Cybersecurity
A cloud-security company built on agentless snapshot scanning published two applications in this week's drop, one on runtime endpoint detection, one on finding sensitive data without agents, that together read as R&D pushing into the two categories adjacent to where its platform started.
Cybersecurity
AdaptHealth Corp. (AHCO) filed an 8-K under Item 1.05 disclosing that a threat actor accessed its cloud business applications and patient-management systems and exfiltrated an insurance-billing password file. The company says the incident is contained and has not yet had a material impact on operations.
Cybersecurity
In a Form 8-K filed June 30, 2026 under Item 8.01, Aflac Incorporated says its wholly owned Aflac Japan subsidiary discovered unauthorized third-party access to certain systems between June 15 and June 25, 2026, has engaged third-party cybersecurity experts, and states the full scope and potential ultimate impact are not yet known.
Cybersecurity
A batch of security patents granted to Cisco on June 30 centers on network detection and visibility — anchored by a domain-fronting detector — and extends into policy assurance, secure access, and hardware provenance.
Cybersecurity
The risk-factors section is a required SEC disclosure of the material factors that make an investment speculative or risky. The rule sets what must be there — and what is discouraged.
Cybersecurity
Operating cash flow is a GAAP statement line; free cash flow is a non-GAAP measure that subtracts capital spending from it. A real filing defines exactly what comes out.
Cybersecurity
Item 2.02 is the 8-K item companies use to disclose quarterly results. The earnings press release is 'furnished,' not 'filed' — a distinction with legal weight.
Cybersecurity
Deferred revenue is cash collected for service not yet delivered. Under the revenue standard it is recognized over the contract term — a real 10-Q shows how.
Cybersecurity
The 10-Q is an unaudited quarterly report filed three times a year; the 10-K is the audited annual report. The form instructions set the timing and the no-fourth-quarter rule.
Cybersecurity
Non-GAAP or 'adjusted' figures exclude items a company chooses to remove from the comparable GAAP number. The SEC defines the term and limits how it may be presented.
Cybersecurity
RPO is the contracted revenue a company has not yet recognized. A real 10-Q shows the figure, the recognition schedule, and why it differs from deferred revenue.
Cybersecurity
Dollar-based net retention measures how much revenue an existing cohort of subscription customers generates a year later. Here is exactly how one filer defines and calculates it.
Cybersecurity
CVE-2026-8024, a critical (CVSS 9.8) deserialization-of-untrusted-data vulnerability in iba's ibaPDA and ibaDatCoordinator, can be exploited by a remote, unauthenticated attacker, according to the National Vulnerability Database and a CERT@VDE advisory.
Cybersecurity
CVE-2026-54390, a critical (CVSS 9.8) server-side template injection flaw in JTL Shop 5.2.0–5.7.1, lets unauthenticated attackers read server secrets and, on 5.4.0–5.7.1, write a webshell to the web root.
Cybersecurity
Two CrowdStrike applications published this week, set against a year of related filings, point the company's R&D away from flagging threats and toward letting machine-learning agents act on them, while a parallel cluster works the cost of being wrong.
Cybersecurity
AMD's AI Tensor Engine for ROCm deserializes attacker-supplied pickle payloads from an unauthenticated ZeroMQ socket, letting one crafted message execute code simultaneously across every reader worker in a cluster.
Cybersecurity
A CVSS 9.6 flaw in transformers 5.2.0 let an untrusted config.json override the very setting meant to block remote code execution, turning AutoModel.from_pretrained into a code-execution primitive.
Cybersecurity
A use-after-free in Chrome's FileSystem component, fixed in 149.0.7827.53, could let a malicious web page potentially escape the renderer sandbox — the boundary that is supposed to contain hostile JavaScript.
Cybersecurity
A CVSS 9.1 memory-corruption-and-disclosure flaw in Netty's Oblivious HTTP codec only triggers when the JVM is hardened against sun.misc.Unsafe — a configuration security teams often choose on purpose.
Cybersecurity
A CVSS 9.1 flaw in the Capsule multi-tenancy framework let a tenant owner borrow the controller's cluster-admin privileges to create cluster-scoped objects they could never create directly, breaking the wall between Kubernetes tenants.
Cybersecurity
CVE-2026-10611 carries the maximum CVSS base score of 10.0. In MISP deployments that pair LDAP authentication with mandatory one-time passwords, a user with valid primary credentials could walk straight past the OTP challenge.
Cybersecurity
CVE-2026-46483 let a crafted .tgz archive filename inject shell commands through Vim's tar plugin because shellescape() was called without the {special} flag. NVD scores it 3.6 Low.
Cybersecurity
CVE-2026-45736 lets ws leak uninitialized process memory when a TypedArray is passed as the close() reason. NVD scores it 4.4 Medium, but the class deserves attention.
Cybersecurity
CVE-2026-6228 lets an attacker self-register, craft an edit_user form, and assign themselves the administrator role because the plugin never checks who may grant it. NVD scores it 8.8 High.
