ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
AI safety systems trained primarily in English lack equivalent safeguards in low-resource languages like Welsh and Maltese, where training data and human raters are scarce. This creates a vulnerability gap across Europe's multilingual population, allowing harmful requests to bypass protections that
UAC-0099 is using a fake Notepad++ plugin to deliver malware, exploiting trust in the widely-used editor. The shift from WinRAR exploits to social engineering makes the threat harder to detect.
Rockwell ThinManager's path traversal bug (CVE-2026-11917) allows authenticated attackers to write arbitrary files to restricted directories, threatening factory floor HMI and PLC systems. The CVSS 8.1 vulnerability requires valid credentials but poses significant risk to industrial control environm
Laundry Bear exploited a Zimbra vulnerability that executes malware when users preview emails—no clicking needed. Zimbra patched it silently in November 2025 without disclosure.
Four critical vulnerabilities in widely-deployed libIEC61850 (IEC 61850 power grid standard) enable remote code execution on unpatched substations. CVE-2026-49035, a heap buffer overflow, exploits many embedded devices lacking ASLR protection, allowing unauthenticated attackers to compromise protect
Johnson Controls' XAAP fire safety app stores sensitive data in plaintext (CVE-2026-34490), exposing credentials to anyone with device access. Lost technician tablets become full data disclosures—a real risk in industrial environments despite the low CVSS rating.
LAUNDRY BEAR exploits Zimbra zero-day CVE-2025-66376 triggered by viewing emails—no clicks needed. The attack silently exfiltrates 90 days of email and contact directories, then establishes persistent backdoor access to compromised accounts.
Weintek HMI flaws let low-privilege users escalate to full admin control via weak sessions and plaintext passwords. CVSS 8.8, network-reachable, trivial to exploit—serious industrial equipment risk.
Russian spies exploited a Zimbra XSS vulnerability triggered simply by opening email, stealing 90 days of messages, contact directories, passwords, and 2FA recovery codes. The recovery codes are the critical piece—they bypass two-factor authentication when credentials are already compromised, leavin
Bing ads promoted fake Claude installers containing SectopRAT malware to developers and IT staff. Attackers used legitimate-looking domains to exploit search result trust and steal credentials and cryptocurrency wallets.
Chick-fil-A One accounts fell to credential stuffing, exposing names, addresses, and payment data. Attackers harvested identity components for fraud and drained stored balances.
**Summary:** Microsoft 365 infrastructure failed on July 23, disabling Teams, SharePoint, Copilot Chat, and the Admin Center across North America starting 10:44 AM ET. Downdetector recorded 2,403 peak reports (80× normal baseline). Microsoft identified the root cause by 1:55 PM ET and deployed miti
Sandworm delivers malware through fake Notepad++ bundles containing trojan plugins that exploit the app's auto-loading feature. Developers dispute the CVE, arguing it's design-as-intended, not a vulnerability—highlighting a modern security challenge where legitimate features become attack surface.
Russian state-sponsored Laundry Bear exploited a Zimbra XSS flaw that stole credentials and 2FA tokens on email view. No click required—just viewing an HTML email triggered the attack.
The White House launched Gold Eagle, an AI-powered federal system admitting Patch Tuesday is dead. Exploits now arrive before patches (negative 7-day window), forcing AI-driven vulnerability response to match AI-assisted threats.
A ChatGPT vulnerability let attackers secretly embed autonomous agents in victims' accounts via malicious links. The invisible agent executes email-commanded tasks with legitimate tokens, leaving no forensic trace.
SharedRoot vulnerability allows Claude Cowork agents to read SSH keys and credentials. Root cause: host filesystem mounted read-write into the agent VM, combined with a Linux kernel exploit (CVE-2026-46331).
Researchers found flaws in Microsoft's passkey implementation that let attackers impersonate privileged users. The vulnerability stems from weak validation of assertions, not faulty cryptography.
Confidential computing matured for production use until AI agents introduced a problem: reasoning data that spans multiple steps with external calls, breaking traditional three-state protection.
RefluXFS (CVE-2026-64600) is a 9-year-old race condition in Linux's XFS filesystem that lets any local user become root on RHEL by writing to privileged files, with persistent impact that survives reboots.
The EU fined Google €890M for gatekeeping Android's search and app store under the Digital Markets Act. Mandated remedies—app store neutrality and interoperability—will reshape Android's security architecture affecting hundreds of millions of users.
Attackers injected malicious workflows into a compromised PHP developer's GitHub account. These ran on GitHub's own infrastructure to exploit CVE-2026-41940 in cPanel servers, harvesting credentials and API keys without targeting the PHP packages themselves.
**RefluXFS (CVE-2026-64600):** A 9-year-old XFS race condition lets unprivileged users silently overwrite root files via reflink + O_DIRECT writes, bypassing SELinux and other hardening at the block layer. Attacks are highly reliable, leave no traces, and survive reboot.
Critical zero-day in Check Point's SmartConsole (CVE-2026-16232) allows unauthenticated attackers to gain full admin access and control firewall policies, logging, and security architecture. Active exploitation confirmed targeting internet-exposed management platforms.
Check Point's SmartConsole auth bypass (CVE-2026-16232) allows unauthenticated attackers to gain admin access and rewrite security policies across all gateways. CISA mandated patches within 72 hours.
Microsoft quarantined legitimate Exchange Online mailboxes after a memory-overload bug—the fourth incident in 18 months. Users lost email and calendar access; remediation sits at 72% complete with no end in sight.
CVE-2026-16232 is a critical SmartConsole bypass (CVSS 9.3) allowing unauthenticated admin access to enterprise firewalls. Active exploitation enables attackers to modify firewall rules and steal VPN credentials. Patch immediately.
A malicious worm exploits AI coding assistants through npm packages, disguising attacks as normal development work. Security analysis found only 2 of 14 malicious behaviors produced reliable alerts, making it nearly undetectable against current defenses.
GitHub cuts public bug bounties in half—critical findings drop from $20,000-$30,000 to $10,000. Higher rewards now require an invite-only VIP membership, signaling how AI is reshaping vulnerability economics.
Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over 314 million users, which, if exploited, could facilitate a silent hijack of a user's WhatsApp data. The shortcoming has been codenamed HermeticReader by Guardio L