latesthackingnews.com

CSRF Attack Explained: Mechanics, Real Exploits, and How to Test for It

A practitioner's breakdown of the CSRF attack: how the forged request works, two documented exploits, a manual test, and the ...
GitHub

Zero-config runtime observability for LangGraph agents, with opt-in interventions for teams that need to block, redact, or rate-limit.

A checked-in synthetic CVE-2026-34070 canary lives at demo/malicious-prompt/. From a clean Python 3.10+ environment: Memory poisoning Yes (new in v0.3) Auto-patched BaseStore.put/aput. Same opt-out ...
VentureBeat

Microsoft patched a Copilot Studio prompt injection. The data exfiltrated anyway

Microsoft assigned CVE-2026-21520, a CVSS 7.5 indirect prompt injection vulnerability, to Copilot Studio. Capsule Security discovered the flaw, coordinated disclosure with Microsoft, and the patch was ...
Hosted on MSN

LangChain framework hit by several worrying security issues — here's what we know

LangChain and LangGraph patch three high-severity flaws exposing files, secrets, and conversation histories Vulnerabilities included path traversal, deserialization leaks, and SQL injection in SQLite ...
GitHub

bobmatnyc/claude-mpm-skills

This repository contains a comprehensive collection of 171 Claude Code skills designed for the Claude Multi-Agent Project Manager (MPM) ecosystem. Skills cover modern development workflows with 95%+ ...
Bleeping Computer

Hackers targeting WhatsUp Gold with public exploit since August

Hackers have been leveraging publicly available exploit code for two critical vulnerabilities in the WhatsUp Gold network availability and performance monitoring solution from Progress Software. The ...
Bleeping Computer

QNAP warns of critical auth bypass flaw in its NAS devices

QNAP warns of vulnerabilities in its NAS software products, including QTS, QuTS hero, QuTScloud, and myQNAPcloud, that could allow attackers to access devices. The Taiwanese Network Attached Storage ...