If your developers are using AI coding tools, you are probably already seeing the upside: faster development, more code, and less time spent on routine work. The harder part is what comes after. AI can also introduce open-source packages at a pace your security team was never built to handle. More dependencies mean more vulnerabilities to review, more remediation work, and a backlog that can
Read full article at The Hacker News ↗More than 200 vulnerabilities have been patched to date this year, compared to only 16 in 2025 and 22 in 2024. The post 91 Vulnerabilities Patched in Spring Application Framework appeared first on SecurityWeek.
Red Hat and the Keycloak project have patched a critical authentication flaw (CVE-2026-18963, CVSS 9.1) that allows unauthenticated remote attackers to take over any user account by exploiting the password reset functionality. This vulnerability in the open-source identity and access management server poses a severe risk to organizations relying on Keycloak for account management and should be prioritized for immediate patching.
Adversa AI researchers disclosed a technique called Cryptographic Context Injection that bypasses AI safety filters by encrypting malicious instructions in AES-256-GCM, which the targeted models decrypt and execute without triggering guardrails. Demonstrated attacks against xAI's Grok and Google's Gemini included a zero-click exploit exfiltrating Grok users' full chat histories and prompting Gemini to generate dangerous instructions and reproduce its own system prompts. The vulnerability exposes a fundamental structural weakness in content-based guardrails, which cannot inspect payloads that only become readable after the model has already decided to trust them, with limited vendor engagement and no coordinated disclosure path at Google due to their AI reward program exclusions.
A defense every attacker can rehearse against isn't a defense. It's a false sense of security.