Blog

A vulnerability in the official MCP Python SDK lets a malicious server steal OAuth credentials. Fixed in versions 1.30.0 and 2.2.0.

Security firm Gambit says an attacker chained Strix, Cairn, and Hermes AI agents to skim 600,000 cards from at least 27 companies for roughly $25 a target.

DIVD says a fully autonomous AI agent carried out a post-exploitation intrusion on its network, the first publicly described agentic AI-driven attack of its

Apple rolls out iOS 26.7.1, iPadOS 26.7.1, and macOS updates to fix a CoreGraphics out-of-bounds write flaw that may have been used in targeted attacks.

CISA adds two critical Citrix NetScaler vulnerabilities (CVSS 9.5) to its KEV catalog after confirming global active exploitation. Patching guidance inside.

A roundup of notable open-source cybersecurity releases from September 2026, covering secrets scanning, AI agent controls, and authorization services.

A now-patched flaw in the TDengine time-series database lets unauthenticated attackers crash servers with a single packet. Industrial and IoT environments are

Persistent AI coworkers need their own identities, not borrowed human credentials. Here is what changes in the access model and what to do before the third wave

Anthropic's Claude Sonnet 5.5 responds over 30% faster and costs less per task while keeping the same listed API price.