Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-0300 is a critical buffer overflow vulnerability in the User-ID Authentication Portal service, also known as Captive Portal, within PAN-OS. It allows unauthenticated remote attackers to send specially crafted packets and achieve arbitrary code execution with root privileges on affected PA-Series and VM-Series firewalls. The flaw stems from improper handling of input data in the authentication portal component, enabling out-of-bounds writes that corrupt memory and grant full system control.

Practically no one runs a single Kubernetes cluster in production these days. Maybe that’s how it started but data sovereignty requirements, acquisitions, AI initiatives and the need for edge servers, among other considerations, have pulled most enterprises into multi-cluster territory whether they planned for it or not.

Managing multiple Shopify stores creates a problem most merchants underestimate at first: inventory fragmentation. A product may sell out in one store while still showing as available in another, and that gap can lead to overselling, canceled orders, frustrated customers, and extra manual work for your team. The more stores you run, the harder it becomes to keep stock numbers consistent without a system in place. This is why merchants need a reliable way to sync inventory between two Shopify stores.

In May 2026, security researchers at Astra identified a stored Cross-Site Scripting (XSS) Vulnerability in HTML ReportGenerator, affecting versions up to 5.5.8. Cross-Site Scripting(XSS) is a general web security vulnerability that allows threat actors to inject malicious scripts into a web application. This type of vulnerability is mostly exploited to perform actions on behalf of the victim or to mine cryptocurrency.

In May 2026, security researchers at Astra identified a Stored Cross-Site Scripting (XSS) Vulnerability in the SVG attachment preview function of nfty, affecting versions up to 2.22.0. Stored Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject and permanently execute malicious scripts within a web application. If exploited, the threat actor could perform actions on behalf of the victim.

Canada’s fintech and cybersecurity sectors continue to gain global recognition, and organizations like the Council of Canadian Innovators (CCI) play an important role in amplifying the companies shaping the country’s technology future. CCI represents many of Canada’s fastest-growing technology firms, advocating for policies and initiatives that strengthen innovation, economic growth and global competitiveness.

In an AI-assisted development era, the third edition of BSides312 showed why trust, identity, access, evidence, and community remain core to security work.

Ransomware has moved beyond simple malware attacks. It is now operating under a structured business model that disrupts operations, not just systems. Attackers are not depending on phishing or malicious files to deploy ransomware. They instead use compromised identities and existing tools present within environments to move undetected. By the time encryption starts, the attack has already progressed across systems.

In the IT world, there is something quietly sinister about a bank holiday. It’s not the holiday itself – who doesn’t love a bank holiday – a long weekend, a reason to grill something in unpredictable weather, the particular pleasure of feeling like you’ve slipped a Monday… The sinister part is structural.

A CNAPP isn’t a single instrument. It bundles five separately-instrumented security domains — CSPM, CWPP, CIEM, CDR, and a fifth add-on module marketed as AI security — each watching a different observation point. So when leadership asks whether your CNAPP can secure the AI agents your team has shipped, you don’t get one answer. You get five.