SparTech Software

CISA added critical Ray RCE flaw CVE-2025-62593 to its KEV catalog and ordered US agencies to update Ray to 2.52.0 within three days under BOD 26-04.

Rapid7 warns AI-accelerated vulnerability discovery and exploit development are overwhelming patch cycles, pushing defenders to focus on exposure, not CVSS.

Varonis researchers detail a Copilot Personal flaw dubbed CoSnitch, where the AI is socially engineered into exposing a hidden autorun path for one-click data theft.

New TwinLoot Python malware routes command-and-control through Microsoft 365 services like SharePoint and Teams, stealing credentials while evading detection.

A new Ransom Busters scam sees ransomware affiliates posing as recovery specialists to hijack negotiations and extort victims a second time.

Researchers show self-propagating mind virus payloads can jump between autonomous AI agents through persistent prompt files, expanding risks for memory-enabled LLM systems.

A critical arbitrary file upload flaw in the Forminator Forms plugin, tracked as CVE-2026-15748, exposes over 600,000 WordPress sites to potential takeover.

Researchers warn Ruby developers after 16 typosquatted RubyGems packages were caught dropping StubMaker, a Windows info-stealer for browser and crypto data.

Heights Finance is notifying 700,000 people after hackers accessed a third-party cloud platform holding loan data, SSNs and bank details in May 2026.

Apple ships new macOS, iOS and iPadOS updates that patch dozens of WebKit vulnerabilities and a Telephony bug that could impact VPN security on Apple devices.