News

The article discusses a critical vulnerability, CVE-2026-52824, affecting the open-source time-tracking application Kimai, with a CVSS score of 9.1. The issue stems from a default APP_SECRET in the official Docker image, allowing unauthenticated attackers to…

The OpenSSL HollowByte vulnerability, discovered by the Okta Red Team, allows remote attackers to crash web servers with a minimal payload of just eleven bytes, leading to out-of-memory conditions. This flaw affects crucial server software like NGINX and…

The article discusses a critical vulnerability in NGINX that can cause worker crashes and potentially allow for remote code execution. It emphasizes the urgency of addressing this security issue, as it could be exploited by attackers to gain unauthorized…

The article discusses a coordinated supply chain attack named "SleeperGem", where malicious versions of three RubyGems packages—`git_credential_manager`, `Dendreo`, and `fastlane-plugin-run_tests_firebase_testlab`—were published to RubyGems.org. These…

The content discusses recent scans targeting Hikvision's Intelligent Security API (ISAPI) identified by Johannes Ullrich. Although Hikvision cameras have a history of vulnerabilities, a new scanning behavior was noted this weekend. The ISAPI, a REST-based…

The Security Affairs Malware Newsletter Round 106 features a collection of articles and research focusing on recent malware threats. Key highlights include: 1) 'CrashStealer' - a C++ infostealer disguised as a crash reporter for macOS. 2) 'Lucide Proxy' that…

The Security Affairs newsletter Round 586, authored by Pierluigi Paganini, highlights notable cybersecurity issues and updates from the past week. Key points include: OpenSSL fixed a memory exhaustion bug. A longstanding malware, Daxin, linked to China, was…

A zero-day exploit chain has been identified, targeting SonicWall SMA 1000 appliances, leading to the deployment of custom malware. The threat actor, referred to as UTA0533, exploited two vulnerabilities (CVE-2026-15409 and CVE-2026-15410) to gain root…

The article discusses a cyber threat involving the UAC-0145 group, which uses ClickFix CAPTCHAs to distribute malware targeting Ukrainian devices. The piece highlights the growing sophistication of malware techniques and the implications for cybersecurity.…

The article discusses the exploitation of zero-day vulnerabilities in SonicWall's SMA products, which allowed attackers to gain root access before a disclosure. It emphasizes the importance of securing network devices and software against such threats and…

The article discusses recently released public exploits targeting critical vulnerabilities in WordPress, specifically CVE-2026-63030 and CVE-2026-60137. These flaws allow remote code execution without authentication on default WordPress installations…

Okta's Red Team has disclosed a critical denial-of-service vulnerability in OpenSSL, named HollowByte, which can be exploited with an 11-byte payload. This flaw allows unauthenticated remote attackers to exhaust server memory, potentially leading to a…

The U.S. Department of Justice has lifted the ban on TikTok for federal workers, allowing them to download the app on government devices. This decision follows significant changes in TikTok's business structure, wherein it established the TikTok USDS Joint…

Hugging Face experienced a data breach on July 16, 2026, caused by a malicious dataset that exploited vulnerabilities in their data-processing pipeline. An autonomous AI agent executed the breach, accessing limited internal datasets and service credentials…

Meta is in early negotiations with AI startup Anthropic to lease computing power from its data centers, potentially valued at around ten billion dollars for a two-year term. This contract would involve flexible monthly payments and exit clauses, reflecting…

The article discusses the discovery of Daxin, a 13-year-old malware linked to China, found active in a Taiwan-based subsidiary of a multinational high-tech manufacturer. Symantec's Threat Hunter Team revealed that Daxin is a Windows kernel-mode rootkit first…

On July 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) included two critical vulnerabilities from Fortinet FortiSandbox and one from Microsoft SharePoint in its Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities…

Anthropic will implement significant changes to its Claude Fable 5 subscription model, effective July 20, 2026. The free tier will be eliminated, affecting Claude Pro and Claude Team Standard plans, which will require additional credits for continued use. In…

CVE-2026-6875 is a critical vulnerability in the ServiceNow AI Platform with a CVSS score of 9.5, allowing unauthenticated users to execute arbitrary commands, leading to a sandbox escape. It is actively exploited in the wild, requiring immediate patching to…

Cloudflare has implemented emergency WAF rules to block the critical wp2shell Remote Code Execution (RCE) vulnerability in WordPress, allowing attackers to gain unauthorized administrative access. Following reports from cybersecurity experts, WordPress has…

Microsoft has announced that it will gradually end support for Windows 10 versions 21H2 and 22H2 along with updates for OneDrive. Support for Windows 10 version 21H2 will end in August 2026, while version 22H2 will cease support by October 2028. Following…

The article discusses a critical vulnerability (CVE-2026-11386) in the Ubuntu Pro Client, reported on July 16, 2026, by Frederick Jerusha. This flaw allows arbitrary code execution with root privileges, scoring 9.0 on the CVSS scale. It affects multiple…

The page discusses critical vulnerabilities affecting WordPress, specifically CVE-2026-60137 and CVE-2026-63030, both of which involve SQL injection and a pre-authentication remote code execution risk. The vulnerabilities have a high severity rating, with…

The content reports on recent cyber attacks by the threat group APT-C-60 targeting organizations in Japan, utilizing spear-phishing techniques and malicious LNK files to deploy the SpyGlace backdoor malware. The campaign, linked to JPCERT/CC, involves…

On July 17, 2026, a critical remote code execution vulnerability (CVE-2026-63030) was disclosed in WordPress Core, allowing unauthenticated attackers to exploit a weakness via the REST API. The vulnerability affects WordPress versions 6.9.0 to 6.9.4 and…

Ernst & Young (EY) announced a data breach involving a compromised third-party IT support ticket system, which contained client documents, including tax information. The breach was detected on April 23, 2026, and unauthorized access occurred between March 28…

A new vulnerability in the WordPress core, named wp2shell, allows unauthenticated attackers to execute code remotely. This flaw highlights significant security risks associated with unpatched WordPress installations. Web security experts urge users to update…

The content discusses a newly identified vulnerability in OpenSSL, termed the 'HollowByte flaw,' which can lead to server memory freeze when processing 11-byte TLS requests. The article emphasizes the importance of addressing this security risk to prevent…

Cloudflare has implemented new Web Application Firewall (WAF) protections for two critical WordPress vulnerabilities: a Remote Code Execution (RCE) vulnerability in the REST API and a related SQL Injection vulnerability. These vulnerabilities affect versions…

A major ransomware group, Inc, has exploited two zero-day vulnerabilities in SonicWall's Secure Mobile Access (SMA) appliances—CVE-2026-15409 and CVE-2026-15410. These vulnerabilities allow unauthorized access and remote code execution, enabling threat…

The article discusses the discovery of seven malicious npm packages that utilize blockchain command-and-control (C2) to deliver a Remote Access Trojan (RAT). It emphasizes the risks posed to the software supply chain and highlights the need for vigilance…

On July 14, 2026, Microsoft disclosed a critical remote code execution (RCE) vulnerability (CVE-2026-58644) affecting on-premises SharePoint Server products, with a CVSS score of 9.8. An unauthenticated attacker can exploit this vulnerability due to…

Nichirei Corporation, one of Japan’s largest food companies, experienced a cyberattack on July 13, 2026, disrupting its logistics and operations. The company, known for its frozen food products, confirmed that server outages were due to this attack and has…

The article discusses the emergence of a new botnet named NadMesh, which targets exposed AI services to steal cloud keys and Kubernetes tokens, posing significant security risks to organizations. Security experts warn that as AI becomes more prevalent,…

The article highlights the security risks associated with AI systems that interpret and execute commands without adequate oversight. A recent incident involving an autonomous AI agent demonstrated vulnerabilities related to 'authority laundering,' where…

The article discusses the GoldenEyeDog subgroup, which is linked to a breach involving DigiCert and the theft of code-signing certificates. It emphasizes the importance of malware and threat intelligence in cybersecurity, shedding light on the implications…

The article discusses the issue of scarcity scams, particularly focusing on the 'Mexican Cita Express' scam that targets citizens seeking expedited government services. As demand for limited government services rises, scammers exploit this by posing as…