Threats & Vulnerabilities

Government symposium highlights gap between modernization and security

At the Red Hat Government Symposium, experts examined how, in the face of swift transformation and growing cybersecurity risks, agencies can balance innovation and security.

By Richard Livingston • Nov. 2, 2026

Why Black October signals a new era of cyber-risk

Experts unpack Black October 2026, a wave of cybersecurity incidents that show how AI accelerates exploitation of old vulnerabilities. Read their insights to get ahead of the next storm.

By Sharon Shea • Oct. 30, 2026

Anthropic’s open source vuln scans shift bottleneck to maintainers

Anthropic's free OSS Scanner finds open source vulnerabilities. Experts say the big problem — especially for small projects — is validating and fixing them.

By Alissa Irei • Oct. 30, 2026

Secure code: LLMs improve, but orgs can’t rely on AI for AppSec

LLMs are getting better at catching easy coding bugs like XSS — but harder, contextual flaws like log injection remain largely unsolved.

By James Walker • Oct. 29, 2026

AI-driven vibe hacking is lowering the bar for attackers

New AI tools give casual cybercriminals the same skills that veteran hackers needed years to hone. Learn how to counter AI-driven vibe hacking.

By Jaikumar Vijayan • Oct. 28, 2026

Wave of PHP2Shell-style flaws coming, Nvidia security exec predicts

Brace yourselves, CISOs. On the heels of the PHP2Shell disclosure, Nvidia's head of cybersecurity policy predicts things will get better – but first, we're in for a bumpy ride.

By Alissa Irei • Oct. 28, 2026

Federal AI security guidance misses real-world enterprise threats

Federal AI incident response guidance leaves enterprise security teams to bridge critical gaps around rogue agents and prompt injection.

By Nathan Eddy • Oct. 27, 2026

PHP2Shell explained: Timeline of the global vulnerability crisis

Two critical PHP RCE flaws, dubbed PHP2Shell, triggered mass patching worldwide. Here's the timeline, the technical details and what CISOs should do.

By Sean Kerner • Oct. 27, 2026

Some businesses are pulling back from AI. CISOs can’t afford to

Some businesses are pulling back from AI amid low ROI, but CISOs can’t afford to lose it. Here’s how to protect AI in security operations.

By Richard Livingston • Oct. 27, 2026

Welcome to TechTarget Cybersecurity

Our expanded reporting, deeper analysis and sharper enterprise security coverage will help CISOs cut through the noise, assess emerging risks and make informed decisions that strengthen their security posture and business resilience.

By Sharon Shea , James Walker • Oct. 27, 2026

PHP2Shell disclosure unravels after leaks forced early patch drop

Although website shutdowns were inevitable to patch critical PHP flaws, early leaks and a broken embargo turned routine maintenance into an emergency scramble.

By James Walker • Oct. 22, 2026

PHP2Shell: 22M exposed servers at risk as emergency patches released

AI gave defenders a head start, but PHP2Shell has sparked a chaotic race against automated exploits across 22 million vulnerable servers.

By James Walker • Oct. 21, 2026

Off the rails: Railway cyberattacks highlight infrastructure risks

Cyberattacks on Japanese rail operators Keio and Tokyo Metro reveal how corporate IT breaches expose passenger data and threaten operational technology systems.

By Richard Livingston • Oct. 19, 2026

CISA to AI labs: Share test-network IPs to flag rogue agents

CISA wants AI testing labs to provide a mechanism for mainstream cyber defenders to spot and flag rogue agents before they cause real damage. Experts' reactions were mixed.

By Alissa Irei • Oct. 15, 2026

Historic Curl flaw shows AI risk to legacy supply chain

An AI audit of Curl unearthed a 25-year-old authentication flaw in code powering 20 billion devices, proving heavily scrutinized legacy libraries still harbor hidden risks.

By Craig Galbraith • Oct. 14, 2026

AI-discovered flaws are rarely exploited but pose greater risk

Relatively few AI-discovered flaws are exploited, but new research shows the ones that are can pose outsized risk to enterprises.

By Alissa Irei • Oct. 13, 2026

Pentagon breach exposes failure to follow its own standards

The Pentagon's DMDC breach exposed millions of records due to failures in basic security controls despite clear DoD cybersecurity standards.

By Richard Livingston • Oct. 8, 2026

Developers facing a patchwork of competing AI safety regulations

Policymakers are moving swiftly to regulate agentic AI, creating varying mandates across regions and leaving developers to figure out compliance. Experts explain how the industry can keep pace.

By Richard Livingston • Oct. 2, 2026

Nvidia Sentry’s millisecond claim raises AI agent detection questions

Nvidia's Sentry design promises millisecond AI agent containment, but security experts warn speed offers little protection when valid credentials or detection delays are involved.

By Nathan Eddy • Oct. 1, 2026

August’s ransomware activity hit new high for the year

NCC Group identified 83 ransomware groups active last month, but it said AI wasn't necessarily what drove the increase in the number of bad actors.

By Nathan Eddy • Sept. 30, 2026

Can ‘agent canaries’ catch rogue AI before it escapes?

AI agent canaries could become valuable security tripwires if enterprises treat them as sensors rather than safeguards.

By Nathan Eddy • Sept. 22, 2026

What the AI safety fallout means for enterprise CISOs  

High-profile resignations and calls for a development slowdown have accelerated the AI safety debate. Here's how security leaders are filtering noise from immediate operational risk.

By Richard Livingston • Sept. 21, 2026

Revolut breach exposes authentication-authorization gap

The Revolut data breach showed what can happen when organizations over-trust and under-verify. Experts warn that countless companies are currently at risk.

By Alissa Irei • Sept. 17, 2026

CISA Cyber Storm exercise offers blueprint for enterprise CISOs

The launch of CISA's Cyber Storm X puts national incident response to the test. For enterprise CISOs, the exercise serves as a practical model for evaluating supply-chain resilience and incident response playbooks under fire.

By Richard Livingston • Sept. 11, 2026

How CISOs can defend against ClickFix attacks

ClickFix attacks have become a top malware delivery method, exploiting unwitting users' trust and weaponizing their access. Stopping them requires a defense-in-depth approach.

By Matthew Smith • Aug. 27, 2026