Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

May 16, 2026, 2:31 AM EDT · AI Security · AI Gateway Security6 minLiteLLM CVE-2026-42208: Critical Pre-Auth SQL Injection Exposes AI Gateway Secrets

Critical LiteLLM CVE-2026-42208 pre-auth SQL injection exposes AI gateway databases, virtual keys and upstream model-provider credentials.

May 15, 2026, 6:09 PM EDT · AI Security · AI Cloud8 minOllama Cloud Slowdown Frustrates Users as Low Token Rates Raise Questions About Hosted Open-Model Economics

User-reported token rates as low as 8 tokens per second show why Ollama Cloud needs clearer performance metrics, queue visibility and paid-tier expectations.

May 15, 2026, 3:29 PM EDT · Exploits · Edge Appliances5 minFortinet Patches Critical FortiVoice Zero-Day Exploited for Credential Theft and Network Scanning

Fortinet patched CVE-2025-32756, a critical unauthenticated RCE flaw exploited against FortiVoice systems for credential theft, FastCGI debugging and network scanning.

May 15, 2026, 3:00 PM EDT · Exploits · CPU Security5 minIntel Branch Privilege Injection Flaw Undermines Six Years of Spectre v2 Hardware Defenses

Intel issued microcode mitigations for CVE-2024-45332, a Branch Privilege Injection flaw that can bypass Spectre v2 hardware defenses and leak privileged memory from affected systems.

May 15, 2026, 1:34 PM EDT · Exploits · Enterprise Apps5 minSAP Patches Second Critical NetWeaver Flaw After Researchers Link It to Chained Zero-Day Attacks

SAP patched CVE-2025-42999, a critical NetWeaver Visual Composer deserialization flaw linked to chained attacks that followed exploitation of CVE-2025-31324.

May 15, 2026, 11:52 AM EDT · Supply Chain · Supply Chain5 minMini Shai-Hulud Worm Exposes Limits of Trusted Publishing After 170+ npm and PyPI Packages Hit

The Mini Shai-Hulud campaign compromised more than 170 reported npm and PyPI packages, exposing how trusted publishing and provenance can still be abused when CI/CD environments are compromised.

May 15, 2026, 11:37 AM EDT · Exploits · Web Server Security4 minNGINX “Rift” Rewrite Module Flaw Confirmed as CVE-2026-42945

CVE-2026-42945 is now tracked as a heap-based buffer overflow in NGINX's rewrite module, affecting NGINX Open Source and NGINX Plus under specific rewrite-rule conditions.

May 15, 2026, 11:09 AM EDT · Exploits · Microsoft Exchange4 minMicrosoft Confirms Exploited Exchange OWA Vulnerability as CVE-2026-42897

Microsoft has disclosed CVE-2026-42897, a high-severity Exchange Server Outlook Web Access vulnerability affecting on-premises deployments, with mitigation available while a permanent fix is pending.