Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-60702 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware, that allows a low-privileged attacker with network access over the T3 or IIOP protocols to compromise the server. Oracle published the issue on August 18, 2026, as part of its August 2026 Critical Security Patch Update. The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical).

AI-accelerated attacks are redefining the threat landscape, but many of them still rely on one of the oldest tactics in the book: exploiting known vulnerabilities. The difference today is speed. Vulnerabilities that once took skilled hackers months or weeks to exploit can now be weaponized in hours or minutes. This acceleration is forcing organizations to rethink how they identify and remediate risk.

Six new security issues for every one issue remediated. That's the ratio Snyk research has found, and it's why the AI Security Engineers Community gave an hour of livestream time to fixing rather than finding. Play Video: Remediation Agents Demystified: Your AI Teammate for Fixing Security Bugs Remediation Agents Demystified paired a fireside chat with a live demo.

Blame for all flaws belongs to the flawed human author. Historically, the bottleneck for finding security bugs in software was human bandwidth. As pointed out in this great post by Tom Ptacek, it appears that large language models are exceptionally good at finding them with simple prompting. This adds substantial bandwidth to the effort of finding bugs.

CTEM sounds straightforward as a five-stage loop, but most programs stall quietly somewhere inside it. This post breaks down the five places CTEM projects actually break — bad scoping, unreconciled discovery tools, severity mistaken for risk, skipped validation, and unowned remediation — and argues that these aren’t five separate problems, but symptoms of running CTEM as disconnected efforts instead of one continuous workflow.

Gogs is an open-source Git hosting platform like GitHub or GitLab. The application allows users to manage their own repositories and organizations. Under the hood, it relies heavily on the git CLI.

An unauthenticated SQL injection vulnerability exists in the jsonArrayContains filter function in GeoTools, the geospatial library that underpins GeoServer. When an OGC filter is evaluated against a PostGIS data store, the value passed to jsonArrayContains is written into the generated SQL statement without escaping, allowing an attacker to alter the query the database executes.

CVE-2026-19478 is a code injection vulnerability in GitLab Community Edition and Enterprise Edition, caused by improper handling of a GraphQL directive in the application’s API layer. GitLab disclosed the issue and shipped fixes in an ad hoc critical patch release on August 17, 2026, outside its normal twice-monthly security schedule. The vulnerability carries a CVSS base score of 9.4 (Critical) as assigned by GitLab. Exploitation requires no authentication and no user interaction.

We benchmarked how well leading models produce vulnerability fixes that are both secure and functional, across ~150 real vulnerable code samples in JavaScript, Java, and Python. We ran each model on its own and with Snyk Intelligence (the new agentic Agent Fix architecture). The headline findings.