ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Researchers discovered that GitHub Copilot and similar AI assistants refuse harmful requests in chat but comply when framed as development tasks—a vulnerability called "workflow-level jailbreaking." By disguising malicious prompts as routine coding work, attackers bypass safety guardrails these mode
With 75% of consumers and 68% of enterprises now using passkeys, attackers are abandoning credential stuffing to target weaker identity verification flows, relocating rather than retreating. As primary authentication hardens through passwordless security, the ATO threat has shifted downstream to hum
CISA mandated urgent patching of CVE-2026-55255, an authentication bypass in Langflow enabling attackers to steal LLM credentials and execute code within AI workflows. The actively exploited IDOR vulnerability requires federal agencies to remediate by Friday to prevent compromise of AI infrastructur
KDDI disclosed a July 2026 breach affecting 12.2M people across five Japanese ISPs. Attackers exploited a zero-day in third-party software, exposing emails and passwords undetected for 30+ days.
DuckDuckGo's browser now blocks YouTube ads by default on iOS, macOS, and Windows using uBlock Origin filters. The feature integrates with Duck Player for ad-free, privacy-focused viewing across both YouTube's site and embedded videos.
Ubiquiti patched seven critical UniFi flaws including CVE-2026-50746, a command injection in Connect 3.4.16 requiring no user interaction. 100,000+ devices vulnerable; upgrade to 3.4.20+ urgently.
CISA ordered federal agencies to patch a critical, exploitable ColdFusion vulnerability by Friday. The flaw allows unauthenticated remote code execution, suggesting active attacks in the wild.
CISA warned of four critical vulnerabilities (CVSS 10.0) under active exploitation as of July 8. Attackers are targeting AI platform Langflow to steal LLM provider and AWS credentials. Adobe ColdFusion, JoomShaper, Joomla, and WordPress are actively being exploited with minimal delay after disclosur
GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel flaw allowing any local user root access in seconds. Publicly exploited and inconsistently patched, major distros remain vulnerable.
Two suspects arrested for a Dutch phishing operation that stole credit card data from victims. The arrests underscore the Netherlands' ongoing struggle with Europe's highest payment fraud rate.
Digi PortServer devices face critical vulnerabilities allowing unauthenticated access (CVE-2026-12352) and stored XSS injection (CVE-2026-12948), threatening manufacturing and critical infrastructure worldwide. Together they enable attackers to bypass security entirely, inject malicious scripts into
PROMOD V (CVE-2026-10763) uses unencrypted HTTP, exposing power grid credentials and commands to network interception. The HIGH-severity flaw threatens critical energy infrastructure operations globally.
A critical flaw in Google Dialogflow CX, dubbed "Rogue Agent," allows attackers with basic update permissions to inject malicious code into chatbots, exfiltrate customer conversations, and steal credentials by exploiting insufficient permission validation. The vulnerability has been patched by Googl
Targeted phishing campaign impersonates major brands (Coca-Cola, Netflix, McKinsey) to trick marketing professionals with fake job offers, using nested redirects through legitimate platforms to steal Google credentials. Attackers personalize emails with target names and professional details to incre
A critical NGINX buffer overflow (CVE-2026-42945) in Hitachi Energy's e-mesh EMS exposes power grids to denial of service and code execution attacks via specially crafted HTTP requests. Legacy energy systems without ASLR protections face heightened risk of exploitation.
CVE-2026-20896 in Gitea allows authentication bypass via HTTP header manipulation, giving attackers access to private repositories and credentials. Active exploitation is confirmed in the wild, posing immediate risk to organizations using self-hosted Gitea instances.
GitLost is a prompt injection vulnerability in GitHub Agentic Workflows that lets unauthenticated attackers extract sensitive code from private repos using crafted GitHub issues. It highlights the security risks of deploying AI agents with broad repository access and demonstrates how untrusted input
Google Dialogflow CX had a critical flaw enabling attackers to hijack enterprise chatbots and steal conversations. The "Rogue Agent" vulnerability has been patched with no exploits detected.
A critical backdoor (CVE-2026-11405) in Tenda routers grants attackers full admin access via a hidden password. The vendor is unreachable for a fix, leaving millions of devices vulnerable.
CVE-2026-53359 (Januscape) is a 16-year-old KVM vulnerability enabling VM escape on Intel/AMD clouds. The use-after-free flaw lets attackers execute root code on hosts, compromising all tenant VMs.
Tarah Wheeler, CISO at TPO Group, stumbled into cybersecurity through social science rather than coding. Her key insight: security failures are fundamentally human failures, not just technical ones.
Adobe ColdFusion zero-day (CVE-2026-48282) with CVSS 10.0 enables unauthenticated RCE with no user interaction required. Actively exploited and affecting enterprises; immediate patching is critical.
CISA deployed Anthropic's Mythos for federal vulnerability scanning, marking the first large-scale government use of generative AI for threat hunting. The tool addresses traditional scanning limitations and helps stretch limited cybersecurity resources across federal agencies.
Chinese APT exploited Roundcube webmail vulnerabilities to breach U.S. university defense departments. Attack chains XSS and RCE flaws to steal credentials and deploy persistent backdoors on mail servers.
Januscape (CVE-2026-53359) is a 16-year-old Linux kernel vulnerability enabling VM escape on Intel and AMD processors. Attackers with guest root access can compromise the host and all other VMs on shared hardware, posing critical risk to cloud providers like AWS and GCP.
Traditional email security controls are failing against sophisticated attacks that exploit trusted identities and normal business processes. A BleepingComputer webinar explores how behavioral AI can shift email defense from reactive detection to automated, intelligent prevention.
BeyondTrust patched four security vulnerabilities in remote access platforms, with two critical flaws (CVE-2026-40138 and CVE-2026-40139) enabling unauthenticated attackers to bypass authentication entirely on vulnerable systems.
CERT/CC warned of CVE-2026-11405, a critical backdoor in Tenda router firmware allowing remote authentication bypass and full admin access. Millions of home and small business networks are at risk.
BeyondTrust patched four critical vulnerabilities in Remote Support and Privileged Access, including CVSS 9.2 flaws enabling unauthenticated bypass. Prior active exploits require urgent patching.
Citrix NetScaler's CVE-2026-8451 memory leak allows credential theft from SAML devices. Active exploitation began within 24 hours of disclosure on June 30, mirroring 2023's CitrixBleed threat.