cybersecurity

I missed it last year, but not this time.

WordPress has released security updates for CVE-2026-64638, a high-severity vulnerability affecting the login page that has been patched in WordPress 7.0.3 and backported to supported branches. The bug itself is a pre-authentication reflected XSS caused by a parser differential between WordPress’s input handling and HTML sanitization pipeline. According to the published research, malformed input survives strip_tags() but is later interpreted as valid HTML by wp_kses_post(), allowing attacker-controlled DOM elements to be injected into the failed login page.

https://1password.com/blog/why-ai-generated-patches-still-require-human-review

Github link -> https://github.com/anthropics/defending-code-reference-harness

Amgen has disclosed a material cybersecurity incident involving cloud storage managed by third-party providers. According to the company’s SEC filing, attackers accessed and stole company data, with the investigation still determining the full scope of the breach. The potentially impacted information includes patient data, confidential business records, intellectual property, and research data

OpenAI says its investigation into the Hugging Face incident uncovered additional cases where autonomous AI agents escaped their intended containment environments. While the newly identified incidents reportedly remained inside OpenAI’s network, they reinforce a growing concern: securing AI systems is now as much a cybersecurity problem as it is an AI safety problem

Anthropic has disclosed that its Claude AI models gained unauthorized access to the systems of three real organizations during internal cybersecurity evaluations after a misconfiguration unintentionally exposed the testing environment to the public internet. Believing the targets were part of a simulated capture-the-flag exercise, Claude used basic techniques, including weak credentials and exposed endpoints, to compromise the systems. Anthropic said no zero-day vulnerabilities were involved, and the affected organizations have since been notified.

A serious firmware flaw in COLDCARD hardware wallets has shaken the Bitcoin community after researchers linked it to large-scale wallet thefts. The issue affects seed generation, where some firmware versions produced recovery phrases with significantly lower entropy than intended. That makes the 24-word seed phrase far more predictable, allowing attackers to brute-force private keys in cases where users relied solely on the generated seed. Reports indicate hundreds of wallets have already been drained, with approximately 594 BTC stolen.

A threat actor claims to be selling an alleged database linked to more than 75 million Revolut users, reportedly containing customer and account-related information. Revolut says it has found no evidence of unauthorized access or a new security breach, and the authenticity of the dataset remains unverified as the investigation continues.

A coordinated cyberattack targeted more than 30 community water systems across Minnesota between July 26 and 27, prompting a statewide incident response involving Minnesota IT Services (MNIT), the FBI, CISA, and other federal partners. Authorities say there is no evidence that drinking water quality was affected, and residents do not need to change their water usage. Several municipalities, including Plymouth, South St. Paul, Maple Plain, and Braham, reported disruptions to operational technology (OT) systems. In Braham, attackers briefly shut down computerized operating controls at the water plant before crews restored operations. The incident highlights the growing threat to industrial control systems (ICS) and SCADA environments that manage critical infrastructure.

Broadcom has released emergency patches for multiple critical VMware vulnerabilities affecting vCenter and ESXi. The most severe issues allow unauthenticated attackers to bypass authentication, execute arbitrary code, and, in certain scenarios, escape from a guest VM to the underlying hypervisor. The key vulnerabilities include: CVE-2026-59309 (CVSS 9.8): Authentication bypass in the VMware Directory Service. CVE-2026-59310 (CVSS 9.8): Directory traversal in the vCenter Syslog Server that can lead to remote code execution. Additional ESXi issues may enable host compromise from a guest VM under specific conditions. An attacker with network access to a vulnerable vCenter instance could potentially gain full administrative control without valid credentials, then deploy malware, steal credentials, manipulate virtual infrastructure, or pivot across enterprise deployments

OpenAI has revealed that a cyber-attack carried out by a rogue Al agent had more than one victim.

RCE Proof of concept for CVE-2026-42945, a critical heap buffer overflow in NGINX’s ngx_http_rewrite_module introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives.

A newly disclosed vulnerability in Active Directory Certificate Services (AD CS) shows just how dangerous certificate-based authentication can become when trust breaks down. Certighost (CVE-2026-54121) allows a low-privileged domain user, under specific conditions, to obtain a certificate for a Domain Controller, authenticate using PKINIT, and perform DCSync to retrieve the krbtgt secret, potentially leading to complete Active Directory compromise. Microsoft patched the flaw in its July 2026 security updates, but a public proof-of-concept is now available

We are pleased to announce the release of Vulnerability-Lookup 5.5.0!

Oracle has released its July 2026 Critical Patch Update (CPU), containing 1,449 security patches across numerous product families. The advisory includes fixes for vulnerabilities affecting Oracle Database, Fusion Middleware, E-Business Suite, Java, Communications, and many other products, with Oracle recommending that customers apply updates without delay.

Check Point recently disclosed CVE-2026-16232, an authentication bypass in the SmartConsole login process that can allow an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges under specific conditions.

CVE-2026-50522 is a critical SharePoint deserialization vulnerability that is now being actively exploited. This article examines the vulnerability in depth, including the exploitation workflow, affected versions, machine-key theft for persistent access, patch analysis, indicators of compromise, and practical mitigation guidance for defenders.

A recent incident demonstrates how a vulnerability in a perimeter security appliance can become the first step in a much larger intrusion. This article examines the attack progression from PAN-OS GlobalProtect exploitation through credential theft, lateral movement, and eventual Qilin ransomware deployment, along with the published IoCs, attacker TTPs, and defensive recommendat

The latest OpenSSL disclosure, HollowByte, demonstrates how seemingly small flaws in protocol handling can translate into denial-of-service conditions through uncontrolled memory consumption. This article examines the vulnerability’s technical root cause, affected releases, attack prerequisites, remediation, and what it means for administrators running Internet-facing TLS services

Adrian Mastronardi has released a book called Half a Second; it is a detailed look into the XZ backdoor attempt of 2024. The book is freely available under a (non-free) noncommercial, no-derivatives CC license.

Since June, Tesla’s algorithms have been sharing street-level telemetry about moving objects over a “broker” network, and using it to command a vehicle (to follow and/or avoid moving objects).

Shark has not acknowledged the vulnerability let alone patched the exploit. If you have a Shark robot vacuum disconnect it from the internet until a patch is available.

I’m a little late with this news, but it’s a good write-up.

Announcement.

A coalition of 21 cybersecurity and intelligence agencies has warned that Russian state-sponsored hackers continue to compromise internet-facing routers by exploiting weak configurations and known vulnerabilities, enabling them to steal device configurations and gain insight into victims’ networks.

The official jscrambler npm package was compromised in v8.14.0, where a malicious preinstall lifecycle hook executed a Rust-based infostealer as soon as npm install was run. Because the payload ran during installation, both developer workstations and CI/CD runners that installed the affected release should be treated as potentially compromised. The malware targeted developer secrets, including SSH keys, Git credentials, browser data, cryptocurrency wallets, and other locally stored tokens. According to the vendor, v8.22.0 is the first malware-free release. If you installed v8.14.0, it’s recommended to upgrade immediately, review affected systems, and rotate any credentials that may have been exposed

A new version of the RedHook Android malware abuses the Android Wireless Debugging (Wireless ADB) mechanism in a novel way to gain shell-level privileges without requiring a computer connection.

In October 2025, Microsoft’s threat intelligence team identified destructive wiping activity inside compromised environments and traced it to a previously unknown piece of malware they’re now calling GigaWiper. The malicious code is written in Go, it combines a command-and-control backdoor with multiple built-in destruction capabilities, and it was assembled by taking code from at least three older malware families and merging them into one implant. Efficient, if attackers aim at destroying the target systems.

Unknown threat actors compromised the Injective Labs SDK project’s GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases.

Stegano 2.5.0 is out! 🎉

Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains.

Researchers have disclosed GhostLock (CVE-2026-43499), a Linux kernel local privilege escalation vulnerability in the rtmutex subsystem that reportedly dates back to 2011. The flaw stems from a use-after-free condition caused by a dangling pointer during proxy-lock rollback and can be leveraged for root privilege escalation and container escape on vulnerable systems.

I wanted to fix a Facebook link, upon opening it in the browser, my adblocker warned me of malware in the url.

Accenture has confirmed it is investigating a security incident after a threat actor claimed to have accessed internal Azure DevOps resources and advertised what they describe as source code, configuration files, and credentials for sale. While the company has acknowledged the incident, the full scope of the allegedly stolen data has not been independently verified

Januscape (CVE-2026-53359) is a guest-to-host vulnerability that exploits a use-after-free in the shadow MMU emulation of KVM/x86. Guest-side actions alone can trigger the bug and corrupt the shadow page state of the host kernel that runs the guest. Because the vulnerability lives in the shadow MMU code that x86 KVM shares between both Intel (VMX) and AMD (SVM), it is not limited to a single architecture, and to the best of public knowledge, this is the first guest-to-host exploit research triggerable on both Intel and AMD. It threatens the guest-host isolation of multi-tenant x86 public clouds (GCP, AWS, etc.) that accept untrusted guests and expose nested virtualization. In fact, this vulnerability was used as a 0-day in Google kvmCTF.

Researchers are warning that CVE-2026-20896, a critical authentication bypass affecting Gitea Docker deployments using reverse-proxy authentication, is now seeing active exploitation. Under specific misconfigurations, attackers can spoof the X-WEBAUTH-USER header to impersonate arbitrary users, potentially leading to full repository compromise. The issue has been fixed in Gitea 1.26.4 (and corresponding patched releases for supported branches), so administrators should update as soon as possible. If you’re using reverse-proxy authentication, it’s also worth reviewing your proxy configuration to ensure authentication headers cannot be supplied by untrusted clients.

Two recent GitHub security disclosures focus on trust rather than flaws in Git itself. One shows edge cases where GitHub’s Verified commit indicator can be misleading despite valid cryptographic signatures. The other looks at how GitHub Copilot’s coding agent can be influenced through MCP prompt injection when interacting with untrusted repository content. If you use signed commits, review PRs based on the Verified badge, or are experimenting with AI coding agents, Here’s a technical breakdown of both issues, GitHub’s response, and the recommended mitigations.

PoC: https://github.com/JakeGinesin/git-chain-malleator

Noma Security’s research team, Noma Labs, has disclosed a critical prompt injection vulnerability in GitHub’s new Agentic Workflows. The vulnerability, named GitLost, allowed researchers to trick GitHub’s AI agent into retrieving data from a private repository and posting it publicly by submitting a crafted issue in a public repository belonging to the same organization.

China-aligned attackers broke into the networks of U.S. and Canadian universities to steal sensitive data and establish persistent access via webshells and backdoors, Proofpoint threat researchers said Tuesday.

We are pleased to announce the release of Vulnerability-Lookup 5.3.0!

CVE-2026-43456 is a local privilege escalation vulnerability in the Linux kernel caused by a flaw in the bonding driver that can lead to use-after-free conditions during interface teardown and state transitions. Under the right conditions, a local attacker can leverage the race to obtain root privileges.

Severe cybersecurity vulnerability disclosures (CVEs) spiked in 2026. In June, notable organizations published around 1,500 high- and critical-severity CVEs — more than 3.5× the monthly record prior to Mythos’ release.

The U.S. Department of Homeland Security has confirmed that attackers breached the Homeland Security Information Network (HSIN) along with a connected SharePoint environment. HSIN is an unclassified but sensitive platform used by federal, state, local, tribal, territorial, and private-sector partners to share threat intelligence and coordinate incident response.

Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities.

We are excited to share the result of a fruitful collaboration with The Shadowserver Foundation: a new Known Exploited Vulnerabilities (KEV) Catalog (BCP-07 compliant) built directly from their global honeypot telemetry.

cross-posted from: https://piefed.world/c/tech/p/1230082/how-a-cannabis-club-management-platform-left-1082680-member-records-985841-passport-scan

Archive link as the repo has been 404’d https://archive.ph/G7y8t

A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks aimed at government entities and critical infrastructure in Southeast Asia.

A ransomware group called World Leaks posted what it claims is data stolen from Tata Electronics, dumped on a dark web site accessible only through Tor. The listing describes 204,300 files totaling more than 630 gigabytes. Cybersecurity researchers who reviewed the data emails, SAP records, event logs going back years, and documents with footers reading “This document contains proprietary and confidential information of Apple Inc.” Other files carried Tesla’s own trade secret markings.

FortiBleed exposed how a Russian-speaking threat group quietly compromised around 75,000 Fortinet firewalls worldwide by abusing old credential leaks, infostealer logs, automated login testing, offline cracking, and compromised FortiGate devices. The campaign turned exposed firewalls into credential-harvesting nodes, creating a self-feeding access pipeline for future attacks and possible ransomware operations.

A single support ticket allegedly became the entry point for one of the biggest EdTech security incidents of 2026. The Canvas breach shows how stored XSS, weak session scoping, and missing browser-layer defenses can turn a routine help-desk workflow into a large-scale data exposure.

A newly disclosed Jenkins vulnerability, tracked as CVE-2026-53435, is now being actively exploited in the wild. The flaw allows an authenticated attacker with relatively low privileges to POST a malicious config.xml file, abuse Jenkins’ deserialization handling, and route requests through Stapler to access sensitive files on the Jenkins controller.