Vulnerabilities | CSO Online

Notepad++ author says fixes make update mechanism ‘effectively unexploitable’

Hardening had to be done after a threat actor compromised updates with a custom backdoor.

By Howard Solomon

Feb 18, 20265 mins

CybercrimeDevopsSoftware Deployment

Chinese hackers exploited zero-day Dell RecoverPoint flaw for 1.5 years

By Lucian Constantin

Feb 18, 20264 mins

SecurityVulnerabilitiesZero-Day Vulnerabilities

Flaws in four popular VS Code extensions left 128 million installs open to attack

By Gyana Swain

Feb 18, 20264 mins

SecurityVulnerabilities

February 2026 Patch Tuesday: Six new and actively exploited Microsoft vulnerabilities addressed

By Howard Solomon

Feb 10, 20268 mins

SecurityVulnerabilities

Articles

BeyondTrust fixes critical RCE flaw in remote access tools

Enterprises are urged to patch self-hosted versions of both Remote Support and Privileged Remote Access due to a 9.9-severity vulnerability that could lead to system compromise.

By Lucian Constantin

Feb 10, 2026 3 mins

Network SecurityRemote Access SecurityVulnerabilities

SolarWinds WHD zero-days from January are under attack

Analysis of real-world incidents reveals that attackers are chaining multiple flaws to compromise the ticketing and support application.

By John E. Dunn

Feb 10, 2026 4 mins

IT ManagementVulnerabilitiesZero-Day Vulnerabilities

Anthropic’s DXT poses “critical RCE vulnerability” by running with full system privileges

Anthropic didn’t dispute the security report, but suggested it would only be caused by user error, where users deliberately installed the tools and granted the appropriate permissions.

By Evan Schuman

Feb 9, 2026 8 mins

Artificial IntelligenceSecurityVulnerabilities

Six more vulnerabilities found in n8n automation platform

Four of the holes, which allow remote code execution and command injection, are rated as critical.

By Howard Solomon

Feb 6, 2026 5 mins

Development ToolsSecurityVulnerabilities

4 big mistakes you're probably still making in vulnerability management…and how to fix them

Vulnerability management isn’t about checking boxes anymore—it’s about real-time visibility, risk prioritization, and automation that keeps you one step ahead of threats.

By Action 1

Apr 28, 2025 4 mins

Endpoint ProtectionRisk ManagementVulnerabilities

Claude AI finds 500 high-severity software vulnerabilities

Anthropic is reporting the flaws to developers — but only after having humans verify them.

By Maxwell Cooter

Feb 6, 2026 2 mins

Generative AIVulnerabilitiesZero-Day Vulnerabilities

Four new vulnerabilities found in Ingress NGINX

Two carry CVSS scores of 8.8, demanding that admins upgrade to the latest versions of the controller.

By Howard Solomon

Feb 5, 2026 4 mins

Network SecuritySecurityVulnerabilities

Attackers exploit decade‑old Windows driver flaw to shut down modern EDR defenses

Attackers abused a signed but long-revoked EnCase Windows kernel driver in a BYOVD attack to terminate all security tools.

By Shweta Sharma

Feb 5, 2026 4 mins

Endpoint ProtectionVulnerabilitiesWindows Security

Microsoft develops a new scanner to detect hidden backdoors in LLMs

Microsoft’s research shows how poisoned language models can hide malicious triggers, creating new integrity risks for enterprises using third-party AI systems.

By Prasanth Aby Thomas

Feb 5, 2026 4 mins

Artificial IntelligenceSecurityVulnerabilities

Software supply chain risks join the OWASP top 10 list, access control still on top

There were some changes to the recently updated OWASP Top 10 list, including the addition of supply chain risks. But old standbys, like broken access control, are still at the top.

By Maria Korolov

Feb 5, 2026 8 mins

SecuritySoftware DevelopmentVulnerabilities

Threat actors hijack web traffic after exploiting React2Shell vulnerability

Researchers at Datadog Security say the hackers are pivoting to hit NGINX web servers.

By Howard Solomon

Feb 4, 2026 4 mins

CyberattacksCybercrimeVulnerabilities

Russian hackers exploited a critical Office bug within days of disclosure

Within days of Microsoft patching a critical Office zero-day, the Russia-linked group “APT28” was already exploiting the flaw in a live campaign tracked as Operation Neusploit.

By Shweta Sharma

Feb 4, 2026 4 mins

MalwareSecurityVulnerabilities

Ivanti patches two actively exploited critical vulnerabilities in EPMM

The code injection flaws allow for unauthenticated remote code execution on Ivanti Endpoint Manager Mobile deployments, but also endanger connected Ivanti Sentry mobile traffic gateways.

By Lucian Constantin

Jan 30, 2026 4 mins

Network SecuritySecurityVulnerabilities