Juju hits a perfect 10.0 CVSS score (CVE-2026-4370). A TLS flaw on port 17666 lets attackers hijack clusters. Update to 3.6.20 or 4.0.5 now!

Critical 8.8 CVSS flaw in libinput allows sandbox escape via malicious Lua plugins. Affects GNOME, KDE, and Fedora. Update to 1.31.1 or 1.30.3 now!

Artifex MuPDF faces a 7.8 CVSS integer overflow (CVE-2026-3308) allowing RCE via "crafted" PDFs. With no official patch, sandboxing is vital. Update now.

A massive supply-chain attack hit the European Commission via a compromised Trivy update. 340GB of data was leaked by ShinyHunters. Rotate your AWS keys!

Cloudflare debuts EmDash, an AI-native, serverless CMS built on Astro 6.0. Say goodbye to WordPress plugin hacks with V8 isolate sandboxing and passkey security.

OpenSSH 10.3 fixes critical gaps, including client-side command execution and scp privilege escalation flaws. Update your remote access stacks immediately.

Google’s "Tap to Share" leaked for Android 17! Using NFC and UWB, this new Quick Share feature aims to end AirDrop's dominance. Discover how it works.

Splunk unmasks BlankGrabber: a modular Python info stealer using Discord and GitHub to swipe credentials and Discord tokens. Learn how to stay protected.

Google releases Gemma 4 under the Apache 2.0 license. Featuring multimodal edge models and a 31B "Dense" system, it redefines AI digital sovereignty for 2026.

ByteDance and OpenAI are racing to dominate "Lobster Husbandry." Discover how the OpenClaw agent is transforming WeChat, Xiaomi, and the global AI landscape.

Microsoft CEO Mustafa Suleyman unveils MAI-Transcribe-1, MAI-Voice-1, and MAI-Image-2—proprietary AI built to undercut competitors and secure self-sufficiency.

Apple officially ceases all payment services in Russia as of April 1, 2026. Subscriptions, App Store buys, and iCloud+ renewals are now indefinitely frozen.

Progress ShareFile hit by critical 9.8 CVSS RCE flaws (CVE-2026-2699). Unauthenticated attackers can hijack configuration and execute code. Update to v5.12.4!

Iran's IRGC claims a strike on Oracle's Dubai data center, targeting U.S. tech infrastructure. Dubai officials deny damage as regional tensions escalate.

The Axios npm hijack exposed millions to a RAT. Discover how North Korean-nexus actor UNC1069 used a masterful phishing ruse to bypass 2FA and steal credentials.

A massive fire at an AWS facility in Bahrain highlights a dangerous shift toward kinetic strikes on cloud infrastructure. Is your multi-region strategy ready?

TP-Link warns of high-severity flaws (CVSS 8.7) in Tapo C520WS cameras. Attackers can bypass auth or blind your security. Update to firmware 1.2.4 now!

If you squint and look at the CISA KEV list, you might think it's made up exclusively of vulnerabilities in file transfer solutions.

While this would be wrong (and you shouldn’t squint, it’s bad for your eyes), file transfer solutions do play a decent role…

Today, we woke up with a nagging feeling: what if Citrix had, in fact, patched multiple Memory Overread vulnerabilities as part of CVE-2026-3055?

While we've been using our analysis from Part 1 (please read it first, as this post will be brief) to accurately…

Sequels? Pain? We're obviously talking about Citrix NetScalers, yet again.

Welcome back to another watchTowr Labs blog post - pull up a chair, we always welcome new members to our group therapy sessions.

If you asked a C programmer what they most dislike…

This overview of the basics of Cloud Security includes some tips and resources for getting started in defending the cloud.