Apache developers have closed multiple, partly critical security vulnerabilities in the enterprise software OFBiz.

Attackers can once again escape the Node.js sandbox vm2 and execute malicious code on the host system.

Microsoft has patched a security vulnerability (CVE-2026-45585) that allowed attackers with physical access to bypass BitLocker encryption; removing the “autofstx.exe” file and switching to TPM+PIN authentication can minimize the risk.

For nearly two decades Verizon counted more cyberattacks using stolen credentials than those exploiting vulnerabilities, but that trend has reversed in the AI era.

Drupal Core maintainers have announced an urgent security update scheduled for the evening of Wednesday, May 20, which administrators should install promptly.