Explore

FactFable FactFable
What an Application Security Engineer Actually Looks Like in a Real Incident

What an Application Security Engineer Actually Looks Like in a Real Incident

Forget the hacker movie stereotypes. Here’s a look at what an application security engineer actually does when a critical incident strikes.
Rapid Read Rapid Read
Arista Networks Patches Critical VeloCloud Orchestrator Vulnerability Exploited as Zero-Day

Arista Networks Patches Critical VeloCloud Orchestrator Vulnerability Exploited as Zero-Day

Arista Networks has released patches for a critical OS injection vulnerability in its VeloCloud Orchestrator (VCO) platform, identified as CVE-2026-16812. This vulnerability, which has a maximum CVSS score of 10, allows remote exploitation to access privileged functionalities intended for internal use. The flaw affects only the VeloCloud Orchestrator On-Prem and has been actively exploited in the wild as a zero-day. Arista has addressed the issue in VCO versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch it within three days.
Rapid Read Rapid Read
Arista Networks Addresses Critical VeloCloud Orchestrator Vulnerability Exploited as Zero-Day

Arista Networks Addresses Critical VeloCloud Orchestrator Vulnerability Exploited as Zero-Day

Arista Networks has released patches for a critical OS injection vulnerability in its VeloCloud Orchestrator (VCO) platform, which has been exploited as a zero-day. The vulnerability, identified as CVE-2026-16812, carries a maximum CVSS score of 10 and allows remote exploitation to access privileged functionalities intended for internal use. The flaw affects only the VeloCloud Orchestrator On-Prem and has been addressed in several updated versions. Arista Networks warns that the vulnerability is actively exploited and does not require special configuration or authentication for successful exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch it within three days.
Rapid Read Rapid Read
CISA Alerts on Fortinet FortiOS Vulnerability Amid Active Exploitation

CISA Alerts on Fortinet FortiOS Vulnerability Amid Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has added the Fortinet FortiOS vulnerability CVE-2025-68686 to its Known Exploited Vulnerabilities catalog, following evidence of active attacks. This vulnerability affects Fortinet's FortiOS, used in FortiGate firewalls, and is classified as an exposure of sensitive information to unauthorized actors. The flaw allows remote attackers to bypass security patches via crafted HTTP requests, provided they have already compromised the system through another vulnerability. CISA has mandated that Federal Civilian Executive Branch agencies apply necessary mitigations by August 10, 2026, and has advised organizations to follow Fortinet's guidance to address the issue.
Trendline Trendline
Infoblox Enters EASM Market with DNS-Centric Security Approach

Infoblox Enters EASM Market with DNS-Centric Security Approach

Infoblox Enters EASM Market with DNS-Centric Security Approach
Rapid Read Rapid Read
Codex Security CLI Enhances Vulnerability Management for Developers

Codex Security CLI Enhances Vulnerability Management for Developers

Codex Security has introduced a command-line interface (CLI) tool designed to help developers identify and address vulnerabilities in their code. The CLI allows for local scans of repositories, providing detailed reports on findings and coverage. It supports integration with GitHub and other platforms, enabling developers to manage security assessments efficiently. The tool requires Node.js and Python for operation and offers features like device authentication and API key usage for secure access. Codex Security's CLI is currently in beta, with a focus on improving security workflows for engineering teams.
Rapid Read Rapid Read
Arista Patches Critical VeloCloud Bug Amid Active Exploitation Concerns

Arista Patches Critical VeloCloud Bug Amid Active Exploitation Concerns

Arista has released a patch for a critical vulnerability in its VeloCloud Orchestrator, which is currently being exploited by attackers. The flaw, identified as CVE-2026-16812, is an OS command injection vulnerability that allows unauthenticated remote attackers to access privileged internal functions. This vulnerability affects the on-premises version of VeloCloud Orchestrator, used to manage software-defined wide area networks (SD-WANs). Arista has advised users to restrict access to the web interface and apply the patch immediately. The Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities catalog, highlighting its severity and the need for urgent action.
Trendline Trendline
VMware Patches Critical Vulnerabilities in ESXi and vCenter Products

VMware Patches Critical Vulnerabilities in ESXi and vCenter Products

VMware Patches Critical Vulnerabilities in ESXi and vCenter Products
Trendline Trendline
AI-Driven Risk-Based Patching Revolutionizes Federal Cybersecurity

AI-Driven Risk-Based Patching Revolutionizes Federal Cybersecurity

AI-Driven Risk-Based Patching Revolutionizes Federal Cybersecurity
Trendline Trendline
Tal Kollander Transitions from Black Hat Hacker to Cybersecurity Defender

Tal Kollander Transitions from Black Hat Hacker to Cybersecurity Defender

Tal Kollander Transitions from Black Hat Hacker to Cybersecurity Defender
FactFable FactFable
Why Most Teams Misread Endpoint Protection for a Accounting Firm

Why Most Teams Misread Endpoint Protection for a Accounting Firm

Accounting firms often misunderstand endpoint protection, leaving sensitive client data vulnerable. Discover the common security blind spots and why a modern approach is crucial.
Variety Variety
Massive Tribeca Fest Data Leak Exposes Jennifer Lawrence, Robert De Niro and More Celebs’ Contact Info; Meet the Man Who Discovered the Files

Massive Tribeca Fest Data Leak Exposes Jennifer Lawrence, Robert De Niro and More Celebs’ Contact Info; Meet the Man Who Discovered the Files

The Tribeca Festival suffered a data leak that exposed hundreds of thousands of records, as well as the contact information for thousands of celebrities, including Martin Scorsese, Francis Ford Coppola, Jennifer Lawrence, Angelina Jolie and festival co-founder Robert De Niro. Cybersecurity researcher Jeremiah Fowler revealed the leak in an ExpressVPN blog post over the weekend, […]