CVE-2026-119977 lets an unauthenticated attacker race a WordPress full-package core update. CISA added it to KEV on November 3. Here is what is confirmed, what is disputed, and what GRC teams should do.
Read more →Binance says a compromised DevOps laptop started the largest crypto theft on record. Here is what is confirmed, what is not, and how to test whether one endpoint in your environment can move money or data.
Read more →GMO Internet confirmed data theft, unauthorized customer trades and an extortion demand at its Onamae.com Desktop Cloud, and will not restore the platform. Here is what is confirmed, what is not, and what GRC leaders should check about credentials stored on vendor infrastructure.
Read more →Arista says a critical SQL injection flaw in VeloCloud Orchestrator, CVE-2026-114625, is already being exploited. It is reportedly the third exploited VCO flaw since July. Here is what is confirmed, what is unclear, and what GRC leaders should do about their SD-WAN control plane. Also covers HTTP2Shell (CVE-2026-111497), the Brotli decoder flaw that hit Node.js, Python and other stacks.
Read more →A broken certificate authority, an exploited remote support appliance, a poisoned AI gateway, a PHP flaw and a ransomware advisory in five days. What is confirmed, what it means for GRC, and how to prepare for larger disruptions.
Read more →A malicious LiteLLM 1.107.0 reached PyPI and Docker on October 21 and went after cloud, developer and AI provider credentials. Here is what is confirmed, what is not, and what a GRC program should do about pinning, rotation and vendor release controls.
Read more →Two critical remote code execution flaws in PHP itself, patched in an emergency release on October 21. Updating your CMS does nothing. Here is what is confirmed, what is disputed, and what a GRC program should do this week.
Read more →Every weakness in this incident was ordinary. That is the point. An autonomous AI agent ran an end-to-end intrusion against Hugging Face's production infrastructure, and nearly every control that failed is one you already have a policy for.
Read more →A TheGRCGuy recap of Black Hat USA and DEF CON 34: agentic AI is now a governance problem, the harness wars, ChainDrop, and the identity story underneath it all.
Read more →Release, jailbreak report, export controls, remediation, restoration, all in under a month. One of the most instructive case studies yet in how AI governance works, and doesn't, when the stakes get real.
Read more →For the first time, an AI vendor has publicly released a model while admitting its unrestricted version is too powerful for general availability. What the Fable and Mythos split means for cybersecurity leaders.
Read more →Vulnerability exploitation is now the leading initial access vector, and AI systems are becoming endpoints that most security programs do not monitor.
Read more →
