InfoSecBulletin Cybersecurity for mankind
Cross-Site Scripting (XSS) is one of the oldest and most persistent vulnerabilities in modern applications. Despite being recognized for over 20 years, it still affects both legacy systems and new cloud-native architectures.
The Microsoft Security Response Center (MSRC) noted that the threat of XSS remains significant, as it regularly receives reports about it across various services and applications.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
A recent MSRC report highlighted the ongoing threat of XSS vulnerabilities, noting that advanced security measures like Content Security Policies (CSP) and secure libraries are still insufficient.
Since January 2024, the MSRC has addressed over 970 XSS cases, showing their ongoing commitment to handling this type of vulnerability.
XSS By The Numbers:
Between July 2024 and July 2025, XSS vulnerabilities accounted for 15% of all “Important” or “Critical” security cases handled by the MSRC.
The center handled 265 XSS cases, with 263 deemed Important and two Critical. Microsoft rewarded security researchers with $912,300 for identifying these vulnerabilities.
The highest reward for a significant XSS attack, like token theft or a zero-click exploit, was $20,000. Click here to read the full report here.
