ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Cribl acquired CardinalOps to add AI-driven detection engineering to its security platform, enabling organizations to map their security controls against MITRE ATT&CK and identify coverage gaps. The move helps CISOs demonstrate comprehensive threat detection coverage and operationalize security tele
Cursor AI's critical 2-click vulnerability lets attackers install malware and steal secrets from developers at 64% of Fortune 500 companies through flaws in Git and MCP server handling. The flaw exposes a blind spot: AI tool security remains overlooked despite widespread enterprise adoption.
Approved marketing tags silently load unauthorized third-party code that vendors chain together. This "Approval Gap" means unauthorized scripts access user data with zero audit trail or visibility.
Researcher Chaotic Eclipse released an exploit for a Windows User Profile Service flaw (LegacyHive) hours after Patch Tuesday, enabling privilege escalation to SYSTEM on unpatched systems. This near-immediate disclosure compounds risk for organizations still assessing patches in multi-user environme
Critical browser vulnerabilities with public exploits affect Firefox and Chrome. Two Firefox flaws—a JavaScript engine vulnerability and site isolation bypass—enable arbitrary code execution and cross-site data theft, requiring immediate patching.
An automated AI system combines LLMs and code analysis to discover zero-days at scale, already finding WordPress vulnerabilities. Security teams now face an asymmetric threat environment.
Gold Eagle is an AI-driven federal initiative to coordinate vulnerability detection and remediation across critical infrastructure, combining government agencies, open-source maintainers, and private-sector partners. It targets patching backlogs that leave power grids, water systems, and communicati
ServiceNow, Ivanti, and Fortinet released patches for 15 critical vulnerabilities. ServiceNow AI's unauthenticated RCE (CVE-2026-6875) is the most critical—attackers can execute code without credentials.
Cursor IDE executes arbitrary code from `git.exe` placed in repository roots without user confirmation. Opening an infected repo grants attackers full access to developer credentials and source code.
Three critical SharePoint vulnerabilities enable remote code execution and IIS key theft in active attacks across 800+ unpatched instances. Federal agencies must patch by July 17, 2026, or discontinue affected systems under CISA's binding directive.
Industrial control vendors released critical patches in July 2026, including a perfect CVSS 10.0 authentication bypass in Siemens OpenCenter X. Multiple critical flaws across Rockwell, Schneider, and other OT products create urgent remediation pressure for infrastructure operators.
Microsoft paused Windows 11 security update KB5101650 for Dell PCs after it caused unexpected shutdowns and battery drain due to an Intel driver incompatibility. The issue stems from a new USB-C Connection Manager interface that conflicts with Intel's thermal management driver.
Google and Mozilla released urgent browser updates (Chrome 150, Firefox 152) fixing critical vulnerabilities including RCE and sandbox escapes. Proof-of-concept exploits for Firefox are already public; immediate patching across all platforms is essential to prevent compromise.
SonicWall warns of two actively exploited zero-day vulnerabilities in SMA1000 remote access appliances: CVE-2026-15409 (SSRF) and CVE-2026-15410 (code injection). Enterprises must patch immediately.
Two critical SonicWall SMA 1000 zero-days enable unauthenticated remote takeover. CVE-2026-15409 rates 10.0 CVSS with no auth needed. Exploitation confirmed.
**Summary:** Active exploitation of SharePoint Server vulnerabilities enables unauthenticated remote code execution across all supported versions, with attackers chaining multiple CVEs to establish persistence and steal credentials. CISA has declared the exploits as known-exploited vulnerabilities
ABB T-MAC Plus 4.0-24 has four critical vulnerabilities (CVSS 9.9) allowing privilege escalation and data theft in manufacturing systems. Authenticated users can execute admin functions without elevated credentials; upgrade to 4.0-25 immediately.
CVE-2026-31431 ("Copy Fail") allows local privilege escalation to root on ABB Edgenius gateways (CVSS 7.8). Containerized deployments risk container escapes enabling lateral movement into industrial systems.
Adobe released patches for 88 vulnerabilities, including eight critical ColdFusion flaws enabling code execution and privilege escalation. The Priority 1 update demands immediate deployment.
Microsoft released 622 vulnerabilities in July—a record—including two actively exploited zero-days: AD FS privilege escalation (CVE-2026-56155) and unauthenticated SharePoint RCE (CVE-2026-56164). Both enable rapid enterprise compromise and pose immediate critical risk to organizations worldwide.
Microsoft's record July 2026 Patch Tuesday includes 622 CVEs (3 zero-days, 2 actively exploited), driven by AI-assisted vulnerability discovery. The volume creates an unprecedented triage crisis, with organizations unable to comprehensively patch all vulnerabilities and forced to make strategic patc
Vendor failures cascade through supply chains; managing hundreds of interconnected dependencies while maintaining security visibility and governance at scale remains the core enterprise challenge.
Researchers found that 6 GHz Wi-Fi frequency coordination systems trust unverified client location and time data, potentially allowing attackers to spoof signals and disrupt critical cellular and emergency infrastructure. No active attacks documented, but fundamental architectural flaws need fixing
Microsoft released a record 622 patches including two actively exploited zero-days: CVE-2026-56164 in SharePoint and an AD FS flaw. Both enable unauthenticated privilege escalation in critical infrastructure.
SonicWall SMA1000 appliances face active exploitation of two critical flaws: an unauthenticated SSRF and authenticated RCE. Federal agencies must patch by July 17, 2026, or discontinue use.
Microsoft released 570 patches in July—nearly 3× the prior month—driven by AI-accelerated vulnerability discovery, signaling that rapid patch cycles are now the norm. Three zero-days in Active Directory, SharePoint, and BitLocker are already exploited, making continuous patching mandatory for enterp
A vulnerability in Claude for Chrome allows malicious extensions to access Gmail, Google Docs, and Calendar without user consent by pivoting through Claude's connected services. The flaw represents a significant escalation in browser extension threats, creating an unauthorized bridge between extensi
SAP patched critical CVE-2026-44747 (CVSS 9.9) in NetWeaver ABAP—a memory corruption flaw allowing authenticated attackers to corrupt data, exfiltrate records, or maintain persistence on affected ERP systems.
Microsoft released KB5099539, patching 570 Windows 10 vulnerabilities including remote code execution and privilege escalation flaws. The massive patch cycle reflects ongoing security debt in the aging OS, now in extended support after its October 2025 mainstream support end.
Progress confirmed a path traversal vulnerability in ShareFile Storage Zone Controllers (5.x/6.x) allowing authenticated admins to access sensitive files. No breaches confirmed. Patches released (5.12.5 and 6.0.2); immediate deployment urged.