CVE-2026-55255: Langflow IDOR Lands on CISA's KEV List
What Happened On July 7, 2026, CISA added three vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog based on confirmed active exploitation. One of them is worth a closer look for anyone running internal AI tooling: CVE-2026-55255, an authorization bypass in Langflow, the open-source visual builder for LLM workflows. The other two entries in that same KEV batch, CVE-2026-48908 (JoomShaper SP Page Builder) and CVE-2026-56290 (Joomlack Page Builder), are CMS plugin file upload an
From Hotel Wi-Fi to ISP Tracking, A Practical VPN Security Guide with NordVPN
Disclosure: This article may contain affiliate links. If you purchase through these links, NULL PACKET may earn a commission at no additional cost to you. We only recommend tools relevant to the security workflows discussed here. Public Wi-Fi networks, ISP telemetry collection, DNS leaks, regional content restrictions, aggressive tracking ecosystems, these have transformed VPNs from niche privacy tools into practical security infrastructure. Most VPN marketing focuses on streaming but the real
SolarWinds Serv-U CVE-2026-28318: What you Need to Know
SolarWinds has released a critical hotfix addressing CVE-2026-28318 affecting its Serv-U Managed File Transfer platform, a product widely deployed across enterprise environments for secure file exchange, third-party integrations, and operational data workflows. For defenders, this vulnerability should immediately raise concern for one reason: Internet-facing managed file transfer systems are prime targets for ransomware operators and advanced threat actors. These platforms frequently: * store
The Hidden Security Risks of Online Advertising: How Malvertising Became a Modern Cybersecurity Threat
Disclosure: This article may contain affiliate links. If you purchase through these links, NULL PACKET may earn a commission at no additional cost to you. We only recommend tools relevant to the security workflows discussed here. For years, online advertising has been treated as a normal part of the internet experience. Pop-ups, autoplay videos, tracking cookies, and targeted banners have become so common that many users barely notice them anymore. What most people do not realize is that the
Why Modern SOCs Fail Against Advanced Persistent Threats
Most Security Operations Centers are drowning in telemetry while simultaneously starving for visibility. On paper, modern SOCs appear stronger than ever: * SIEM platforms ingest terabytes of logs daily * EDR agents monitor every endpoint * Cloud providers expose massive audit datasets * Threat intelligence feeds update in real time * SOAR platforms automate response workflows Yet major intrusions continue to evade detection for weeks or months. This is not a tooling problem alone. It is a
Weaponizing OAuth Misconfigurations: How Modern Attackers Abuse Trust to Bypass Traditional Security Controls
OAuth was designed to solve a legitimate problem: delegated access between applications without exposing passwords. In practice, however, OAuth has evolved into one of the most abused trust mechanisms in modern enterprise environments. Attackers increasingly target OAuth integrations because they offer something traditional malware often cannot: persistent access that looks legitimate. A compromised OAuth workflow does not necessarily require malware execution, credential dumping, or even MFA
Kerberos Abuse in Active Directory
Modern enterprise authentication depends heavily on Kerberos. Within Active Directory environments, Kerberos acts as the primary trust mechanism responsible for validating users, granting service access, and enabling secure communication across systems. From a defensive standpoint, Kerberos was designed to improve security over older authentication methods such as NTLM by reducing plaintext credential exposure and introducing ticket-based authentication. However, the protocol’s deep integration
Active Directory Security in Hybrid Enterprise Environments
Modern enterprise identity infrastructure has evolved far beyond the traditional Windows domain controller model. Today’s organizations operate in hybrid identity ecosystems where on-premises Active Directory integrates directly with cloud identity providers such as Microsoft Entra ID, SaaS applications, VPN platforms, endpoint management systems, and third-party federation services. This convergence has transformed Active Directory (AD) from a simple directory service into the operational core
Cybersecurity Best Practices for Individuals and Organizations
An Enterprise Security Operations & Infrastructure Hardening Playbook Modern cybersecurity is no longer centered around a single firewall, antivirus platform, or isolated security team. Enterprise environments now span hybrid infrastructure, multi-cloud deployments, SaaS ecosystems, remote workforces, APIs, mobile endpoints, third-party integrations, and highly distributed identity systems. At the same time, threat actors have evolved significantly. Modern attacks leverage ransomware-as-a-serv
Trend Micro Apex One CVE-2026-34926: CISA Adds Exploited Endpoint Management Vulnerability to KEV
What Happened CISA added CVE-2026-34926 to the Known Exploited Vulnerabilities (KEV) catalog on May 21, 2026 after evidence of active exploitation in the wild. The vulnerability affects Trend Micro Apex One (On-Premise) and can allow attackers to inject malicious code into agent deployments. According to CISA, the flaw is a directory traversal vulnerability that enables a pre-authenticated local attacker to modify a key server-side table and push malicious code to managed endpoints. Why It M
Langflow CVE-2025-34291: CISA Adds Critical AI Workflow RCE Chain to KEV
What Happened CISA added CVE-2025-34291 to its Known Exploited Vulnerabilities catalog on May 21, 2026, with a remediation due date of June 4, 2026. The flaw affects Langflow, an open-source AI agent and workflow platform. NVD describes it as a chained vulnerability in Langflow versions up to and including 1.6.9 that can lead to account takeover and remote code execution. Why It Matters Langflow often stores API keys, model credentials, SaaS tokens, database connectors, and workflow secrets.
Drupal Core SQL Injection Vulnerability Actively Exploited: What You Need to Know
A critical SQL injection vulnerability affecting Drupal has been added to the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities (KEV) catalog after evidence emerged that attackers are actively exploiting the flaw in the wild. Organizations running vulnerable Drupal installations should patch immediately, review logs for indicators of compromise, and restrict exposure where possible. Vulnerability Overview The flaw affects Drupal Core and allows unauthenticated