CVE-2026-32194: Bing Images Command Injection via SVG Upload
A critical command injection vulnerability in Bing's image processing pipeline allows unauthenticated attackers to execute arbitrary commands as SYSTEM on Microsoft's servers…
Tag: Microsoft
CVE-2026-32191: Bing Images OS Command Injection via SVG URL
A critical OS command injection vulnerability in Bing's image processing pipeline allows unauthenticated attackers to execute arbitrary commands as SYSTEM by hosting…
ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Cybersecurity researchers at Zenity Labs have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents, codenamed AgentForger, that could allow a single…
Police Dismantle Kratos Phishing Kit Targeting Microsoft 365 Sessions and Bypassing MFA
German and US law enforcement, in coordination with Indonesian authorities, have dismantled the infrastructure behind Kratos, a sophisticated phishing kit designed to…
Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
A critical vulnerability in Microsoft's official Azure DevOps MCP server allows attackers to inject hidden HTML comments into pull request descriptions, which…
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A critical remote code execution vulnerability in Microsoft SharePoint Server, CVE-2026-50522 (CVSS 9.8), is being actively exploited in the wild following the…
Bit2Watt Attack: Cloud Tenants Could Destabilize Power Grids Using Legitimate GPU Workloads
A new attack technique called Bit2Watt, detailed by researchers from Zhejiang University in a paper accepted to CHES 2026, demonstrates how a…
Open-Source Android AI Agents Vulnerable to Invisible Screen Text Attacks Leading to Host Code Execution
Researchers have demonstrated that open-source Android AI agent frameworks are vulnerable to a novel attack chain where invisible screen text can lead…
Semantic Kernel: Microsoft AI Agent Framework
Microsoft's AI agent framework that had similar command injection vulnerabilities (CVE-2026-25592, CVE-2026-26030) patched in May 2026.
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server exposed, allowing Rapid7 to recover a full toolkit of 1,048 files including lure templates, filename-spoofing…