Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Snyk

Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

Apr 29, 2026 By Brian Vermeer In Snyk
The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as the new Log4shell, read this first. CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf. Thymeleaf is a templating engine in Java that is used for server-side webpage rendering. The sandbox that normally prevents arbitrary code execution got bypassed using a tab character. And yes, this can lead to a remote code execution if exploited.
Read Post
Snyk

"A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages

Apr 29, 2026 By Stephen Thoemmes In Snyk
On April 29, 2026, attackers published malicious versions of four npm packages in the SAP development ecosystem: mbt, @cap-js/db-service, @cap-js/sqlite, and @cap-js/postgres. Each compromised release ships a preinstall hook that downloads the Bun JavaScript runtime from GitHub Releases and uses it to execute an ~11.6 MB obfuscated credential stealer.
Read Post
cycognito

Emerging Threat: (CVE-2026-3854) GitHub Enterprise Server RCE via Git Push Injection

Apr 29, 2026 By Igal Zeifman In CyCognito
CVE-2026-3854 is a command injection vulnerability in GitHub Enterprise Server. It lives in the git push pipeline. User-supplied push option values were not properly sanitized before being embedded in an internal service header. The header format used a delimiter that could also appear in user input. A crafted push option containing that delimiter let an attacker inject additional metadata fields. Downstream services treated those fields as trusted internal values.
Read Post
seal security

Beyond the Build: Dynamic Remediation for Malicious Package Versions

Apr 29, 2026 By Alon Navon In Seal Security
In the fast-moving world of software supply chains, the discovery of a malicious version of a popular library often triggers a state of emergency. Traditional security tools take a reactive approach: they scan, they find a match, and they fail the build. But what happens if the malicious version was merged before it was flagged? What if it’s already running in your production containers? Or what if it’s being pulled dynamically across hundreds of different pipelines?
Read Post
nucleus

Exploited Before CISA KEV: What 8 Confirmed Cases Reveal

Apr 29, 2026 By Tally Netzer In Nucleus
Most vulnerability programs are built to act when risk looks obvious, such as when a vulnerability lands in CISA KEV, a public exploit emerges, or EPSS rises. This approach is rational because it provides a clear, defensible trigger for action. But it often comes with delay: by the time signals are strong enough to drive consensus, the window to get ahead of risk may already be closing.
Read Post
Arctic Wolf

Vulnerability Prioritization Requires More Than a Score

Apr 29, 2026 By Dan Schiappa In Arctic Wolf
As AI systems become more capable and increasingly embedded into business operations, security teams are confronting a familiar challenge in a new form: speed without context. Vulnerability discovery is accelerating toward machine scale, while adversaries continue to adapt in real time. In response, the industry has gravitated toward data‑driven scoring models to help determine what deserves attention first.
Read Post

"Just looking at code and finding vulnerabilities is not going to stop breaches."

Apr 29, 2026 By CrowdStrike In CrowdStrike
CrowdStrike CEO and Founder George Kurtz discusses with Dan Ives of Wedbush Securities why frontier AI models won’t replace cybersecurity platforms: stopping breaches requires proprietary data, real-time decisions, enterprise-grade support and the ability to act in milliseconds.
View Video
cato networks

Cato CTRL Threat Research: New Vulnerabilities in NVIDIA NeMo and Meta PyTorch Enable Full System Compromise

Apr 29, 2026 By Inga Cherny In Cato Networks
Cato CTRL has discovered high-severity vulnerabilities in NVIDIA NeMo (CVE-2025-33236 with a CVSS score of 7.8) and Meta PyTorch that turns AI model files into remote code execution (RCE) vectors. The NeMo vulnerability allows RCE by importing a malicious AI model. The NeMo framework silently executes threat actor-controlled code with no warning.
Read Post
Continuous Threat Exposure Management (CTEM): The Complete Guide to Proactive Cybersecurity

Continuous Threat Exposure Management (CTEM): The Complete Guide to Proactive Cybersecurity

Apr 28, 2026 By SecuritySenses In SecuritySenses
The cybersecurity landscape has fundamentally changed. Organizations today manage sprawling digital environments - cloud workloads, remote endpoints, SaaS applications, third-party APIs, and hybrid infrastructure - all of which expand the attack surface at a pace that traditional security programs simply cannot match.
Read Post

Exposure Prioritization Agent: Demo Drill Down

Apr 27, 2026 By CrowdStrike In CrowdStrike
Vulnerability volume continues to rise, making it difficult for security teams to determine which exposures actually matter. Without clear prioritization, teams are forced to react to volume, often focusing on severity scores instead of real risk. In this demo drill down, we showcase the Exposure Prioritization Agent within Falcon Exposure Management. You’ll see how AI-driven prioritization uses ExPRT.AI, adversary intelligence, and business context to reduce millions of vulnerabilities into a focused set of high-risk exposures.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.