Stories tagged “Vulnerability Management.”
16 stories
AI coding tools can introduce open-source packages at a pace security teams were never built to handle, leading to remediation debt and security work accumulating faster than teams can close it.
The article discusses the impact of AI on vulnerability management and the need for a new prioritization approach. It highlights the limitations of current vulnerability management playbooks and the importance of considering identity context, reachability, and path contin…
Microsoft has launched MAI-Cyber-1-Flash, a new cybersecurity-specific AI model integrated into its MDASH vulnerability management system, achieving a 95.95% score on CyberGym at 50% less cost.
Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers
CISA, NSA, and international partners have developed joint guidance on establishing a coordinated vulnerability disclosure program for software manufacturers and online service providers to work with external security researchers.
The gap between a flaw becoming public and a working attack has closed due to sheer volume and speed. AI has erased the cushion, and defenses haven't moved fast enough. Defenders can't patch their way out of a backlog that's growing by the minute. A new CVE lands every 7.…
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The vulnerability, CVE-2008-4128, is a Cisco IOS Cross-Site Request Forgery Vulnerability.
The GitHub Advisory Database published 1,560 reviewed advisories in May 2026, a record high. The surge in vulnerability reports has caused delays in publication times.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog. The vulnerability, CVE-2026-48558, is a SimpleHelp Authentication Bypass Vulnerability.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog. The vulnerabilities are CVE-2026-12569 and CVE-2026-20230.
The emergence of AI-powered agentic models is changing the cybersecurity landscape, enabling faster and more anonymous attacks. Organizations must adapt to this new threat landscape.
Vulnerability management is facing a new challenge with AI reducing the time to exploit from months to hours. Patching is no longer a viable solution due to the slow remediation process.
A recent analysis of 3,000 attack surfaces found that 60% of organizations had at least one HTTP panel exposed. The top 10 most common exposures include MySQL and Postgres databases, API documentation, and WordPress admin panels.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog. The vulnerability, CVE-2026-48907, is an improper access control vulnerability in the Widget Factory Joomla Content Editor.
CISA added Oracle WebLogic CVE-2024-21182 to its KEV catalog after evidence of active exploitation. Federal civilian agencies must patch it by June 4, 2026.
Microsoft says it fixed KB5089549 install failures tied to low EFI System Partition space. The patch is in KB5089573 and later updates.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added a Palo Alto Networks PAN-OS authentication bypass flaw to its KEV Catalog after finding active exploitation.