Know what changed. Know what matters.

Nvidia introduced a safety platform with hardware watchdogs on its Grace Hopper chips to monitor generative agents and shut them down when anomalous behavior was detected.[securityweek.com]

A flaw in the official MCP Python SDK can redirect credential exchanges to attacker‑controlled endpoints, exposing client secrets and authorization codes.

A previously known zero‑day flaw in Oracle’s PeopleSoft software has resurged and is actively exploited against legacy systems.

Attackers used compromised service principals to delete Azure resources for ~18 hours.

A new Lunex variant hijacks an AMD kernel driver to elevate privileges, disable security monitoring, and harvest browser passwords via fake CAPTCHAs on Ukrainian sites.

Two unpatched Citrix NetScaler RCE bugs are currently being used in the wild.

FTC and congressional reports reveal data‑broker breaches costing U.S. consumers over $20 billion.

CISA lists new Microsoft SharePoint and MikroTik RouterOS vulnerabilities as actively exploited worldwide.

Two previously disabled GitHub actions were reactivated last week and now execute Mini Shai‑Hulud malware, affecting many open‑source projects.

A pre‑authentication SQL injection in Roundcube Webmail’s virtuser_query plugin has enabled attackers to read and modify database content across affected installations.

A researcher showed a malicious app could grant full root control on OnePlus 15 phones without requesting special permissions.

The Corp MDM Android spyware targets logistics firms with fake Google Play listings that appear legitimate.