Curated security research, vulnerabilities, advisories and tools for practitioners.

Top security intelligence

High-signal security research, vulnerabilities, advisories and tools ranked by relevance.

1.

James Kettle’s ‘autonomous research cascade’, CRLF-powered desync attacks, RCE on humanoid robots – ethical hacker news roundup

vulnerability | 2026-09-15 12:39 | yeswehack.com | original ↗ | #ai-security | #rce | #http-desync

2.

[CVE-2026-90894] ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell

vulnerability | 2026-09-15 13:16 | CVE-2026-90894 | jfrog.com | original ↗ | #privilege-escalation | #lpe | #macos

3.

Overview of Passive Optical Networks (PONs) Security

blog | 2026-09-15 22:00 | blog.quarkslab.com | original ↗ | #network-security | #cryptography | #encryption

4.

1Password's AI patching benchmark is misleading

blog | 2026-09-15 11:00 | blog.trailofbits.com | original ↗ | #ai-security | #vulnerability-management | #open-source

5.

XBOW Integration for Jira is now Available

blog | 2026-09-15 14:25 | xbow.com | original ↗ | #cloud | #vulnerability-management | #jira

6.

Neo v1 is now available for everyone

tool | 2026-09-16 00:19 | projectdiscovery.io | original ↗ | #bug-bounty | #cloud | #continuous-testing

7.

When to use SAST versus an LLM security scanner

blog | 2026-09-16 00:00 | about.gitlab.com | original ↗ | #ai-security | #appsec | #devsecops

8.

Droid ASC: High-Performance On-Demand Android Decompiler Front-End for Mobile Security & AI Agents

tool | 2026-09-15 18:43 | github.com | original ↗ | #ai-security | #open-source | #android

9.

CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key

vulnerability | 2026-09-11 00:00 | CVE-2026-82329 | bishopfox.com | original ↗ | #authentication-bypass | #jfrog | #bishop-fox

10.

JFrog Artifactory Supports LuaRocks Hosting for NGINX, OpenResty and Kong

blog | 2026-09-16 13:15 | jfrog.com | original ↗ | #jfrog | #package-management | #nginx

11.

SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia

blog | 2026-09-16 00:00 | hunt.io | original ↗ | #threat-intelligence | #apt | #c2

12.

CrowdStrike Accelerates Real-Time Data Classification with On-Device AI

blog | 2026-09-16 00:00 | crowdstrike.com | original ↗ | #ai-security | #cloud | #data-security

13.

Tenzai Integrates with Palo Alto Networks to Help Enterprises Validate Which Exposures Are Truly Exploitable

blog | 2026-09-16 00:00 | tenzai.com | original ↗ | #attack-surface | #exposure-management | #integration

14.

[CVE-2024-21762] Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence

research | 2026-09-14 00:00 | CVE-2024-21762 | hunt.io | original ↗ | #threat-intelligence | #ioc | #ssl-vpn

15.

Investing Together: Wiz Defend and Google Security Operations

blog | 2026-09-15 12:49 | wiz.io | original ↗ | #ai-security | #cloud | #cloud-security

16.

‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting

blog | 2026-09-14 07:16 | yeswehack.com | original ↗ | #bug-bounty | #community | #responsible-disclosure

17.

PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

blog | 2026-09-15 00:00 | crowdstrike.com | original ↗ | #ai-security | #bug-bounty | #supply-chain

18.

GitLab Dedicated: Compliance for a new regulatory era

blog | 2026-09-14 00:00 | about.gitlab.com | original ↗ | #cloud | #gitlab | #devsecops

19.

A Payment Platform for Security Researchers—No Bug Bounty Program Required

blog | 2026-09-14 14:14 | hackenproof.com | original ↗ | #bug-bounty | #vulnerability-disclosure | #payments

20.

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

vulnerability | 2026-09-10 19:04 | wiz.io | original ↗ | #jfrog | #artifactory | #wiz

21.

Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490

vulnerability | 2026-09-09 00:00 | CVE-2026-19490 | bishopfox.com | original ↗ | #authentication-bypass | #citrix | #netscaler

22.

AI Application Security Testing: The Authorisation Boundary

blog | 2026-09-14 15:50 | borghq.io | original ↗ | #ai-security | #appsec | #llm

23.

CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap

vulnerability | 2026-09-09 07:11 | CVE-2023-54391 | yeswehack.com | original ↗ | #ai-security | #exploit | #vulnerability-disclosure

24.

[CVE-2026-15409] UK Council Attack Linked to SonicWall SMA 1000 Campaign

vulnerability | 2026-09-10 00:00 | CVE-2026-15409 | hunt.io | original ↗ | #incident-response | #threat-intelligence | #active-directory

25.

ShieldCrash: Windows Defender 0-Day PoC Bypassing ShieldBreak (CVE-2026-69414) Patch

vulnerability | High | 2026-09-07 20:36 | CVE-2026-69414 | github.com | original ↗ | #cloud | #zero-day | #arbitrary-file-read

26.

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

vulnerability | 2026-09-09 16:06 | wiz.io | original ↗ | #cloud | #rce | #cloud-security

27.

Google Bug Hunters

blog | 2026-09-11 00:00 | bughunters.google.com | original ↗ | #bug-bounty | #vulnerability-research | #access-control

28.

Google ARTEMIS: Natural-Language Driven Android Automation & Mobile AI Agent Framework

tool | 2026-09-12 03:00 | github.com | original ↗ | #ai-security | #automation | #mcp

29.

A Guide to AWS S3 Buckets Security

blog | 2026-09-11 00:00 | bishopfox.com | original ↗ | #cloud | #cloud-security | #aws

30.

CVE-2026-32475: Elementor Pro Forms Unauthenticated Arbitrary File Upload to RCE Lab & PoC

vulnerability | Critical | 2026-09-05 06:23 | CVE-2026-32475 | github.com | original ↗ | #bug-bounty | #rce | #wordpress