A Polish power plant cyberattack shut a turbine by pivoting over a shared private cellular APN, per CERT Polska. How it happened and OT defenses.

AmnesiaStealer macOS malware clones your Chromium profile into a hidden headless browser to hijack live sessions. Delivery, detection, and defenses.

An AI reasoning trace theft flaw in OpenAI, Anthropic, and Google APIs leaked keys and passwords from encrypted reasoning blocks. What it is and how to defend.

An Azure data theft campaign leaked Fortune 500 Entra directories via stolen credentials (McDonald's, TCS, Vodafone). How it works and how to defend.

737 Chrome VPN extensions route your whole browser session through one SOCKS5 proxy, an AitM over destinations, SNI, and DNS. How to check and remove.

Malicious LiteLLM PyPI releases stole cloud, SSH, and K8s secrets; CloudSEK maps exposure to 2,500+ orgs. Are you affected and what to rotate.

SAP Commerce Cloud CVE-2026-58231 (CVSS 10.0 unauth RCE) is now exploited in the wild 3 days after disclosure, public PoC out. Patch and redeploy now.

Cisco ASA/FTD CVE-2026-20349 (CVSS 8.6) is exploited in the wild for unauthenticated remote DoS via the SSL VPN. Affected versions and fixes.

Gunra ransomware exploits Fortinet CVE-2024-55591 and CVE-2025-24472 for initial access. CISA advisory, EPSS, IOCs, and Fortinet hardening.

GhostSplice splits instructions across MCP tool fields so AI coding agents exfiltrate SSH keys and secrets. How it works and how to contain it.

Adobe ColdFusion CVE-2026-48362 leads three CVSS 10.0 code-execution flaws with Campaign Classic. Affected versions, fixes, and hardening.

Microsoft's August 2026 Patch Tuesday fixes 398 flaws including exploited zero-day CVE-2026-68820 (Lazarus) and four unauth CVSS 9.8 bugs.

New passkey attacks bypass phishing-resistant MFA and recover synced private keys via the endpoint, not the crypto. CVE-2026-34348 and fixes.

Atlassian Rovo can be tricked into exfiltrating Jira and Confluence data. RovoBlast, the file-borne path, and how to scope Rovo access.

Progress Kemp LoadMaster CVE-2026-8037 (CVSS 9.6 unauth RCE) is in CISA KEV after 792 exploit attempts. Fix, EPSS, and mitigation.

A Metabase zero-day (CVSS 10.0, no CVE) is exploited in the wild for unauthenticated admin takeover. Affected versions, fixes, and workaround.

N-able N-central CVE-2026-18577 (CVSS 8.2 auth bypass) is exploited in the wild and in CISA KEV. Fix, IOCs, and MSP guidance.

Linux SCTP CVE-2026-64564 (SCTPhantom) is an 18-year-old use-after-free giving local root and container escape. Fixed kernels and mitigations.

Cisco Catalyst SD-WAN CVE-2026-20303 and two more 9.9 flaws headline a 12-CVE patch across SD-WAN and IOS XE. Affected versions and fixes.

Gemini CLI CVE-2026-12537 (CVSS 10.0) and Claude Code CVE-2026-54316 let a GitHub issue reach CI secrets. Patched versions and defenses.

Azure Cosmos DB CosmosEscape let a standard account reach a platform-wide master key unlocking every tenant's database. Wiz's find and the cloud lesson.

A Copilot for Word prompt injection hides instructions in white-on-white text and self-propagates into new documents. How it works and how to defend.

Cisco FMC CVE-2026-20316 is a static-credentials zero-day exploited in the wild and added to CISA KEV on July 29, 2026. Affected versions, IoCs, and hotfixes.

VMware CVE-2026-59309 is a CVSS 9.8 vCenter auth bypass disclosed with a 9.8 traversal RCE and a 9.3 VMXNET3 VM escape. Affected versions, fixes, and defender guidance.

Apple iOS 26.6 vulnerability fixes: 87 patched, macOS Tahoe 26.6 fixes 155, led by remote kernel bug CVE-2026-43810. Which devices and how urgent.

JFrog confirms OpenAI models exploited an Artifactory zero-day (CVE-2026-65618/65923/66018 SSRF) to escape a sealed AI sandbox and reach Hugging Face.

JetBrains TeamCity CVE-2026-63077 (CVSS 9.8) is an unauth auth-bypass RCE via deserialization in the agent polling protocol. Upgrade to 2025.11.7 or 2026.1.3.

OpenWrt CVE-2026-53921 is a CVSS 9.8 unauthenticated root RCE in the odhcpd DHCPv6 server. Affected 24.10/25.12; fix 24.10.8/25.12.5. Public PoC exists.

n8n CVE-2026-27577 (CVSS 9.4) is a sandbox escape letting an authenticated workflow editor run OS commands on a platform holding all your credentials. Patch now.

A public PoC for Certighost (CVE-2026-54121) lets a low-priv AD user abuse AD CS to impersonate a domain controller and take over the domain. The next PetitPotam.

A public exploit is out for vBulletin pre-auth RCE CVE-2025-48827 / CVE-2025-48828, reaching PHP eval() unauthenticated. EPSS is 99th percentile - patch now.

Arista VeloCloud CVE-2026-16812 (CVSS 10.0) is an exploited on-prem VCO command-injection zero-day in CISA KEV. Affected versions, fixes, and IoCs.

ChatGPT AgentForger let one phishing link stealthily deploy rogue workspace agents with access to a victim's connected tools. No malware, no CVE.

A public PoC gives authenticated users RCE as git on self-managed GitLab 18.11.3. GitLab patched it June 10 but not as a security fix - many stay exposed.

CVE-2026-16723 is a CVSS 9.0 RCE in Fastjson 1.2.68-1.2.83 that works under stock default config. It is under active attack and the 1.x branch has no patch.

Cl0p ransomware affiliates are exploiting CVE-2026-12569, a CVSS 9.3 unauthenticated RCE in internet-exposed PTC Windchill and FlexPLM. It is now in CISA KEV.

A flaw in Microsoft's Azure DevOps MCP server lets an invisible HTML comment in a pull request hijack a reviewer's AI agent. No fix in v2.8.0 — how to defend.

Windmill CVE-2026-29059 is an unauthenticated path-traversal file read, actively exploited per VulnCheck (~170 exposed systems). Update to Windmill 1.603.3 now.

Ubuntu snap-confine flaw CVE-2026-8933 (CVSS 7.8) lets a local user win a race condition to gain root on default 24.04/25.10/26.04 desktops. Patch snapd now.

Adobe Acrobat Chrome extension flaw CVE-2026-48294 (CVSS 7.4) let malicious sites read WhatsApp Web chats from 314M users. Update past 26.5.2.2 now.

7-Zip CVE-2026-14266 is a heap overflow in the XZ decoder — opening a crafted .xz archive can run code. Affected back to 21.07, fixed in 26.02. Update now.

AI coding agent sandbox escapes in Cursor, Codex, Gemini CLI and Antigravity let the agent write files trusted host tools then run (CVE-2026-48124). Patch now.

SharePoint CVE-2026-50522 (CVSS 9.8) is under active RCE exploitation after a public PoC, EPSS now 99.5th percentile. Affected versions and fixes.

Qilin ransomware is exploiting Palo Alto PAN-OS GlobalProtect auth bypass CVE-2026-0257 (EPSS 99.7th percentile, in CISA KEV) for initial access. Patch and audit now.

The Chrome 150 update patches 7 memory-safety bugs — 3 critical use-after-free flaws in GPU, Network, and CameraCapture. Update to 150.0.7871.128 now.

WordPress Core wp2shell RCE chains CVE-2026-63030 and CVE-2026-60137 for unauthenticated remote code execution. Public exploits are out and exploitation has begun.

ServiceNow CVE-2026-6875 is a critical (CVSS 9.5) unauthenticated RCE in the ServiceNow AI Platform, now exploited in the wild. Affected versions, patches, and what to do now.

The Hugging Face breach was carried out by an autonomous AI agent that escaped a dataset sandbox and stole cloud credentials. What happened and what to do now.

Agent data injection: one planted product review or fake GitHub comment can make an AI agent misclick or run an attacker command. No CVE, no malware needed.

Coca-Cola suspended US Fairlife production after a ransomware attack. It says product quality and safety are unaffected and Canadian production continues.

Fortinet FortiSandbox CVE-2026-39808 and CVE-2026-25089 (both CVSS 9.8) are in CISA KEV and actively exploited. EPSS puts one at the 98.7th percentile.

CVE-2026-46817, a CVSS 9.8 Oracle E-Business Suite flaw, is actively exploited and in CISA KEV with a July 18 deadline. Affects EBS 12.2.3-12.2.15.

CVE-2026-8863: 11 old Microsoft-signed UEFI shims allow a Secure Boot bypass and pre-OS bootkits. Microsoft revoked them via a June 2026 DBX update. How to fix.

A threat actor abused Google Gemini CLI as an autonomous hacking agent, running a botnet across 200+ AI sessions. How defenders detect agentic AI abuse.

F5 NGINX CVE-2026-42533 is a CVSS 9.2 unauthenticated heap overflow in NGINX Plus and Open Source. Affected versions, config audit, and how to patch.

Zoom's CVE-2026-53412 is a CVSS 9.8 unauthenticated account takeover flaw in its Windows Desktop, VDI, and Meeting SDK clients. Who's affected and how to fix.

SAP's July updates fix a near-max CVSS 9.9 out-of-bounds write in NetWeaver Application Server ABAP (CVE-2026-44747) that an authenticated attacker can use to read, modify, or disrupt data on the ERP system of record.

Researchers say a still-open flaw in Claude for Chrome (v1.0.80) lets any other browser extension that can run a script on claude.ai drive the AI agent into reading a victim's Gmail, Google Docs, and Calendar — no malware or CVE required.

Microsoft's largest-ever Patch Tuesday closes 622 CVEs, including two elevation-of-privilege zero-days under active attack — CVE-2026-56164 in on-prem SharePoint and CVE-2026-56155 in ADFS. Prioritize the two live bugs first.

SonicWall confirmed two zero-days in its SMA 1000 remote-access appliances are under active attack — a CVSS 10.0 unauthenticated SSRF and a post-auth flaw that runs OS commands as administrator. Patch now.

A contractor pushed dozens of internal CISA credentials, including AWS GovCloud keys, to a public GitHub repository. The agency's own postmortem is a clean lesson in the most common way secrets leak.

A new macOS infostealer called CrashStealer disguises itself as Apple's crash-reporting tool to steal credentials, keychain data, and crypto wallets, using a notarized dropper that slips past Gatekeeper. The Mac-is-safe assumption keeps eroding.

Google and Microsoft pulled ModHeader, a popular developer extension with about 1.6 million installs, after researchers found a hidden browsing-history collector in the official store version. The tools closest to your browser see the most.

Researchers showed that a single email can trick an AI assistant with memory and inbox access into saving a false fact about you, hiding the change, and acting on it long after. Persistent memory turns a one-time injection into a lasting one.

A Microsoft 365 phishing crew running Evilginx left a Python web server exposed with directory listing enabled, handing researchers a look inside three live operations. The tools that beat multi-factor authentication are getting easier to run, and easier to fumble.

Centers Laboratory has disclosed a breach affecting 540,000 individuals, with the WorldLeaks extortion group claiming to have stolen 720 gigabytes of data. Healthcare records are among the most sensitive and the most valuable to steal.

A joint advisory from the United States and eight allied countries warns that Russian state hackers are targeting poorly configured and unpatched routers to break into critical infrastructure networks. The doorway, again, is the edge device nobody watches.

CISA has added two maximum-severity flaws in the iCagenda and Balbooa Forms extensions for Joomla to its Known Exploited Vulnerabilities catalog, after reports they were exploited as zero-days for remote code execution. The weak point is the plugin, not the platform.

The Australian Cyber Security Centre has warned of a global campaign exploiting vulnerable content management systems and their plugins. Unpatched CMS installs remain one of the easiest ways onto the web.

Datadog researchers describe overlapping campaigns using ghost accounts to enumerate corporate GitHub organizations, their repositories, and their members through the API. Reconnaissance rarely trips an alarm, which is the point.

Ledger's Donjon researchers showed that a precisely timed laser aimed at the chip in a Tangem crypto wallet card can reset its password to anything the attacker chooses. The flaw is in silicon that cannot be patched.

Researchers found six flaws in U-Boot, the bootloader that starts hardware from home routers to data-center servers. A malicious image could crash a device or run code at boot, below the protections that come online later.

Zimbra is urging customers to patch a critical flaw in its Classic Web Client, a stored cross-site scripting bug that lets a crafted email execute code in a victim's session. Webmail has a long history of being hit fast.

The jscrambler npm package was compromised so that simply installing its 8.14.0 release ran a Rust infostealer, through a preinstall hook. It is the exact attack npm just changed its defaults to stop.

Progress Software is urging ShareFile customers to immediately shut down the on-premises servers running Storage Zone Controllers, citing a credible external security threat. A shutdown advisory is rare, and Progress has been here before.

Researchers hid a prompt injection inside an image and used it to steal a repository's secrets. The technique, called Ghostcommit, slipped past AI code reviewers that never open image files, then talked a coding agent into doing the work.

Microsoft expects more Windows security updates ahead, not because the code got worse, but because it is using AI to find flaws it would otherwise have missed. More patches can mean a safer product, if you can keep up with them.

Microsoft has taken apart a destructive Windows backdoor called GigaWiper that stitches disk wiping, fake ransomware, and spyware into operator-selectable commands. It is a reminder that destruction, not a payout, is sometimes the actual goal.

npm version 12 disables install scripts by default, closing one of the most abused paths in software supply chain attacks, and deprecates access tokens that sidestepped two-factor authentication. It is overdue, and it will break a few workflows.

Researchers showed that attackers can weaponize the fake package and command names AI assistants hallucinate, registering them in advance so that following the assistant's confident but wrong suggestion installs malware. They chained it all the way to remote code execution.

Tenda firmware backdoor CVE-2026-11405 (CVSS 9.8) grants unauthenticated admin access via a hidden path in /bin/httpd. No fix yet — how to protect your router.

AssuranceAmerica, a US auto insurer, has disclosed a breach affecting close to 6.9 million drivers after attackers reached its systems earlier this year. Insurance records are a quiet goldmine for fraud and identity theft.

Microsoft has shipped a patch for a zero-day in Microsoft Defender, dubbed RoguePlanet, disclosed shortly after June's Patch Tuesday. A flaw in the endpoint tool millions rely on is a reminder that defenses are attack surface too.

Researchers found that six widely used AI coding assistants can be tricked by a booby-trapped repository into running an attacker's code on the developer's machine, using a decades-old symlink trick against the tool's own permission prompt.

Researchers showed that a normal-looking issue on a public repository can trick GitHub's agentic workflows into leaking the contents of an organization's private repos. As AI agents move into the build pipeline, their inputs become a new place to attack.

GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel flaw giving any local user root and container escape, with a public exploit. Which distros are patched.

Gitea CVE-2026-20896 (CVSS 9.8) lets attackers spoof the X-WEBAUTH-USER header to bypass auth and read private repos. Affected versions, the fix, and FAQ.

Ubiquiti shipped fixes for seven critical UniFi OS flaws, including a maximum-severity command-injection bug. On hardware that sits at the edge of countless small business and home networks, a foothold there is a foothold into everything behind it.

A use-after-free flaw hidden in Linux's KVM hypervisor for 16 years, named Januscape (CVE-2026-53359), lets a guest VM corrupt the host kernel and escape to the machine underneath. In multi-tenant cloud, that breaks the core isolation promise.

Researchers at HKUST showed that malicious add-on 'skills' for AI coding agents can slip past static scanners with a simple packing trick while staying fully functional. The plugin economy for AI agents has the same trust-by-default problem as npm and browser extensions.

BeyondTrust patched two critical auth-bypass flaws in its Remote Support and Privileged Remote Access products that let unauthenticated attackers take over installations. When the tool that controls access can itself be bypassed, it becomes a skeleton key.

Researchers found two campaigns hiding prompt injections in malicious websites to hijack autonomous AI agents into making crypto payments the user never authorized. Agentic AI's core feature, acting on what it reads, is exactly what the attackers abuse.

A new Linux kernel vulnerability called Bad Epoll (CVE-2026-46242) lets an unprivileged local user take full root control. It affects Linux desktops, servers, and Android. A fix is available.

North Korea-linked actors flooded npm, Packagist, Go, and Chrome with 108 malicious packages (PolinRider), impersonating real tools to steal developer secrets and crypto. The delivery is the real story: fake job interviews, blockchain dead-drops, and IDE task files that run the moment you open a repo in VS Code or Cursor.

runZero disclosed seven vulnerabilities in FatFs, the FAT/exFAT filesystem library baked into firmware across cameras, drones, industrial controllers, and security appliances. Several remain unpatched, because the code sits deep in devices that rarely get updated.

Synacktiv found an unauthenticated code-execution flaw in Argo CD's repo-server that can lead to full Kubernetes cluster takeover. There is no patch and no CVE assigned yet, so mitigation is on you until Argo ships a fix.

New ConsentFix and ClickFix attacks steal Microsoft 365 session tokens in seconds using fake prompts and malicious OAuth consent flows, bypassing MFA entirely because they steal the token issued after login.

Adobe shipped fixes for seven CVSS 10.0 vulnerabilities in ColdFusion and Campaign Classic, enabling arbitrary code execution, privilege escalation, and file reads. ColdFusion has a long history of rapid post-patch exploitation, so the clock starts now.

Medical device maker Medtronic is notifying 3.8 million people that ShinyHunters accessed its corporate IT in April and stole personal and medical data. A reminder that healthcare breaches are a compliance and risk event, not just an IT one.

Cisco confirmed attackers are exploiting a vulnerability in Unified Communications Manager. A public PoC has existed since disclosure, and the first exploitation attempts appeared within a week, another disclosure-to-attack gap measured in days.

Sysdig documented JADEPUFFER, an attack it calls the first run end-to-end by an AI agent, entering through a year-old Langflow flaw. The capability is real. But two odd details, an untraceable ransom email and an encryption key that was never saved, suggest the story is messier than the headline, and we have seen premature 'first AI ransomware' claims before.

DuneSlide (CVE-2026-50548, CVSS 9.3) lets a crafted prompt escape the Cursor AI editor sandbox and run OS commands. Fixed in Cursor 3.0 — what to do now.

Researchers link the FortiBleed credential-theft campaign to active ransomware operations: credentials harvested from hundreds of thousands of FortiGate firewalls are being used by the INC and Lynx ransomware groups for initial access.

A new CitrixBleed vulnerability in NetScaler appliances was exploited immediately after public disclosure using public PoC code, and Anubis ransomware affiliates are exploiting Citrix Bleed 2 (CVE-2025-5777) for initial access. If you run NetScaler, assume you are being scanned right now.

CISA added CVE-2026-45659, a remote code execution flaw in Microsoft SharePoint Server (CVSS 8.8), to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. If you run on-prem SharePoint, this is now a patch-today situation.