Vulnerabilities & Exploits
Cybersecurity news in this category
Critical Vulnerability in JetBrains TeamCity Allows Unauthenticated Remote Code Execution
Critical OS Command Injection Flaw in Arista VeloCloud Orchestrator Exploited in the Wild
CISA Adds Exploited Flaws in FortiOS and VeloCloud Orchestrator to Known Exploited Vulnerabilities Catalog
Critical Vulnerabilities in JetBrains IntelliJ IDEA and TeamCity Enable Remote Code Execution
JetBrains has addressed multiple critical vulnerabilities in its IntelliJ IDEA and TeamCity products that could allow remote code execution, unauthorized file access, and sandbox escapes. The flaws affect remote development environments and require immediate patching, especially in shared setups. In IntelliJ IDEA, CVE-2026-59792 involves directory traversal during workspace identifier processing and carries a CVSS score of up to 9.8. TeamCity received fixes for several issues, including malicious Git repository configurations that enable code execution and a Kotlin DSL sandbox escape. Additional patches cover arbitrary file access through Perforce integration and a persistent cross-site scripting flaw on cloud profile pages. Administrators are urged to update IntelliJ IDEA to versions 2026.1.4 or 2026.2 and TeamCity to 2026.1.2 or 2025.11.6 depending on the release line in use.
Critical Vulnerabilities Patched in OpenAM with Release of Version 16.1.2
Multiple serious vulnerabilities have been disclosed in OpenAM, including remote code execution flaws that require no authentication. The Open Identity Platform development team released OpenAM 16.1.2 on July 20, 2026, addressing a total of 18 issues that encompass both native vulnerabilities and those in third-party dependencies. CVE-2026-62379 allows arbitrary Java classes specified in XML to be loaded and instantiated without validation, enabling unauthenticated remote code execution. CVE-2026-62263 stems from improper deserialization filtering in Java, similarly permitting unauthenticated code execution. The update also resolves an XSS vulnerability (CVE-2026-62280) on the authorization consent page and fixes issues in components such as Node.js, js-yaml, and websocket-driver. CVSS scores rate the two primary flaws as critical at 9.8 and 9.2 respectively.
Cisco, Eltex, and MikroTik Switches Tested Against 90 DHCP Spoofing Attacks
Researchers conducted a detailed comparison of three popular network switches to evaluate their effectiveness in blocking DHCP spoofing attacks, a common Layer 2 threat that can compromise data in local networks. The tested devices included the Cisco 2960 with hardware-based protections, the Russian Eltex MES1428 also featuring ASIC-implemented security, and the more affordable MikroTik CRS that relies on CPU-processed Bridge Filter rules. Using a legitimate ALT Linux DHCP server, a Kali Linux attacker running a custom Scapy Python script, and a victim machine, the team launched 30 attacks per device with protections enabled. Results showed Cisco blocking 100% of attacks with the fastest detection times around 415 ms and minimal CPU impact, while Eltex achieved 93.3% effectiveness and MikroTik only 80% with significantly higher latency and processor load. The study highlights hardware versus software implementation differences and provides recommendations for critical infrastructure versus small office environments.
Check Point Issues Urgent Fixes for Critical Exploited SmartConsole Vulnerability CVE-2026-16232
Check Point has released emergency patches for a critical vulnerability in the SmartConsole login process that is already being actively exploited in real-world attacks. The flaw, tracked as CVE-2026-16232 with a CVSS score of 9.3, allows unauthenticated remote attackers to obtain valid access tokens and gain full administrative privileges over the management environment. Exploitation requires the management server to be directly exposed to the internet without IP address restrictions for trusted clients. The company has confirmed attacks against a small number of customers and notified those affected. The update also addresses two additional vulnerabilities, CVE-2026-62144 and CVE-2026-62145, and is delivered through the Jumbo Hotfix package released on July 22, 2026.
Google Releases Fifth Chrome Security Update in July, Addressing Four High-Severity Vulnerabilities
Google has issued the fifth security update for its Chrome browser in July 2026, releasing patches for four high-severity vulnerabilities. The update, published on July 23, 2026, includes versions Chrome 150.0.7871.187 and 150.0.7871.186 for Windows and macOS, along with Chrome 150.0.7871.186 for Linux. This follows previous July updates that fixed 27 issues on July 8, 15 on July 14, 7 on July 16, and 12 on July 21. The four newly addressed flaws, reported between late May and mid-June, all carry a High severity rating. They include an out-of-bounds write vulnerability in the codec component tracked as CVE-2026-16807, plus three Use After Free issues in WebMCP (CVE-2026-16806), the Blink rendering engine (CVE-2026-16805), and input processing (CVE-2026-16804).
PHP Type Juggling Vulnerabilities: How Loose Comparisons Enable Authentication Bypass in Legacy Applications
PHP Type Juggling remains a persistent source of critical authentication bypass vulnerabilities because the language's dynamic typing and loose comparison operator == automatically coerce strings, arrays, and scientific notation values into numbers. The article explains why == differs fundamentally from the strict === operator, how magic hashes starting with 0e followed by digits can be treated as zero, and why functions like hash_hmac return NULL when given arrays instead of strings in older PHP versions. It details practical exploitation techniques including sending parameter[]=value to force arrays, bypassing HMAC checks, and the changes introduced in PHP 8 that eliminated many unexpected string-to-number conversions. The piece also covers detection methods for penetration testers, such as searching for == usage around cryptographic functions, and provides concrete defensive recommendations including mandatory use of hash_equals and strict in_array comparisons. Finally, it directs readers to a hands-on ONE TASK exercise on the free White Hacker Profession course platform to practice identifying and exploiting these issues in a realistic application.
Dell Releases Security Update for PowerProtect Data Manager Fixing 359 Vulnerabilities
Dell has issued a security update for its data protection solution Dell PowerProtect Data Manager to address a total of 359 vulnerabilities. The company published security advisory DSA-2026-287 on July 14, 2026, rating the issues as Critical and urging users to apply the fixes immediately. Six product-specific flaws were resolved, including CVE-2026-40712 in the REST API that allows privilege escalation after input validation bypass and CVE-2026-49499 stemming from improper security token generation. The remaining four native vulnerabilities received CVSS v3.1 base scores between 6.0 and 7.2. In addition, 353 third-party component vulnerabilities were patched, covering 130 issues in the Linux kernel along with flaws in Apache Log4j, Apache Tomcat, Samba, PostgreSQL, OpenSSL, glibc, and Vim. Administrators are advised to upgrade to version 20.2.0.0 or later to mitigate the risks.
CVE-2026-8933: snap-confine Flaw Allows Local Root Escalation on Default Ubuntu Desktop Installs
A high-severity vulnerability tracked as CVE-2026-8933 affects snap-confine within snapd and enables unprivileged local users to obtain root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw stems from a hardening change that replaced traditional setuid root with Linux capabilities, inadvertently creating a race condition during sandbox initialization involving temporary files in /tmp, FUSE mounts, and symbolic links. Attackers can chain the issue with malicious udev rules to bypass AppArmor confinement and force systemd-udevd to execute commands as root. Canonical has released patched versions of snapd including 2.76.1 upstream and corresponding Ubuntu packages for multiple releases, along with ESM updates for older systems. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability once local access is obtained. Organizations are advised to deploy the updates immediately on workstations and developer machines while strengthening local execution controls and AppArmor policies.
ASUS Releases Security Updates to Fix Critical CVE-2026-13385 Router Vulnerability with CVSS Score 9.5
ASUS has issued security updates to address a critical vulnerability identified as CVE-2026-13385 that affects multiple router firmware versions and could allow remote command execution. The flaw impacts devices running firmware versions 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 across various home and small business router lines. It stems from inadequate validation of digital certificates and file integrity mechanisms, preventing proper authentication of servers or received content. Exploitation requires a man-in-the-middle attack condition on compromised networks or manipulated connections but does not need administrative credentials or user interaction. Users are advised to install the latest firmware for their specific models, disable unnecessary administrative features, and review any unauthorized configuration changes. The advisory emphasizes the high severity of the issue given its 9.5 CVSS score and broad device coverage.
Vulnerability in Adobe Acrobat Chrome Extension Allowed Theft of WhatsApp Web Conversations
A flaw in the Adobe Acrobat extension for Chrome enabled malicious websites to steal active WhatsApp Web conversations, contacts, and profile information without requiring any user interaction beyond visiting a prepared URL. The vulnerability, tracked as CVE-2026-48294 and named HermeticReader, carried a CVSS score of 7.4 and affected approximately 329 million installations across all versions up to 26.5.2.2. Attackers exploited internal extension pages and missing origin validation to modify local storage, activate the Hermes integration mechanism, and extract rendered chat content by predicting tab identifiers and sending commands to the Acrobat component. The stolen data included contact names, conversation lists, message previews, profile details, and the full text of open chats, all transmitted to attacker servers via hidden forms while leaving end-to-end encryption intact. Adobe addressed the issue in version 26.5.2.3, which was automatically pushed through the Chrome Web Store. No evidence of in-the-wild exploitation had surfaced prior to public disclosure.
Check Point Management Products Affected by High-Severity Authentication Bypass Vulnerability CVE-2026-16232 Already Under Active Exploitation
Check Point Software Technologies has disclosed a high-severity vulnerability in its security management products that allows attackers to bypass authentication and gain administrator privileges. The flaw, tracked as CVE-2026-16232, resides in the SmartConsole login process and affects the Management Server when accessed over the network. The company published its security advisory on July 19, 2026, confirming that exploitation has already been observed in the wild. Successful attacks could enable unauthorized changes to security configurations and policies. Impacted software includes R82.10, R82, R81.20, and multiple unsupported versions starting from R77.30. Organizations are urged to investigate potential breaches and apply available mitigations promptly.
CISA Adds SharePoint and Check Point SmartConsole Flaws to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation. CVE-2026-50522 affects Microsoft SharePoint and allows remote code execution through untrusted data deserialization, carrying a CVSS v3.1 base score of 9.8. A patch was released on July 14, 2026, though exploitation was not observed at the time of disclosure. CVE-2026-16232 impacts Check Point Software Technologies SmartConsole and stems from an authentication bypass that could let attackers obtain administrative privileges and alter security policies. CISA has directed federal agencies to remediate both issues by July 25, 2026, and Check Point has published associated malicious IP addresses. The agency warns that the flaws pose a broad exploitation risk beyond government systems.
Adobe Acrobat Chrome Extension Flaw Enabled Silent Theft of WhatsApp Web Conversations
A vulnerability in the Adobe Acrobat extension for Chrome allowed attackers to silently extract WhatsApp Web conversations, contacts, and account data without any user interaction beyond visiting a malicious page. The issue affected approximately 329 million browser installations and required no password theft or malware infection. Researchers at Guardio named the attack HermeticReader and traced it to an internal messaging flaw that let a hidden iframe execute unverified commands inside the extension. This activated the dormant Hermes integration mechanism, which acted as a bridge to WhatsApp Web and exfiltrated data in plaintext while the user viewed an ordinary webpage. Adobe received the report, fixed the bug in June, and assigned it CVE-2026-48294, classifying it as a UXSS vulnerability that enables cross-site data disclosure. The extension's failure to validate message sources allowed the malicious site to write data to local storage and trigger the integration without warnings.
From Hundreds of Alerts to Proven Vulnerabilities: INFERA AI.SafeCode Unifies Seven Scanners into a Single DevSecOps Pipeline
INFERA AI.SafeCode integrates seven distinct security scanners into one continuous analysis platform that automatically validates findings instead of flooding teams with unconfirmed alerts. The solution combines SAST, SCA, Secrets detection, DAST, AI-driven Pentest agents, Code Fuzzing, and API Fuzzing to deliver proof-of-exploit evidence for high-risk issues. By cross-validating results across engines, the platform reduces false positives and provides developers with actionable tasks that include reproduction steps, stack traces, and one-click AutoFix recommendations directly inside IDEs and Git workflows. Special attention is given to AI-generated code from tools such as GitHub Copilot, Cursor, and Claude, ensuring that rapid development does not introduce unvetted vulnerabilities. The system also maps full attack surfaces, tracks reachability from entry points to vulnerable sinks, and supports compliance requirements including FSTEC orders for critical information infrastructure. MLSecOps capabilities extend coverage to machine-learning pipelines, model configurations, and inference APIs. Overall, INFERA shifts AppSec from reactive alert triage to measurable risk management with clear MTTR metrics and SLA tracking.
Critical wp2shell Vulnerability Chain Exploited in WordPress for Unauthenticated Remote Code Execution and Webshell Deployment
A critical vulnerability chain dubbed wp2shell is being actively exploited against WordPress Core installations, enabling unauthenticated remote code execution and the installation of persistent webshells. The flaws affect versions 7.0.x prior to 7.0.2, 6.9.x prior to 6.9.5, and the 6.8 branch before 6.8.6, with patches now available. Attackers chain CVE-2026-63030 and CVE-2026-60137 through the WordPress REST API batch processing endpoint and an SQL injection in WP_Query via the author__not_in parameter. Observed campaigns involve mass scanning, user enumeration, attempts to read wp-config.php, and deployment of PHP webshells in wp-content/cache that return fake 404 responses. Administrators are urged to update immediately, audit logs for anomalous REST API requests, inspect for unauthorized admin accounts or plugins, and rotate credentials if wp-config.php exposure is suspected.
Cybercriminals Exploit Critical SharePoint Vulnerability CVE-2025-53770 for Remote Code Execution
A critical unauthenticated remote code execution flaw in Microsoft SharePoint Server, tracked as CVE-2025-53770 with a CVSS score of 9.8, is being actively exploited in the wild. The vulnerability stems from unsafe deserialization of data sent to on-premises servers and forms part of the ToolShell attack chain alongside CVE-2025-49704 and CVE-2025-49706. Attackers can execute arbitrary commands, install web shells, and steal ASP.NET cryptographic keys to forge authentication tokens and maintain persistence even after patching. The flaw affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, while SharePoint Online in Microsoft 365 remains unaffected. Two related variants, CVE-2025-53770 and CVE-2025-53771, were developed to bypass earlier mitigations. Administrators are urged to apply all available patches immediately, restrict internet exposure of SharePoint, and hunt for suspicious files, processes, and scheduled tasks.
Telegram Bug Floods iPhones with Fake Notifications, Causing Severe Overheating and Battery Drain
A persistent bug in the Telegram messaging app has been causing iOS devices to overheat dramatically and rapidly drain their batteries by spamming hundreds of false push notifications in the background. The issue triggers constant English-language alerts reading "You have a new message" even when users have Russian language settings enabled and message previews turned off, rendering the notifications useless. Reports of the problem first emerged in May but intensified after the release of Telegram version 12.9, which appears to create an infinite loop in background processes that overworks the CPU. Affected users report battery losses of up to 11 percent within 30 minutes of idle time, with some devices becoming hot enough that Apple automatically pauses charging until temperatures drop. One journalist resorted to using a gaming controller with a built-in fan to keep an iPhone cool enough to charge. The only temporary workaround involves clearing the app cache and performing a full reinstall from the App Store, though the bug has been known to return after one or two weeks for some users.
Rent, Don't Build: Penetration Testing, Vulnerability Management, and Bug Bounty as a Service
The fifth installment in the Vulnerability Management for Beginners series explores three outsourcing models that allow organizations to avoid building their own infrastructure for vulnerability management. Pentest as a Service, VM as a Service, and bug bounty programs each offer distinct advantages in speed, coverage, and cost while shifting operational burdens to specialized providers. The article details how automated and manual penetration testing differ in depth and scope, why white-box scanning inside the network yields more accurate results than black-box perimeter tests, and how bug bounty platforms like HackerOne and Standoff Bug Bounty have scaled dramatically in Russia and globally. It also covers practical requirements such as proving asset ownership, establishing triage processes, setting realistic SLAs, and handling sensitive data risks when using external services. Benchmarks from providers, updated EPSS metrics, CISA KEV catalogs, and the latest FSTEC methodology are presented as tools for better prioritization. The piece concludes with legal and operational caveats for Russian companies adopting these models in 2025.
Oracle Releases Quarterly Critical Patch Update Addressing 1449 Vulnerabilities Across Numerous Products
Oracle has issued its regular quarterly Critical Patch Update on July 21, 2026, delivering fixes for a total of 1449 vulnerabilities. After removing duplicates, the update covers 1235 unique CVEs and impacts a broad range of products including Oracle Database Server, Oracle Java SE, Oracle MySQL, Oracle Fusion Middleware, Oracle WebLogic Server, and many others. Among the fixes, 261 vulnerabilities received CVSS base scores of 9.0 or higher, with ten rated at the maximum score of 10.0. Additionally, 1024 issues scored 7.0 or above, and 663 vulnerabilities can be exploited remotely without authentication. The advisory provides detailed guidance for administrators to apply the patches promptly across enterprise environments.
Mozilla Releases Firefox 153 Fixing 63 Vulnerabilities Including Critical ESR Issues
Mozilla Foundation released Firefox 153 on July 21, 2026, addressing a total of 63 vulnerabilities tracked under CVE identifiers. The update also covers the Firefox ESR branch, where several flaws already had public exploit code available, earning a Critical severity rating. Among the High-severity issues resolved are same-origin policy bypasses in navigation handling such as CVE-2026-16349 and multiple memory-safety problems. The release further patches Use-After-Free vulnerabilities including CVE-2026-16362 and several sandbox escape flaws designated CVE-2026-16351, CVE-2026-16352, CVE-2026-16356, and CVE-2026-16367. Additional fixes cover boundary condition errors, integer overflows, miscompilation issues, privilege escalation vectors, and information disclosure problems. In total the advisory lists 20 High, 35 Moderate, and 8 Low severity vulnerabilities that have been mitigated.
Adobe Issues 12 Security Advisories Addressing 89 Vulnerabilities Across Multiple Products
Adobe released 12 security advisories on July 14, 2026, addressing a total of 89 vulnerabilities in products including ColdFusion, Adobe Commerce, Experience Manager, Illustrator, and others. The updates align with Microsoft's Patch Tuesday schedule and cover critical flaws rated at the highest severity level. Several vulnerabilities in ColdFusion, Commerce, Experience Manager, and Illustrator received CVSS v3.1 base scores of 9.0 or higher. Adobe ColdFusion received the highest priority rating of 1, requiring remediation within 72 hours, while Adobe Commerce was assigned priority 2 with a 30-day update window. No active exploitation of the vulnerabilities had been observed at the time of disclosure. The advisories include dozens of specific CVE identifiers for each affected product line.
Gitea Authentication Bypass Exposes Private Repositories Through Default Docker Reverse Proxy Setting
A critical authentication bypass vulnerability in Gitea, tracked as CVE-2026-20896 with a CVSS score of 9.8, allows attackers to gain administrative access and read private repositories by sending a single HTTP header. The root cause lies in the official Docker image defaulting the REVERSE_PROXY_TRUSTED_PROXIES setting to a wildcard, trusting the X-WEBAUTH-USER header from any source when reverse-proxy authentication is enabled. The researcher reproduced the full attack on a live vulnerable instance, demonstrating how an unauthenticated request could retrieve secret files such as .env containing database passwords and cloud keys. Multiple related access-control flaws were also disclosed in the same year, including CVE-2026-27771 affecting the container registry, CVE-2026-22874 in webhooks, and CVE-2026-28740 in LFS handling. The recommended fix involves explicitly setting trusted proxy IPs or disabling reverse-proxy authentication entirely and upgrading to version 1.26.4 or later. The issue highlights recurring problems with overly permissive defaults in self-hosted DevOps tools.
Windows Lacks Official Patch for LegacyHive Zero-Day; 0Patch Delivers Free Micro-Patch
A zero-day vulnerability named LegacyHive has been discovered in the Windows user profile service, allowing any standard user to mount another user's registry hive with full access. The flaw was reported on July 14 by researcher Nightmare Eclipse, coinciding with Microsoft's Patch Tuesday, and enables extraction of stored secrets or persistence by modifying registry settings that execute code on the next administrator login. Microsoft has acknowledged the issue and is investigating, but no official fix has been released yet. ACROS Security stepped in with a free micro-patch through its 0Patch platform that neutralizes the exploit by redirecting it to a harmless temporary hive instead of the administrator profile. The protection is available for Windows 10 version 2004 and later, as well as Windows Server 2022 and newer releases, and requires only registration and agent installation without a reboot. Researchers Will Dormann and Kevin Beaumont have independently confirmed the exploit's functionality, with Beaumont also publishing Microsoft Defender for Endpoint queries to detect related attacks.
WordPress Releases Security Update Fixing Two Vulnerabilities That Chain to Remote Code Execution
The WordPress development team has issued version 7.0.2 along with other security releases on July 17, 2026, addressing two critical vulnerabilities identified as CVE-2026-63030 and CVE-2026-60137. When combined, these flaws enable remote attackers to execute arbitrary code on affected installations. CVE-2026-60137 stems from insufficient input validation in certain functions, potentially allowing SQL injection when processing untrusted data from plugins or themes. CVE-2026-63030 involves route interpretation confusion in the REST API batch endpoint, which can be leveraged alongside the SQL injection issue to achieve code execution. The vulnerabilities impact WordPress 6.8 and later branches, although chained attacks are not possible on the 6.8 series. Administrators are urged to apply the updates immediately to mitigate the risks.
Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products
Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.
Google Issues Emergency Chrome Update Patching Seven Vulnerabilities Including Three Critical Flaws
Google has released a new security update for its Chrome browser addressing seven vulnerabilities just two days after the previous patch. The update covers Windows, macOS, and Linux platforms with versions Chrome 150.0.7871.129 and 150.0.7871.128. Three of the issues, tracked as CVE-2026-15899, CVE-2026-15900, and CVE-2026-15901, received the highest severity rating of Critical and involve Use After Free flaws in CameraCapture, GPU, and Network components. Four additional High-severity vulnerabilities were also fixed, including an out-of-bounds access issue in the V8 JavaScript engine and Use After Free problems in Cast, Ozone, and Aura. The company plans to roll out the patches gradually over the coming days and weeks to all users.
OpenSSL Patches HollowByte Vulnerability That Enables Denial-of-Service Attacks on TLS Connections with Just 11 Bytes
OpenSSL has released fixes for a vulnerability dubbed HollowByte that allows denial-of-service attacks against servers using unpatched versions of the library. The flaw can be triggered by a malicious TLS request as small as 11 bytes and was addressed without a CVE or formal security advisory because it was classified as a hardening improvement. Researchers from Okta warn that the operational impact can be significant on internet-facing servers, as the issue occurs during the initial TLS handshake when vulnerable OpenSSL versions reserve memory based on the client-declared size before verifying actual data delivery. Attackers can open connections, claim they will send a large message, and then deliver only a tiny portion, leaving the server waiting indefinitely with reserved memory. In tests with NGINX, low-memory servers could be completely taken down while more powerful machines suffered substantial capacity loss without triggering abnormal traffic volumes. The patches are included in OpenSSL versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, and administrators are advised to update packages, restart affected services, and monitor for unusual memory growth.
CISA Adds Three Exploited Vulnerabilities in FortiSandbox and SharePoint to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. Two of the flaws affect Fortinet’s FortiSandbox malware analysis product and involve OS command injection issues that can be triggered via specially crafted HTTP requests without requiring authentication. The third vulnerability impacts Microsoft SharePoint and stems from unsafe deserialization of untrusted data, potentially allowing remote code execution over the network. CISA’s action follows public advisories released by the vendors in April and June 2026. The agency is urging organizations to apply available patches and mitigations immediately to reduce the risk of compromise.
CISA Urges Immediate Patching as Multiple SharePoint Server Vulnerabilities Confirmed Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory after confirming active exploitation of multiple vulnerabilities in Microsoft SharePoint Server. Four specific CVEs have been added to the Known Exploited Vulnerabilities (KEV) catalog, with one additional flaw flagged by Microsoft as high-risk even without confirmed exploitation. Successful attacks can lead to remote code execution, theft of Internet Information Services (IIS) machine keys, establishment of persistent access, and deployment of malware. CISA recommends applying the latest Microsoft patches immediately, verifying successful installation, enabling the Antimalware Scan Interface (AMSI), and strengthening monitoring through Microsoft Defender Antivirus. Organizations are also advised to avoid direct internet exposure of SharePoint servers and to implement Layer 7 reverse proxies with enhanced logging to reduce the attack surface.
Eleven Old Microsoft-Signed UEFI Shims Enable Bypass of Secure Boot on Linux Systems Still Trusting Microsoft Corporation UEFI CA 2011
Eleven legacy UEFI shim bootloaders signed by Microsoft, all version 0.9 or earlier, can be abused to bypass UEFI Secure Boot on systems whose firmware still trusts the Microsoft Corporation UEFI CA 2011 certificate. Attackers who manage to place one of these vulnerable shims in the boot path can execute arbitrary code before the operating system loads, enabling bootkits, persistence, and kernel-level compromise with minimal visibility to traditional EDR tools. The issue stems not from a new kernel bug but from the continued validity of old, correctly signed binaries that have not yet been revoked in the DBX database. Microsoft has already issued DBX revocation updates, yet administrators must first upgrade shim, GRUB, and other boot components to modern versions that support SBAT before applying the revocations to avoid bricking systems. Affected implementations include Red Hat Enterprise Linux 7.2, CentOS 7.2, Oracle Linux 7.2, openSUSE, baramundi Management Suite up to 2024R1, WipeDrive 8.0.0–8.1.3, PC Doctor Service Center, and Abitti 1. The problem is tracked under CVE-2026-8863 and CVE-2026-10797, with public references available from The Hacker News, CERT/CC VU#616257, NIST NVD, and Help Net Security.
SonicWall Issues Emergency Hotfixes After Detecting Active Exploitation of Two Zero-Day Vulnerabilities in SMA1000 Appliances
SonicWall has confirmed active exploitation of two zero-day vulnerabilities in its SMA1000 series appliances, prompting the immediate release of hotfixes and a strict compliance deadline for U.S. federal agencies. The first flaw, CVE-2026-15409, carries a critical CVSS score of 10.0 and allows unauthenticated server-side request forgery (SSRF) through the Appliance Work Place interface, enabling attackers to force the device to make unauthorized requests to internal services. The second vulnerability, CVE-2026-15410, rated CVSS 7.2, permits authenticated code injection via the Appliance Management Console, allowing administrators to execute operating system commands. Affected models include SMA6210, SMA7210, and SMA8200v running specific vulnerable platform versions such as 12.4.3-03245 through 12.5.0-02800. CISA has added both CVEs to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch or decommission impacted systems by July 17, 2026. Indicators of compromise and recommended response actions, including log analysis and potential appliance reimaging, have been published to help organizations detect and mitigate potential intrusions.
Zero-Day Vulnerability CVE-2026-15682 in AnyDesk Enables Denial-of-Service Attacks on Affected Systems
A newly disclosed zero-day vulnerability in AnyDesk, tracked as CVE-2026-15682, allows attackers to trigger denial-of-service conditions on systems running the popular remote access tool. The flaw centers on a support information transmission feature that can be abused through Windows file system redirection mechanisms. An attacker with limited local access can manipulate these redirections to crash either the AnyDesk application or the underlying operating system. Because AnyDesk is widely deployed by support teams, managed service providers, and internal IT departments, the vulnerability poses a significant risk to remote assistance workflows and incident response operations. Until an official patch is released, organizations are advised to restrict code execution privileges, monitor for anomalous file system redirection activity, and apply updates as soon as they become available.
Cybercriminals Actively Exploiting Critical Zero-Day Vulnerabilities in SonicWall SMA1000 Appliances
Cybercriminals are actively exploiting a critical zero-day vulnerability in SonicWall SMA1000 appliances used for corporate remote access. The attack chain combines two flaws that together enable unauthenticated access to internal services and local privilege escalation, ultimately allowing remote code execution with maximum privileges on affected devices. The most severe issue, CVE-2026-15409, carries a maximum CVSS score of 10.0 and permits attackers to reach internal appliance services without authentication, while CVE-2026-15410 facilitates local privilege escalation. Impacted models include the SMA1000 Series 6210, 7210, and 8200v running firmware versions 12.4.3-03434 and 12.5.0-02800. SonicWall has confirmed that its SSL VPN firewalls and the SMA 100 product line remain unaffected. Compromised appliances have already been observed serving as stealthy entry points into corporate networks, where attackers harvested credentials, session data, and multi-factor authentication seeds before pivoting into Active Directory environments. Administrators are urged to apply the emergency patches that upgrade devices to firmware versions 12.4.3-03453, 12.5.0-02835, or later.
7-Zip Vulnerability CVE-2026-14266 Enables Arbitrary Code Execution Through Malicious XZ Archives
A critical buffer overflow vulnerability has been identified in the popular file archiver 7-Zip, tracked as CVE-2026-14266, that allows attackers to execute arbitrary code by delivering a specially crafted XZ archive containing fragmented data. The flaw stems from improper handling of fragmented XZ streams, which can cause the application to write data beyond allocated memory buffers and potentially grant attackers the same privileges as the running 7-Zip process. Exploitation requires user interaction, such as opening a malicious archive received via email, messaging apps, or file-sharing services, making it particularly suitable for targeted phishing campaigns rather than automated remote attacks. The vulnerability received a CVSS score of 7 out of 10, reflecting its significant impact on confidentiality, integrity, and availability without requiring authentication or prior access. No real-world exploitation cases have been reported yet, but technical details have been made public, increasing the risk that working exploits could be developed quickly. Developers have already released a fix in version 26.0, and users are strongly advised to update immediately while exercising caution with unexpected XZ files. The issue highlights ongoing risks associated with archive processing software that handles complex compression formats.
Microsoft Pauses Windows Security Update KB5101650 After It Triggers Shutdowns and Overheating on Dell Laptops with Intel Processors
A mandatory July security update intended to patch 570 vulnerabilities in Windows instead caused spontaneous shutdowns, performance drops, overheating, and rapid battery drain on certain Dell laptops equipped with Intel processors. The root cause was traced to incompatibility between the new Windows USB-C Connection Manager interface and Intel’s Innovation Platform Framework Processor Participant driver, which manages CPU power consumption and thermal control. Microsoft had already observed early signs of the conflict in June with the optional update KB5095093, but the problematic driver changes were carried forward into the mandatory Patch Tuesday release. Because the exact list of affected Dell models was not disclosed, the full scope of the issue remains difficult to assess, though the company acted quickly to block rollout on incompatible hardware. No widespread hardware damage has been reported, and Microsoft is working with Intel and Dell to deliver a fix in the coming days while continuing to recommend the update for unaffected systems.
Secure Boot Bypassed for Over a Decade Through Unrevoked Vulnerable Shim Bootloaders, ESET Finds
ESET researchers have disclosed that Secure Boot, the UEFI mechanism designed to block malicious code before Windows or Linux starts, could be bypassed for more than ten years using old but still-trusted shim bootloader images signed by Microsoft. The 11 vulnerable shims, some dating back to 2013, were never added to revocation lists despite known vulnerabilities, allowing attackers to load unsigned or malicious code early in the boot process. The flaw affected both Linux distributions and Windows systems because UEFI firmware does not tie a Microsoft-signed shim to a specific operating system. After Microsoft finally revoked the images in its June updates following ESET’s disclosure, users were advised to check firmware policies and Linux Vendor Firmware Service for proper propagation of the new revocation data. The incident highlights systemic weaknesses in managing thousands of signed boot components and the central trust role played by Microsoft in the UEFI ecosystem.
Microsoft Patches Record 570 Windows Vulnerabilities in July Update, Including Three Actively Exploited Zero-Days
Microsoft released its largest Patch Tuesday update to date, addressing 570 vulnerabilities across Windows and related products. Among them are three zero-day flaws, two of which have already been exploited in real-world attacks. Fifty-nine issues were rated critical, with 48 enabling remote code execution. The company credited its use of AI for discovering more vulnerabilities in the Windows codebase. The update covers a wide range of components including .NET, Active Directory services, Microsoft Office, Azure services, and Microsoft Defender. Administrators are urged to apply the patches promptly to mitigate risks from privilege escalation, remote code execution, and information disclosure flaws.
WinFsp Vulnerability CVE-2026-3006 Allows Local Attackers to Escalate Privileges to SYSTEM via Race Condition in Kernel Driver
A critical vulnerability has been discovered in WinFsp, the open-source platform used to implement virtual disks, network file shares, and custom file systems on Windows. The flaw, tracked as CVE-2026-3006 with a CVSS 3.1 score of 7.0, affects version 2.1.25156 and all earlier releases, enabling a local attacker to trigger a race condition that leads to a memory overflow inside the kernel-mode driver. Successful exploitation grants full SYSTEM-level privileges, allowing modification of protected files, installation of services and drivers, disabling of security mechanisms, and creation of new accounts. The issue cannot be exploited remotely and requires the attacker to already have the ability to execute code on the target system, either through a compromised account or by running malicious software. WinFsp components are frequently bundled inside third-party virtualization and storage applications, significantly expanding the potential attack surface. Developers have released a fix in WinFsp 2.2B1, while Singapore’s Cyber Security Agency recommends immediate updates, restriction of local administrative rights, and monitoring for unexpected driver or service changes.
Progress Software Urges Businesses to Immediately Shut Down ShareFile Storage Zone Controller Servers Over Credible External Threat
Progress Software has instructed customers to manually power down servers running ShareFile Storage Zone Controller due to a credible external threat, temporarily blocking affected accounts while an investigation is underway. The company has not disclosed the nature of the threat or any timeline for restoring access, and no evidence of unauthorized access to customer data has been found so far. Storage Zone Controller enables organizations to store and manage data in their own infrastructure or with third-party providers instead of relying solely on Progress-hosted services. Some users have speculated that the incident may be linked to two high-severity vulnerabilities patched in March, CVE-2026-2699 and CVE-2026-2701, which could allow unauthenticated attackers to modify controller settings, upload malicious files, and execute arbitrary commands. Progress Software is treating the server shutdown as an additional protective measure while the investigation continues, highlighting the seriousness with which the company views the potential risk.
OpenClaw AI Assistant Compromised via WhatsApp: Three Critical Vulnerabilities Allowed Credential Theft, Sandbox Escape, and Arbitrary Code Execution on Host
Security researchers discovered three high-severity vulnerabilities in OpenClaw that could let attackers steal credentials, escalate privileges, and execute arbitrary code on the host system running the AI assistant. Two flaws rated 8.8 on the CVSS scale stemmed from incomplete command filtering that failed to block dangerous inputs, while a third issue rated 8.4 enabled sandbox bypass by mounting parent directories such as /home or /var. The weaknesses potentially exposed sensitive data in ~/.ssh, ~/.aws, and ~/.gnupg, and even allowed attackers to reach the Docker socket for full host escape. Notably, the attack could be triggered remotely through an external WhatsApp message without any prior system access, according to researcher Chinmohan Nayak. All issues were patched in OpenClaw version 2026.6.6, and users are urged to update immediately while tightening sandbox and tool permissions.
IRIS C2 Zero-Day Marketplace: How Two Convicted Fraudsters Jack Berkman and Jacob Wohl Launched a Government-Facing Exploit Trading Operation
IRIS C2, a Virginia-based company promising up to $7 million for zero-day vulnerabilities and offensive hacking tools, is operated by Calvexa Group LLC and run by two previously convicted political provocateurs with histories of fraud and operating under false identities. Journalist Brian Krebs uncovered that the firm, which emerged on social media in January 2025, markets itself as a supplier of offensive cyber capabilities while actively recruiting young talent without requiring formal degrees or experience. The company claims to purchase zero-days, exploit chains, and ready-made attack tools for major platforms, then refine them into stable, weaponized products for sale primarily to government agencies, including phone-hacking solutions. Founders Jack Berkman and Jacob Wohl previously ran fake intelligence firms, spread false accusations against politicians, and were convicted in 2022 for wire fraud in Ohio, later receiving a $5.1 million FCC fine for illegal robocall campaigns. They also received $300,000 from a cryptocurrency theft suspect to lobby for a presidential pardon, continuing a pattern of deceptive business practices exposed by outlets including KrebsOnSecurity and Politico.
Don't Flash Your Keys on Social Media: Photos Can Be Used to 3D-Print Working Duplicates in Minutes
A cybersecurity specialist has demonstrated that ordinary photographs of keys posted on social media can be turned into functional duplicates using only publicly available tools. Red teamer Evan Ottinger showed how visible key profiles and cuts allow attackers to reconstruct the exact geometry and produce working copies via graphic editors and 3D printers. The entire process, from downloading a photo to having a usable plastic key, can take as little as 10-15 minutes and leaves no obvious traces on the lock, unlike traditional lockpicking methods. Ottinger tested the technique himself after initially doubting its effectiveness, confirming that the printed key successfully opened the corresponding lock. The researcher warns that both ordinary users and celebrities frequently share such images, treating physical keys like passwords that should never be displayed in close-up shots or stories. This physical attack vector raises serious concerns for security professionals because it bypasses digital protections while appearing completely normal to bystanders.
Critical CVSS 10.0 Vulnerabilities in Joomla SP Page Builder and Page Builder CK Enable One-Click Unauthenticated File Upload and Full Site Takeover
U.S. authorities have warned about three actively exploited vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalog, urging immediate patching. The most severe issues, CVE-2026-48908 and CVE-2026-56290, affect Joomla extensions SP Page Builder and Page Builder CK respectively, both scoring 10.0 and allowing unauthenticated attackers to upload and execute arbitrary PHP files for complete site compromise. A third flaw, CVE-2026-55255 (CVSS 9.9), impacts the Langflow AI application platform and permits authenticated attackers to hijack other users’ processes and access sensitive secrets. All three vulnerabilities are already being used in real-world attacks, though CISA has not disclosed attacker identities or victim counts. Federal agencies must remediate under BOD 26-04, while all organizations are advised to check for vulnerable components, apply fixes, and review logs for prior intrusions.
Windows Defender Patch for RoguePlanet Zero-Day Vulnerability May Exhaust Disk Space on Windows Systems
Microsoft released a security update addressing the RoguePlanet zero-day vulnerability (CVE-2026-50656) in the Microsoft Malware Protection Engine used by Windows Defender. The flaw, disclosed earlier by researcher NightmareEclipse, allowed remote attackers to gain administrative control over Windows 10 and Windows 11 even when real-time protection was disabled. While the patch was intended to resolve the issue and deploy automatically, the researcher now claims it introduces a new problem involving excessive disk writes. Specifically, the update may cause Defender to cache extremely large Zone.Identifier alternate data streams without size limits, potentially filling the entire drive. The attack vector involves a malicious SMB server that serves oversized metadata streams while maintaining the connection. Microsoft has not yet confirmed the reported behavior, and tensions between the company and the researcher continue over disclosure practices and bug bounty rewards.