OpenAI on Tuesday said a combination of its artificial intelligence (AI) models, including GPT-5.6 Sol and an "even more capable pre-release model," was behind the security incident that targeted Hugging Face's production infrastructure last week. The AI company said the models were operating with "reduced cyber refusals for evaluation purposes" that might otherwise limit their ability to
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 1:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
There are several cybersecurity companies that offer managed EDR services in 2026. Here’s what actually separates them, and who each one suits. Most successful cyber attacks begin with a breached laptop, a smartphone or a server. Over the past 15 years, endpoint detection and response (EDR) has gone from niche to a mainstream security solution. […] The post The 4 best managed EDR service suppliers (and how to choose) appeared first on Heimdal Security Blog .
VU#847406: Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
Overview Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious files, such as DLLs, in that directory. To mitigate this vulnerability, install Duplicati in the default C:\Program Files\ directory or update to the latest fixed version. Description Duplicati is a free, open-source backup solution that stores data across cloud and local storage platforms. On Windows, Duplicati is distributed as an MSI installer. By default, the installer deploys the application to C:\Program Files\Duplicati 2\ , where the directory inherits the standard protected ACLs provided by Windows. The following vulnerability affects Duplicati v2.3.0.1: CVE-2026-16157 During installation, the MSI registers a LocalSystem service that executes binaries from the Duplicati installation directory. When the default installation path under C:\Program Files\ is used, the directory is protected by the appropriate ACLs. However, if Duplicati is installed to a non-default location, the installer does not apply equivalent permissions to the installation directory. As a result, standard local users may have write access to files within the installation directory, allowing an attacker to place malicious files, such as DLLs, that may be loaded by the LocalSystem service, resulting in arbitrary code execution with elevated privileges. Impact A local attacker with write access to a non-default Duplica
VU#360868: Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability
Overview Version 3.5.8 of Analog Way's Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script. Description The Picturall Quad Compact Mark II is a compact, heavy-duty 8K media server developed by Analog Way for video playback and content management in professional audiovisual environments. The core firmware includes a maintenance script called create_local_installer.sh , and the default script permission allows the low-privileged user, picmedia , to execute it as root and without a password. An attacker creates a malicious Ext4 disk image that contains the file, picturall-version.txt , with a directory traversal string and a payload file. create_local_installer.sh reads input from picturall-version.txt when processing these attacker-supplied disk images. This input is not properly sanitized, allowing an attacker to supply directory traversal sequences. As a result, the attacker can manipulate the script to write files outside of the intended extraction directory and execute a malicious payload. Because the script executes with root privileges, this behavior enables arbitrary file writes to sensitive system locations such as `/etc/cron.d, a system directory in Unix/Linux operating system used to store system-wide task scheduling files. An attacker can then leverage this capability to execute arbitrary code with root privileges. Impact By exploiting this path traversal vulnerability, an attacker with local access to the device can write arbitrary files to privileged locations. This access allows modifica
Latest
Thursday, July 23
Well i recently saw this post on github , and wanted to ask can i get hired after learning all this in 3 months ? Also , i know that i have to get some practical projects . Overall i believe it will take around 6 months . Plus what certifications will i have to get ? I am a bit confused . I recently finished the n10 009 playlist of comptia network and going after security+ .
TL;DR: some addresses probe a CVE's exact exploit path weeks before an NVD entry or any public exploit tooling exists. We went through 30 million honeypot probes looking for them, built four checks to kill the false positives, and ended up with three actors we are confident about.
Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a
Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances. The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13,
Full report is available at [https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/](https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/) The exposed server at 198\[.\]245\[.\]53\[.\]26 gave a rare opportunity to compare two related Banana RAT branches through live infrastructure, sandbox telemetry, and recovered payloads. The older branch used ETW-themed paths, static Microsoft-looking names, and a typo-based pseudo-Microsoft C2 identity. The newer branch kept the same staging concept but moved to randomized install identifiers, better-structured SYSTEM persistence, and a WebSocket channel built around a hashed `testewin.com` subdomain. IoC: * 198\[.\]245\[.\]53\[.\]26 * [https://app.any.run/tasks/96796146-688f-4b12-894c-236dadab8413](https://app.any.run/tasks/96796146-688f-4b12-894c-236dadab8413)
A research on Machine Learning for detecting insider threat https://forms.gle/CaguUJEQAHFTHFBEA Thank u so much No PII will be collected and all survey are anonymous
There are several cybersecurity companies that offer managed EDR services in 2026. Here’s what actually separates them, and who each one suits. Most successful cyber attacks begin with a breached laptop, a smartphone or a server. Over the past 15 years, endpoint detection and response (EDR) has gone from niche to a mainstream security solution. […] The post The 4 best managed EDR service suppliers (and how to choose) appeared first on Heimdal Security Blog .
Google on Thursday announced a new way for users to sign-in to their accounts by letting them take a selfie video. The selfie for sign-in, per the tech giant, is another option on top of existing recovery methods to log in to an account, including an email address or a phone number. The idea is to use a video selfie as a way to regain access if a user ever gets locked out or doesn't have access
Hackers access Australian customers’ names, addresses, dates of birth, phone numbers and some bank account details, company says Follow our Australia news live blog for latest updates Get our breaking news email , free app or daily news podcast Origin Energy customers’ addresses, phone numbers and partial bank account data have been accessed in a hack, the company has confirmed. The firm has 4.8m customer accounts in Australia, providing electricity, fossil gas, LPG and internet services to homes and businesses. Continue reading...
RefluXFS, a new Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux can meet the conditions for exploitation. The company demonstrated the race
Many of the vulnerabilities fixed with the July 2026 Critical Patch Update were likely discovered by AI. [https://www.securityweek.com/oracle-patches-over-1400-vulnerabilities-with-quarterly-security-updates/](https://www.securityweek.com/oracle-patches-over-1400-vulnerabilities-with-quarterly-security-updates/)
Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass affecting the Check Point SmartConsole login process that allows an
Sunday-to-Monday onslaught fuels speculation over AI-assisted bug reports
Wednesday, July 22
Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here. All the reports and research below were published between July 13th - July 19th. You can get the below into your inbox every week if you want: [https://www.cybersecstats.com/cybersecstatsnewsletter/](https://www.cybersecstats.com/cybersecstatsnewsletter/) # Ransomware **The State of Ransomware 2026 (Sophos)** Now in its seventh straight year, this is the definitive look at ransomware trends worldwide. **Key stats:** * 79% of ransomware attacks start with an identity-based approach. * 67% of root causes across 661 incident response and MDR cases are identity-related. * 97% of victims where compromised credentials are identified as the root cause have MFA enabled in some form at the time of the attack. *Read the full report* [*here*](https://www.cybersecstats.com/r/c1d653b3?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* **Ransomware and Cyber Extortion in Q2 2026 (ReliaQuest)** ReliaQuest's Q2 numbers on ransomware activity. The big takeaway: The Gentlemen is the group everyone should be watching. Plus, it looks like Deadlock is back. **Key stats:** * The Gentlemen surged 588% quarter-over-quarter to 179 posts in Q1. * Deadlock emerged in June 2026 with 75 named victims in a single month, after being absent from public data-leak sites for 11 months. * The US absorbed 1,094 ransomware victim data leak posts in Q2, roughly 49% of observed activity and nine times the volume of the next country. *Read the full report* [*here*](https://www.cybersecstats.com/r/820ece66?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Vulnerability Management **The 2026 State of Vulnerability Remediation (Vicarius)** A look at how security leaders are fixing vulnerabilities. **Key stats:** * 79% of organizations experienced a security incident in the past 12 months involving a vulnerability that was already known and sitting in their inventory. * 75% of critical vulnerability responses initiate administrative workflows (like ticket creation or routing) rather than immediately fixing the underlying flaw. * 58% of all vulnerability remediation activities require direct human intervention. *Read the full report* [*here*](https://www.cybersecstats.com/r/0d914164?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # AI Security **AI Agents Are Entering Critical Workflows. Who's Governing Them? (JumpCloud)** AI agents are moving into real work, but 800 IT leaders admit governance hasn't caught up. **Key stats:** * More than 60% of organizations run AI agents in production. * Organizations have adopted fewer than one-third of standard AI governance and security practices. * The share of organizations requiring human review before high-risk AI actions dropped from 40% to 25% in six months. *Read the full report* [*here*](https://www.cybersecstats.com/r/2239f04e?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* **The AI Security Report 2026 (Check Point)** A breakdown of how AI has gone from cyber assistant to active attacker. **Key stats:** * High-risk enterprise AI prompts doubled over the year, increasing from about 1 in every 50 interactions to 1 in every 25 interactions. * The average organization runs ten AI applications per month. * Between 87% and 93% of organizations experienced at least one high-risk AI interaction each month. *Read the full report* [*here*](https://www.cybersecstats.com/r/7a575e6b?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* **The Year Agents Entered the Workforce (Straiker)** Straiker put AI agents through adversarial testing to see where they fail. **Key stats:** * More than 1,700 successful exploits occurred across production coding, productivity, and first-party AI agents during adversarial testing. * 36% of successful attacks on coding agents reached remote code execution on the developer's machine. * 91% of successful attacks on productivity agents ended in silent data exfiltration. *Read the full report* [*here*](https://www.cybersecstats.com/r/3cda6c05?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* **Rethinking AI's Impact on Cybersecurity Roles (ISC2)** ISC2 on how AI is changing the day-to-day of cybersecurity work. **Key stats:** * 89% of cybersecurity professionals report having experienced AI recommendations that lead to incorrect outcomes at their organizations. * 62% list over-reliance on AI as a top concern. * 50% say their organizations hold human decision-makers ultimately accountable when AI-recommended actions lead to incorrect outcomes. *Read the full report* [*here*](https://www.cybersecstats.com/r/3c2e0759?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Executive Risk **2026 Executive Trends Report (Nisos)** Scary insight into how exposed executives are on the internet. **Key stats:** * 100% of executives have breach data linking their name to at least one current email address. * 94% have at least one plaintext password exposed in breach data. * 94% have home addresses publicly linked to their name in public records or people-search sites. *Read the full report* [*here*](https://www.cybersecstats.com/r/32020b62?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Industry-Specific **Government Ransomware Roundup: H1 2026 (Comparitech)** Comparitech tracked ransomware attacks specifically against government entities in the first half of 2026. **Key stats:** * From January to June 2026, an average of one ransomware attack on a government entity occurred every day. * The median ransom demand in H1 2026 was $100,000, one-fifth of the H2 2025 median of $500,000. * The most prolific ransomware strains against government were The Gentlemen (22), Qilin (21), LockBit (14), APT73/BASHE (12), and INC (10). *Read the full report* [*here*](https://www.cybersecstats.com/r/26c4f375?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.*
Deep dive into a UAF in the bfs.sys Windows kernel minifilter driver patched in this month's Patch Tuesday.
Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more. Reports filed before that date, including those already in GitHub's growing triage queue, will retain the previous payout terms. GitHub said the
Microsoft admits SMS and voice MFA can’t stop AI attacks, mandates passkeys in Entra by February 2027
Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment. The high-severity flaw, tracked as CVE-2026-8933 (CVSS score: 7.8), impacts default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The disclosure comes as
VU#847406: Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
Overview Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious files, such as DLLs, in that directory. To mitigate this vulnerability, install Duplicati in the default C:\Program Files\ directory or update to the latest fixed version. Description Duplicati is a free, open-source backup solution that stores data across cloud and local storage platforms. On Windows, Duplicati is distributed as an MSI installer. By default, the installer deploys the application to C:\Program Files\Duplicati 2\ , where the directory inherits the standard protected ACLs provided by Windows. The following vulnerability affects Duplicati v2.3.0.1: CVE-2026-16157 During installation, the MSI registers a LocalSystem service that executes binaries from the Duplicati installation directory. When the default installation path under C:\Program Files\ is used, the directory is protected by the appropriate ACLs. However, if Duplicati is installed to a non-default location, the installer does not apply equivalent permissions to the installation directory. As a result, standard local users may have write access to files within the installation directory, allowing an attacker to place malicious files, such as DLLs, that may be loaded by the LocalSystem service, resulting in arbitrary code execution with elevated privileges. Impact A local attacker with write access to a non-default Duplica
Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over 314 million users, which, if exploited, could facilitate a silent hijack of a user's WhatsApp data. The shortcoming has been codenamed HermeticReader by Guardio Labs. It's officially tracked as CVE-2026-48294 (CVSS score: 7.4), with the vulnerability
I found and reported an authentication failure in the WPForms PayPal Commerce webhook, the webhook route being public was not the vulnerability as webhooks have to be publicly reachable so that PayPal can deliver events. The problem was what happened after the request arrived. In affected versions, the handler could process a supported event before establishing that PayPal was actually the sender. In my local lab, a forged event could change the state of a matching payment record. The expected order is: 1. Authenticate the sender 2. Validate the event 3. Change payment state The affected flow effectively performed steps 2 and 3 without first completing step 1. The issue was fixed in WPForms [1.10.0.5](http://1.10.0.5) and is tracked as CVE-2026-4986. Then came the part I found more interesting: triage told me I was reporter #11. That number does not prove exploitation, and it does not tell us the total number of people who found the vulnerability. It does establish a lower bound: at least eleven researchers independently converged on the same trust failure. The write up covers: \- the vulnerable code path \- my local reproduction \- why payload validation was not sender authentication \- the fallback listener \- the patch \- why duplicate reports may be useful rediscovery intelligence Full write-up: [https://blog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/](https://blog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/) Testing was limited to my own local environment. I am not claiming original CVE credit; I independently rediscovered and reported the issue. Disclosure: I wrote and performed the research, code review and local reproduction. I used an AI to help copy edit and organize the final article. Should duplicate report volume affect how urgently a vendor treats a vulnerability?
VU#360868: Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability
Overview Version 3.5.8 of Analog Way's Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script. Description The Picturall Quad Compact Mark II is a compact, heavy-duty 8K media server developed by Analog Way for video playback and content management in professional audiovisual environments. The core firmware includes a maintenance script called create_local_installer.sh , and the default script permission allows the low-privileged user, picmedia , to execute it as root and without a password. An attacker creates a malicious Ext4 disk image that contains the file, picturall-version.txt , with a directory traversal string and a payload file. create_local_installer.sh reads input from picturall-version.txt when processing these attacker-supplied disk images. This input is not properly sanitized, allowing an attacker to supply directory traversal sequences. As a result, the attacker can manipulate the script to write files outside of the intended extraction directory and execute a malicious payload. Because the script executes with root privileges, this behavior enables arbitrary file writes to sensitive system locations such as `/etc/cron.d, a system directory in Unix/Linux operating system used to store system-wide task scheduling files. An attacker can then leverage this capability to execute arbitrary code with root privileges. Impact By exploiting this path traversal vulnerability, an attacker with local access to the device can write arbitrary files to privileged locations. This access allows modifica
In a recent security assessment, we were unable to intercept the traffic originating from a WebView from an Android application. The application wasn’t using certificate pinning, nor was it configured in any special way that would prevent normal interception. When testing that same application on a different device, the traffic could be intercepted directly, confirming our belief that the issue was the device, not the application. TL;DR: Chromium now enforces
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's "get_log_file" endpoint ("/api/w/{workspace}/jobs_u/get_log_file/{filename}"). "The filename parameter is concatenated into
Security leaders who build fast, visible paths to AI adoption are becoming the most valued partners in their organizations. AI governance done right gives security teams the visibility they need, employees the tools they want, and CISOs the strategic influence they have earned. According to McKinsey's State of AI report, 76 percent of employees now use AI in some capacity at work, up from 55
OpenAI on Tuesday said a combination of its artificial intelligence (AI) models, including GPT-5.6 Sol and an "even more capable pre-release model," was behind the security incident that targeted Hugging Face's production infrastructure last week. The AI company said the models were operating with "reduced cyber refusals for evaluation purposes" that might otherwise limit their ability to
The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely. The CrowdStrike Global Threat Report estimates around 79% of attacks are malware-free, as threat actors rely on
Federal lawyers say anti-mask laws would endanger immigration agents, citing an ICE face-recognition art project that doesn’t actually work.
German and US law enforcement have taken down the core infrastructure of Kratos, described by German investigators as one of the world's most widely used criminal phishing kits, and Indonesian authorities arrested the man they say developed and ran it. In a joint announcement on Monday, the Frankfurt public prosecutor's cybercrime unit (ZIT) and Germany's Federal Criminal Police Office (BKA)
If you're running n8n Enterprise and using multi-issuer token exchange, you'll want to double-check your configurations today. CVE-2026-59208 just dropped, and it highlights a classic identity binding issue. Basically, if the setup is misconfigured, a user from one trusted issuer can be authenticated as a user from a completely different issuer. This isn't just a UI glitch. In an automation platform like n8n, impersonating another user means potential access to their workflows, stored credentials, and connected business systems. It’s a great reminder that validating a signature isn't enough—you have to bind the identity correctly. Review your token exchange setups to mitigate the risk and strengthen your identity posture before someone else's token unlocks your workflows. Read the full details here: [https://socradar.io/blog/cve-2026-59208-cross-issuer-impersonation-n8n/](https://socradar.io/blog/cve-2026-59208-cross-issuer-impersonation-n8n/) Anyone here running multi-issuer setups in their automation pipelines?
Cybersecurity researchers have discovered a NuGet typosquat that's unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it's designed to rig live game results on Digitain. The package, named "Newtonsoftt.Json.Net," masquerades as the Newtonsoft.Json library and is a trojanized fork. Seven versions of the package have been published to the
A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one of its tools returns pull request descriptions without a prompt-injection guardrail the company had
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV. Proxy SDK prevalence among smart TV apps for LG (webOS) and Samsung (Tizen OS) televisions. Image: Spur.us. On July 2, we featured research by the security firm Spur that examined the prevalence of residential proxy software development kits (SDKs) in smart TV apps. Spur found more than 42 percent of apps available for download on LG smart TVs include SDKs that turn one’s television in a proxy node indefinitely, and that more than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components. Responding to questions about Spur’s research, LG Senior Vice Presid
Tuesday, July 21
Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guarantees. 404 Media reported Tuesday that a fix for the issue was deployed by Apple on July 3, 2026, after more than a year, when it was disclosed to the company by Tyler Murphy, co-founder of EasyOptOuts. Hide My Email
America's AI Action Plan puts speed at the center of federal AI policy, reducing regulatory friction and accelerating adoption across government and industry. That same speed expands the AI attack surface just as fast, through new agents, APIs, and tool-calling chains shipped every week. Point-in-time pentests and quarterly assessments cannot keep pace with systems that change that often. AI security testing needs to run continuously and be backed by human-validated evidence. The post America’s AI Action Plan Is About Speed: AI Security Needs to Keep Up appeared first on Synack .
A new type of malware can worm deep into AI coding systems to steal data and logins—and can flip a “death switch” to destroy files and keep out real users.
Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to summarize a page could end in remote code execution. AWS has patched the issue, and no CVE has been
Google's DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber, a specialized artificial intelligence (AI) model built atop 3.5 Flash that's designed to discover, validate, and patch vulnerabilities quickly and efficiently. According to the tech giant, the model will be exclusively available to governments and trusted partners via CodeMender as part of a limited-access pilot
A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway
For 96 years, the World Cup has been a global phenomenon, uniting nations and communities through a shared love of sportsmanship. While its popularity is nothing new, what is novel today is how rare a truly collective global experience has become. In an era defined by microtrends and algorithmic bubbles, it is increasingly uncommon for people across most countries to engage in the exact same event. That is precisely the unifying power of the World Cup. Fans from all over the globe reshape their daily routines around these once-in-a-lifetime matchups and storylines — and because Cloudflare operates a global network with 330+ points of presence worldwide, we are in a unique position to see exactly how this global ritual reshaped the world’s online activity throughout June and July 2026. Cloudflare Radar tracks HTTP traffic, DNS, security, and more to highlight global Internet trends. In this blog post we’ll use that data to explore how the World Cup impacted global traffic patterns throughout the tournament’s run. How did the World Cup change our behavior online? To understand how traffic changes throughout a match, we had to establish what it is “normally.” One way to do this is by looking at raw request volumes, or the amount of traffic we see on our network per country. But these amounts vary per country (the amount of daily traffic in the United States is always a larger number than the traffic in Portugal), which makes it difficult to establish a globally applicable baseline. Instead, we defined "normal" using the median traffic of the four preceding weeks: a month-long window that provided a stable, per-minute reference and smoothed out day-to-day noise. We also wanted to know whether traffic rose or fell relative to that baseline, but a plain difference wouldn't let us compare a high-volume country against a low-volume one. Instead, we used the ratio of current to baseline traffic, expressed as a log₂ value
Desktop+ Lockscreen Animated Wallpaper Fully RE of WallpaperExtensionKit.framework private apis (Still Buggy)
Dealerships installed alarms in millions of vehicles—and left them in even if the buyer didn’t want them. Now researchers warn they can be hacked to unlock, track, and disable cars.
Presently sponsored by: CoreView: Misconfigurations in Microsoft 365 leave doors open. Scan your tenant for free. I reckon this week's video on how Claude is tying together info from UniFi, Home Assistant and the Pi-Hole is an absolute ripper. Or at least the concept is - if ever there was an actual value proposition for AI it's taking lots of noise and converting it into a useful signal. Or, sometimes, it's just helping you see the woods through the trees, and that's exactly what Claude helped me do last night when every Sonos unit in the house refused to connect to any music service. It only took Claude a moment to work out: "you know your Pi-Hole is dead, right?" Uh... I do now! Give it a go, it's pretty awesome (and the Pi-Hole came good with a power cycle on the PoE port).
Automation platforms such as n8n are often introduced as productivity tools: connect a few systems, automate repetitive work, maybe add some AI. Inside a corporate network, however, that framing is incomplete. A self-hosted workflow engine can reach internal systems, execute actions on behalf of users, and hold sensitive credentials. That puts it in the same category as a jump host or a CI/CD runner even though it is usually evaluated and deployed like an ordinary business application. That became very concrete during a recent assessment. A client asked us to pen-test their internal infrastructure, and on the scope list was something I’d only heard about secondhand: n8n, one of those tools that keep surfacing in conversations about AI-powered automation. I’d never touched it before, and I went in without assumptions. That turned out to be the right posture: what surprised me was not what n8n can do for productivity, but the gap between how it is presented and what it means to have one sitting inside a corporate network. That gap matters because the pressure to adopt these tools is real. The past two years have produced a relentless stream of platforms promising to transform how businesses work, and the message is often the same: automate faster, integrate more, add AI, or fall behind. But speed of adoption and depth of security evaluation rarely move together. Tools are integrated into production based on what they promise to enable, not on a clear understanding of what they can reach, execute, or expose. n8n is my worked example here because it is the one I assessed, but the pattern is general. Before deploying any platform of this kind, five questions decide whether it can be operated safely: Which systems can it reach?
With the new Intelligence Dashboard, pin any combination of CVEs, tags, countries, IPs, and GNQL queries into one persistent, always-current view.
Monday, July 20
Starting today, Cloudflare Internal DNS is generally available. Cloudflare Internal DNS provides authoritative and recursive DNS for private networks on the same global network and control plane customers already use for public DNS, Zero Trust, networking, and application services. Internal DNS — sometimes also referred to as private DNS — is one of the last pieces of enterprise infrastructure still managed separately from the rest of the network. Many organizations operate one platform for public DNS, another for internal DNS, and use cloud-native DNS services inside each cloud environment with separate security policies layered on top. None of these systems share a common control plane. Split-horizon DNS adds another layer of complexity, often requiring multiple DNS environments to remain synchronized so internal and external users receive different answers for the same hostname. When those systems drift, outages follow. With Cloudflare Internal DNS, you get a single platform to manage public and private DNS resources, enforcing DNS policies and gaining visibility across your entire DNS stack. For Enterprise customers, this is included with Cloudflare Gateway without any additional charge. Why customers are adopting Internal DNS Consolidate DNS operations . Public and private DNS run on one platform, with one API, one audit trail, and one place to set policy. The appliance refresh cycle and the scaling bottlenecks that came with legacy DNS go away. Simplify split-horizon DNS . Internal and external resolution are defined as separate views over shared zones, managed from a single control plane. There are no parallel systems to keep in sync, so there's
Regulated enterprises evaluating AI pentesting platforms should assess eight capabilities: FedRAMP Moderate authorization or higher, multi-framework compliance support, human-in-the-loop with agentic AI, verified zero-false-positive findings, bidirectional workflow integrations, self-service launch, auditable coverage visibility, and full offensive security platform capabilities. Vendors who can't clearly distinguish their AI from an automated scanner are likely selling exactly that. The post The AI Pentesting Platform Checklist for Regulated Enterprises appeared first on Synack .
A new **13Cubed** episode is out! In this episode, we'll look at a tool that can run multiple Volatility 3 plugins simultaneously, automating your memory analysis and saving you valuable time during investigations. Watch now: [https://www.youtube.com/watch?v=0GMTydimOP4](https://www.youtube.com/watch?v=0GMTydimOP4) More at [youtube.com/13cubed](http://youtube.com/13cubed)
A new toolkit for attorneys in Massachusetts targets the technologies police use—and conceal—to build criminal cases, from facial recognition to AI-written police reports.
A first-of-its-kind analysis found more than one in eight apps built for US service members carried foreign code—some from firms in nations the Pentagon designates as adversaries.
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Saturday, July 18
Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more.
Hello everyone, A few months ago I shared my open database of malicious browser extensions. I'm happy to say it has now grown to **over 500 malicious CRX samples**. It started as a small research project, but it's continued to grow as I discover and collect more malicious extensions. My goal is to make it a useful resource for researchers, students, and anyone interested in browser extension security. One thing I'm working on next is making the data easier to consume in other tools. At the moment I'm considering exposing it in formats such as: * JSON * CSV I'm also thinking about adding things like an API or threat-intelligence style feeds if people think they'd be useful. I'd love to hear your thoughts: * What format would you actually use? * Are there any security tools or platforms you'd like to integrate it with? * Is there any metadata you'd find useful that I'm currently missing? Repository: [https://github.com/GherardoFiori/MaliciousBrowserExtensions](https://github.com/GherardoFiori/MaliciousBrowserExtensions?utm_source=chatgpt.com) **Please remember these are live malicious browser extensions. Handle them with care.** Project: [https://exterminai.com/](https://exterminai.com/) Any feedback is appreciated. Thanks!
“Context bombing” tricks malicious AI agents into shutting down before they can do harm.
White House launches AI-driven "Gold Eagle" clearinghouse to centralize public-private vulnerability coordination
The White House recently announced the **Gold Eagle Initiative**, a new federal program designed to use AI to centralize, prioritize, and accelerate vulnerability patching across critical infrastructure, government agencies, and tech partners. Operating out of CMU's Software Engineering Institute, it essentially acts as an AI-driven **clearinghouse to fix security flaws** before threat actors can exploit them. Because let's face it, our current bug reporting and patching systems are absolute speed demons. It only takes a **lifetime** 🤦🏻♂️ or two to get a critical vulnerability acknowledged and fixed, so why change anything? Btw, my candid opinion about the status of current vulnerability reporting is painfully slow, so we desperately need a framework that actually moves at the speed of the threat landscape. I think this initiative is genuinely a good idea and a step in the right direction, though the announcement is still light on the exact technical implementation. I’m personally eager to see what will happen in practice, but it is definitely an impressive concept. What are your thoughts on this? Will an AI-coordinated pipeline actually help scale response times, or is it just going to generate massive noise and triage fatigue for overworked infosec teams?
Friday, July 17
Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress. The protections address an Unauthenticated Remote Code Execution (RCE) vulnerability in WordPress's REST API and a related SQL Injection vulnerability. The WordPress security team disclosed the vulnerabilities to Cloudflare before public release so that we could prepare protections for customers. Cloudflare has deployed the new rules to protect all customers, including those on free and paid plans, as long as their application traffic is proxied through the Cloudflare WAF. The rules were deployed at 17:03 UTC on July 17 2026. WAF protections reduce exposure while customers update, but they are not a substitute for patching. WordPress has released fixes in version 7.0.2, with backports to affected earlier branches: 6.9.5, 6.8.6, and 7.1 Beta 2 ( see release details ). Versions earlier than 6.8 are not affected. WordPress is treating this as its highest-severity, highest-priority class of issue and is forcing automatic updates to affected sites, so most sites will be updated automatically. We still recommend confirming that you are on a patched release or the backports for your branch and follow the guidance in the official WordPress security release announcement . What you need to know The vulnerabilities affect different parts of the request path: CVE-2026-60137: SQL injection. A vulnerability in WordPress version 6.8 and later allows crafted input to alter a database query. Rating High. CVE-2026-63030: Unauthenticated remote code execution. A vulnerability in WordPress version 6.9 and later allows an unau
A man from Florida got arrested, allegedly behind the PirateFI and Blockblasters Crypto stealer attacks. The second Game stole 150k from a cancer Patient. https://www.tomshardware.com/tech-industry/cyber-security/fbi-arrests-florida-man-in-steam-malware-investigaton-after-tracing-stolen-bitcoin-to-uber-eats-gift-cards
The City Attorney’s Office sent the tech giants cease-and-desist letters this week telling them to stop profiting from 13 “face-swap” apps that are overwhelmingly used to target women and girls.
If Microsoft Defender quarantines BrowserModifier:Win32/MediaArena on one of your endpoints, the alert reads like a win. Our SOC data says treat it as a live persistence incident instead. In the case we timed, the payload finished writing its persistence 21 seconds into execution. Quarantine didn’t complete until 29 seconds. By the time the alert fired, […] The post MediaArena malvertising: why a quarantine isn’t the end of the incident appeared first on Heimdal Security Blog .
Thursday, July 16
Overview A denial-of-service (DoS) vulnerability exists in some HTTP/2 server implementations that fail to adequately limit resource consumption when buffering response data under stalled flow-control conditions. A remote, unauthenticated attacker can trigger memory exhaustion and service interruption by using standard flow-control parameters such as SETTINGS_INITIAL_WINDOW_SIZE = 0 to stall outbound data for multiple simultaneous request streams. Description HTTP/2 is a widely used application-layer protocol that supports multiplexing, header compression, and flow-control mechanisms to regulate the transmission of data between web browsers and servers. Flow control is designed to prevent senders from overwhelming receivers and relies on client-advertised window sizes to determine the maximum volume of unacknowledged data that can be in transit at any given time. A client can intentionally stall outbound flow control by withholding WINDOW_UPDATE frames or by advertising SETTINGS_INITIAL_WINDOW_SIZE = 0 . In some HTTP/2 implementations, the server continues processing requests and generating complete response bodies even though it is unable to transmit them. The resulting response data remains buffered in memory, and each stalled stream retains its allocated buffer until the connection closes or a timeout occurs. An attacker can exploit this behavior by opening many simultaneous streams and requesting large resources, causing the server to accumulate large amounts of buffered response data. In environments with permissive resource limits, this can lead to excessive memory consumption, swap exhaustion, service instability, and, in severe cases, system crashes. Even under more conservative limits, the attack can exhaust worker or connection resources and de
Most security teams underestimate what it costs to build an AI pentesting solution in house. People, AI token costs, infrastructure, and compliance gaps add up faster than the initial business case accounts for, and the hidden bill usually arrives in year two. I’ve been hearing the same question from security leaders lately. They’re all asking […] The post The Hidden Costs of Building an AI Pentesting Solution appeared first on Synack .