testing was a reasonable approach. Most business applications changed relatively slowly, with major releases happening a handful of times each year.
Read Post
sedara

FortiBleed Is a Reminder: You Can't Protect What You Can't See

Jun 19, 2026 By Liz Sujka In Sedara
A recent report about exposed Fortinet and FortiGate VPN credentials is a reminder of a hard truth in cybersecurity: risk is not always hidden in advanced malware or complex attack chains. Sometimes, the biggest exposure comes from known systems, forgotten access, weak credentials, or internet-facing assets that are not being monitored closely enough.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.