Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Snyk

What Is AI Pentesting and How Does It Works?

Jul 27, 2026 By Snyk Team In Snyk
AI pentesting (AI penetration testing) is the use of reasoning-capable AI models to autonomously find, exploit, and validate security vulnerabilities in running applications — especially the context-dependent flaws, such as broken authorization and business-logic abuse, that traditional scanners cannot detect.
Read Post
Securing Your Data Pipeline from Internal Threats

Securing Your Data Pipeline from Internal Threats

Jul 27, 2026 By SecuritySenses In SecuritySenses
When organisations design security strategies, they often focus on building a fortress to keep external threats out. However, some of the biggest risks to data integrity don't come from outside; they start within. Securing a data pipeline, the complex system that moves information from source to destination, needs strong defences against internal threats, whether they're intentional or accidental.
Read Post
indusface

CVE-2026-6875: ServiceNow Sandbox Escape Leads to Pre-Auth RCE in AI Platform

Jul 23, 2026 By Bhargavi Pallati In Indusface
ServiceNow AI Platform (the enterprise PaaS formerly branded in the Now Platform) contains a critical, unauthenticated remote code execution vulnerability tracked as CVE-2026-6875. The vulnerability allows a remote attacker to escape ServiceNow’s JavaScript execution sandbox. No credentials or user interaction are required, and the attacker achieves full code execution on the underlying instance.
Read Post
seal security

Bad Things Also Come in Small Packages: A 38-byte DoS in fflate (CVE-2026-45820)

Jul 23, 2026 By Ben Bader In Seal Security
We discovered this new vulnerability as part of our abandoned-packages research. Despite what seems like a 2-year hiatus, fflate is one of the few popular npm packages that released a fix for the vulnerabilities we found merely using Sonnet-4.6, giving its 50M+ users a chance to upgrade to a safe version.
Read Post

Build the Zero-Day Playbook Before the Next Crisis

Jul 23, 2026 By Forescout Technologies In Forescout
In this video, Daniel dos Santos, VP of Research, explains why organizations should establish a zero-day containment playbook before a crisis occurs. A well-defined playbook connects response actions to assets, critical services, and business functions while outlining decision-making, impact validation, and crisis communication processes. When a real-world zero-day strikes, there is no time to create a plan from scratch. Preparation helps teams respond faster, align stakeholders, and reduce uncertainty during high-pressure situations.
View Video
How Anthropic's Claude Mythos Escaped a Secure Environment and What It Means for SMBs

How Anthropic's Claude Mythos Escaped a Secure Environment and What It Means for SMBs

Jul 23, 2026 By SecuritySenses In SecuritySenses
SecuritySenses and BCA, an IT services company in Spokane, team together to help small and midsize businesses turn frontier-AI security news into controls they can actually implement. During an internal evaluation, Anthropic gave Claude Mythos Preview access to a restricted computer and instructed it to find a way out. The model discovered a weakness, bypassed its technical restrictions and contacted the researcher overseeing the test.
Read Post
aikido

Finding eight high-severity vulnerabilities in NodeBB in six hours

Jul 22, 2026 By Jorian Woltjer In Aikido
TL;DR While improving our AI Pentest, we ran a whitebox assessment on NodeBB, a forum software powered by NodeJS. The result? Eight high-severity vulnerabilities that would all be exploitable on default instances of NodeBB. This includes Cross-Site Scripting (XSS), two of which require interaction with a custom Federation server that the AI agent had to set up itself. Another affects practically every input on NodeBB due to a template injection.
Read Post
indusface

WP2Shell: WordPress Core SQLi + REST API Chain to Pre-Auth RCE

Jul 22, 2026 By Pavithra Hanchagaiah In Indusface
A newly disclosed WordPress exploit chain, nicknamed “WP2Shell,” lets unauthenticated attackers achieve remote code execution (RCE) on any WordPress Core installation, no plugins required. Disclosed on July 17, 2026, the chain combines two vulnerabilities: CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API batch-route confusion).
Read Post
aikido

SQL injection isn't dead

Jul 22, 2026 By Dania Durnas In Aikido
Oops! A SQL injection bug just forced an emergency WordPress core patch last week. On July 17, WordPress shipped an emergency release to fix an unauthenticated remote code execution flaw in the core, reachable via a SQL injection that an anonymous attacker can exploit on a stock install. WordPress.org even turned on forced auto-updates because of how severe it is. Searchlight Cyber, who reported it, estimates over 500 million sites run WordPress.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.