Vulnerability Watch

What ScreenConnect is: ConnectWise ScreenConnect is a remote support and access tool used by IT teams to connect to and manage computers remotely.

What it is: A missing authorisation flaw allows files to be transferred and executed through an active ScreenConnect session without the host's knowledge or approval.

Who's at risk: Anyone running ScreenConnect below version 26.6.5, particularly IT support teams and managed service providers. Active exploitation has been confirmed since August 20, per SecurityWeek.

CVSS: 9.9 — Critical. Patch today.

Root cause: The software fails to properly verify whether a user has permission before allowing file transfers and execution during a remote session. Think of it like a hotel key card that opens any room on the floor rather than just your own — the system trusts the session without checking what that session is actually allowed to do.

Attack vector: Attackers used social engineering (manipulating people into trusting something malicious) to trick victims into running modified ScreenConnect clients. Once installed, the rogue client checked for active sessions and pushed four VBScript payload files to connected machines, establishing persistence and spreading further — worm-like behaviour that jumps from machine to machine without further human interaction.

Detection strategies:

1. Look for unexpected VBScript file creation or execution in system logs
2. Audit active ScreenConnect sessions for connections you did not initiate
3. Check for new scheduled tasks or startup entries added around August 20 onward

Recommended actions:

1. Upgrade ScreenConnect to version 26.6.5 immediately
2. As a temporary measure, disable the TransferFiles permission in ScreenConnect settings
3. Review session logs for signs of unauthorised file transfers since August 20

What GitLab is: GitLab is a web-based platform that teams use to host, review, and collaborate on software code.

What it is: A path traversal flaw (where an attacker manipulates file path references to reach files they shouldn't be able to access) that lets an unauthenticated user read any file on the GitLab server in a single HTTP request.

Who's at risk: Anyone running a self-hosted GitLab CE or EE instance on an affected version. Cloud-hosted GitLab.com users are already patched.

CVSS: 10.0 (Critical — patch today, ahead of anything else on your list).

Root cause: The server fails to sanitise file path inputs before processing them, allowing a specially crafted request to escape the intended directory and reach arbitrary files — including credentials and configuration secrets.

Attack vector: An attacker sends a POST request to /api/v4/projects/{id}/repository/commits/ with a manipulated file.path parameter. No login required. The server returns the requested file's contents directly.

Detection strategies: Search your logs for POST requests to /api/v4/projects/{id}/repository/commits/ URIs that include file.path parameters. Unexpected hits from external IPs are a strong indicator of exploitation.

Recommended actions:

1. Upgrade to GitLab 19.1.8, 19.2.6, or 19.3.2 immediately
2. If you cannot patch right now, restrict external access to the GitLab API at your firewall
3. Review logs for the pattern above and audit recent access to sensitive configuration files

What Cisco Secure Firewall Management Center is: A centralised management platform used by network administrators to control and monitor Cisco firewall devices across an organisation's infrastructure.

What it is: An authentication bypass vulnerability (a flaw that lets an attacker skip the login process entirely) that allows an unauthenticated remote attacker to execute scripts on the device and gain root access — the highest level of system control — to the underlying operating system.

Who's at risk: Any organisation running an unpatched instance of Cisco Secure FMC that is reachable over a network. Cisco Talos confirms active exploitation in the wild by multiple threat groups, including a ransomware operator and suspected state-sponsored actors. Read the full Talos advisory here.

CVSS: 10.0 (Critical) — patch today. This is the highest possible severity score.

Root cause: The software fails to properly verify a user's identity before allowing access to privileged functions. An attacker can interact with authenticated endpoints without presenting valid credentials, because the application's authentication logic does not enforce the check at the point of execution.

Attack vector: An attacker sends a crafted request directly to the FMC interface without logging in. The application processes the request as though it came from an authorised user, allowing the attacker to execute scripts and establish root-level access. From there, observed post-exploitation activity includes deploying web shells (persistent backdoors hidden in web server files), harvesting stored credentials, and in one confirmed case, deploying a variant of the Cyclops Blink malware previously linked to Russian state actors.

A second related vulnerability, CVE-2026-20316 (CVSS 5.3, Medium), has been used alongside this flaw to further elevate attacker privileges — patch that one too.

Detection strategies: Look for unexpected processes or unfamiliar JAR files in your Tomcat webroot directory. Review authentication logs for access to privileged endpoints from unauthenticated sessions. Monitor for outbound connections to unusual external IP addresses initiated by the FMC process.

Recommended actions:

1. Apply Cisco's available hotfix for CVE-2026-20079 immediately — do not wait for the comprehensive hardening release scheduled for the week of 14 September.
2. Restrict FMC management interface access to trusted IP ranges only.
3. Review FMC access logs for signs of compromise before and after patching.

CVE ID not confirmed in source — check the original advisory before acting.

What Adobe Commerce / Magento is: Adobe Commerce, built on the open-source Magento platform, is the software that powers the checkout, product catalogue, and payment processing for thousands of online shops worldwide.

What it is: A zero-day (a flaw with no patch available yet) vulnerability nicknamed StyleSmuggler allows attackers to inject malicious PHP code — the programming language Magento uses behind the scenes — through the platform's template system. No user interaction is required for the attack to succeed.

Who's at risk: Any merchant running Adobe Commerce or Magento versions 2.4.7, 2.4.8, or 2.4.9, including those who applied the July and August 2026 security patches.

CVSS: Not yet scored — treat as Critical until confirmed.

Root cause: Magento's template engine fails to adequately sanitise input passed through a site's styling properties. An attacker exploits this by deliberately generating a payment failure report, which causes Magento to execute injected code when the platform sends a "Payment Transaction Failed Reminder" email. The flaw exists because the email-rendering process trusts template content that should be treated as untrusted input.

Attack vector: An attacker submits a crafted request that triggers a payment failure on the targeted store. Magento generates an error report and queues a notification email. When Magento processes that email — including if delivery fails — it executes the attacker's injected PHP code. A Rust-written backdoor is then installed on the server, disguised as a system process name such as [kworker/u:8:0] or fc-cache, and begins communicating with an attacker-controlled server while masquerading as routine NTP (time synchronisation) network traffic.

Detection strategies: Watch for unexpected bursts of "Payment Transaction Failed Reminder" emails from your Magento installation. Look for unfamiliar process names such as [kworker/u:8:0] or fc-cache on your server, particularly ones making outbound connections. Review server logs for unusual NTP traffic patterns — legitimate NTP traffic does not carry system information like hostnames or memory usage.

Recommended actions:

1. Apply Adobe's scheduled Patch Tuesday update on 8 September 2026 and monitor Adobe's official advisory for a specific StyleSmuggler fix.
2. Until a patch is available, consider blocking outbound connections from your Commerce server to unknown external IPs at the firewall level.
3. Alert your hosting provider or server administrator to the active exploitation and ask them to review process lists and outbound traffic immediately.

What SonicWall SMA 1000 is: A remote access gateway used by organisations to let employees connect securely to corporate networks from outside the office.

What it is: CVE-2026-83548 is a pre-authentication SSRF (server-side request forgery — where an attacker tricks the server into making requests on their behalf) flaw in the user-facing portal. No login is required to trigger it.

Who's at risk: Any organisation running an affected SMA 1000 appliance exposed to the internet. Models 6210, 7210, and 8200v on the affected firmware versions are vulnerable. Exploitation is confirmed and ongoing.

CVSS: 10.0 (Critical — patch today, before anything else).

Root cause: The flaw exists because the appliance does not properly restrict which internal resources the user-facing portal is permitted to reach. An unintended alternate access path allows requests to bypass the controls that should keep unauthenticated users out of sensitive functionality.

Attack vector: An unauthenticated attacker sends a crafted request to the public-facing portal. The appliance processes it without checking whether the sender has any credentials, giving the attacker access to sensitive internal functions. When chained with CVE-2026-83549 (a separate authenticated OS command injection flaw in the admin console), the result is full remote code execution on a device sitting directly on the internet.

Detection strategies: Check for unexpected or repeated requests to internal portal endpoints from external IPs. Review admin console access logs for activity from unrecognised accounts. Look for anomalous outbound connections from the appliance itself.

Recommended actions:

1. Upgrade immediately to firmware 12.4.3-03526 or 12.5.0-02952.
2. If indicators of compromise are found, re-image hardware appliances or re-deploy virtual ones.
3. Reset all user and administrator passwords and TOTP tokens after patching.

What Ruby on Rails is: A popular open-source web application framework used by developers to build websites and web services — including many you use every day without knowing it.

What it is: A critical flaw dubbed KindaRails2Shell allows an attacker to read arbitrary files on the server, steal credentials, and then execute their own code remotely. RCE (remote code execution — when an attacker runs commands on a machine they do not own) is the worst outcome a web vulnerability can produce.

Who's at risk: Any Rails application that uses libvips (an image processing library) for Active Storage and accepts image uploads from untrusted users. VulnCheck identified roughly 7,000 exposed instances in early August, before exploitation began.

CVSS: 9.5 (Critical — patch today.)

Root cause: Rails trusts the content type declared by the client to determine whether a file is an image. libvips ignores that declaration and inspects the file's internal bytes instead. An attacker exploits this disagreement by crafting a file that claims to be a MATLAB image, which tricks libvips into handing it to a chain of libraries that ultimately reads an attacker-chosen file from the server and returns its contents.

Attack vector: An unauthenticated attacker uploads a specially crafted file to any vulnerable image upload endpoint. The server processes it as an image, reads a sensitive file — such as the credentials database — and returns its contents to the attacker. Armed with those secrets, the attacker can forge user sessions and execute code. Critically, VulnCheck found that patching to 8.1.3.1 blocks the file-read path but does not neutralise a separate deserialization gadget, meaning RCE remains possible on patched servers given a valid signature.

Detection strategies: Check server logs for image upload requests containing MATLAB or HDF5 file signatures. Look for unexpected outbound connections from your Rails process. Rails has published forensic tools specifically to detect exploitation attempts — run them.

Recommended actions:

1. Patch to the latest Rails release immediately and apply all available security updates.
2. Restrict image upload endpoints to authenticated users where possible.
3. Run Rails' published forensic detection tools and review logs for signs of prior exploitation.

What PaperCut is: PaperCut NG and MF are print management platforms used by universities, corporations, and governments to control and monitor printing across Canon, Epson, Xerox, Brother, and other devices.

What it is: An actively exploited flaw in PaperCut's web-facing management interface. Attackers can reach it without authentication and gain control of the print server. A second related flaw, CVE-2026-81578, was disclosed alongside it.

Who's at risk: Any organisation running PaperCut NG or MF with the server's web interface reachable from the internet. Universities and government bodies are at particular risk — they have historically been the primary targets of PaperCut exploits.

CVSS: 8.8+ (High — patch this week, sooner if your server faces the public internet)

Root cause: The vulnerability exists in PaperCut's web management interface, which can be reached by unauthenticated external requests. An initial patch was insufficient; PaperCut worked with researchers from Huntress and watchTwr to produce a corrected fix released the following day.

Attack vector: An attacker sends a crafted request to the exposed PaperCut web interface without needing a username or password. From there, they can take administrative control of the print server — which sits inside the corporate network and holds stored print jobs, credentials, and configuration data. Past PaperCut compromises have served as the initial foothold for ransomware deployments.

Recommended actions:

1. Apply the corrected patch released Friday immediately — the first patch was insufficient
2. Remove PaperCut servers from the public internet and restrict web access to trusted IP addresses only
3. Check for evidence of exploitation: review server logs for unexpected authentication events or admin account changes

What Zimbra Collaboration Suite is: A widely used platform that combines email, calendar, contacts, and file sharing — common in government agencies, universities, and mid-to-large businesses.

What it is: A critical remote code execution (RCE — where an attacker can run their own commands on your server without physical access) flaw triggered through Zimbra's SNMP notification processing. SNMP (Simple Network Management Protocol) is a standard used to monitor and manage networked devices. The vulnerability requires no login credentials to exploit.

Who's at risk: Any organisation running Zimbra Collaboration Suite with SNMP notifications enabled — which is the default configuration in affected versions. Federal agencies were given until 24 August to patch or stop using the product.

CVSS: Not confirmed in the source — treat as Critical based on CISA's three-day remediation deadline and confirmed active exploitation.

Root cause: Zimbra fails to properly sanitise (clean and validate) untrusted input received during SNMP notification processing. Think of it like a form that accepts any text without checking whether it contains commands — an attacker can slip instructions through the front door disguised as ordinary data.

Attack vector: An unauthenticated attacker sends a specially crafted SMTP request to a vulnerable Zimbra server. Because the input is not sanitised before being processed, the server executes the attacker's embedded commands with Zimbra-level system privileges. No account, credentials, or social engineering required — just a network path to the server.

Recommended actions:

1. Upgrade to Zimbra Collaboration Suite v10.1.20 immediately — this is the patched release.
2. If patching is not immediately possible, disable SNMP notifications as a temporary mitigation.
3. Treat any previously exposed server as a potential incident: review logs for anomalous SMTP traffic and check for signs of persistence installed before the patch.

What Spring for GraphQL is: Part of Broadcom's Spring application framework, a widely used open-source toolkit for building Java-based enterprise software — Spring for GraphQL specifically handles APIs built using the GraphQL query language.

What it is: Cybersecurity firm Sonatype has flagged CVE-2026-59285 as a critical remote code execution (RCE) flaw — meaning an attacker who successfully exploits it can run their own commands on the affected server, with no need for physical access.

Who's at risk: Developers and organisations running applications built on Spring for GraphQL. Sonatype's analysis found the broader Spring patch batch affects more than 200,000 software components.

CVSS: Not confirmed in the source — treat as Critical until the official advisory publishes a score. Patch today.

Root cause: The source does not detail the precise technical mechanism for CVE-2026-59285. The broader Spring release patched 91 flaws, and Broadcom has attributed the surge in part to increased AI-assisted development introducing new code paths that weren't adequately reviewed.

Attack vector: An attacker targeting a vulnerable Spring for GraphQL endpoint could craft a malicious GraphQL query that triggers unsafe code execution on the server. The exact payload format has not been publicly detailed, which limits immediate exploitation — but that window closes quickly once researchers publish proof-of-concept code.

Detection strategies:

1. Check application logs for unexpected GraphQL queries with unusual structure or parameters.
2. Monitor for new outbound connections from your application server shortly after API calls.
3. Review dependency manifests for Spring for GraphQL and compare against the versions listed in Broadcom's advisory.

Recommended actions:

1. Apply Broadcom's Spring framework updates immediately — this is a critical-severity flaw.
2. Restrict external access to GraphQL endpoints where not required.
3. Enable logging on all GraphQL API calls and alert on anomalous patterns.

No notable new vulnerability disclosed in the last 48 hours. The Vulnerability Watch article provided contained no CVE — it was a general opinion piece on application security practices rather than a disclosure.

What Microsoft Entra ID is: Microsoft Entra ID is a cloud-based identity and access management service — the system that verifies who you are and controls what you can access across Microsoft 365 and connected apps.

What it is: A deserialization flaw (where an application converts user-supplied data back into executable code without properly checking it first) allows an unauthenticated attacker to run arbitrary code on Microsoft's servers over a network connection.

Who's at risk: Any organisation using Microsoft Entra ID was theoretically exposed. Microsoft has confirmed active exploitation in the wild, though no customer action is needed.

CVSS: 10.0 (Critical — the highest possible score). Patch today — though in this case, Microsoft has already applied the fix on their end.

Root cause: The service failed to validate untrusted data before converting it back into active objects. Think of it like a mail room that opens every package and assembles whatever is inside without checking whether the contents are safe.

Attack vector: An unauthenticated attacker sends a specially crafted network request to the Entra ID service. The service deserializes the payload without validation, triggering code execution on Microsoft's infrastructure. No credentials or user interaction were required.

Detection strategies: Microsoft handled the mitigation server-side, so traditional patch detection won't apply. Review your Entra ID sign-in logs for unexpected authentication events around and before the disclosure date. Look for unfamiliar service principals or newly granted admin permissions.

Recommended actions:

1. Confirm your Microsoft 365 tenant is receiving service updates — no manual patch is required, but verify your environment reflects the current service version.
2. Audit recent Entra ID activity logs for anomalous sign-ins or privilege changes.
3. Enable Conditional Access policies and alert on unusual admin role assignments.

What Ray is: Ray is an open-source Python framework used by developers and data scientists to run large AI and machine learning workloads across many computers at once.

What it is: A critical flaw in Ray allows an attacker to execute arbitrary code (RCE — remote code execution, meaning running any command they choose on your machine) through a browser-based DNS rebinding attack (where a malicious website tricks your browser into making requests on your behalf to software running locally on your own machine).

Who's at risk: Developers running Ray in development or testing environments, particularly those using Firefox or Safari.

CVSS: 9.4 (Critical — patch today.)

Root cause: Ray's development team has not implemented authentication on critical internal endpoints, including /api/jobs. Because these endpoints accept requests from browsers without verifying who is asking, and because the User-Agent header can be freely modified by a webpage, an attacker-controlled site can manipulate a browser into sending commands directly to Ray as if it were the legitimate user.

Attack vector: A developer visits a malicious website or is served a malicious ad while Ray is running locally. The page performs a DNS rebinding attack, redirecting the browser to Ray's unauthenticated API. The attacker submits a crafted job request, and Ray executes it with the developer's own system privileges. The attack can also reach Ray instances running inside a private corporate network by using the victim's browser as an unwitting intermediary. The RondoDox DDoS botnet incorporated this vulnerability two days before public disclosure in November 2025, and a separate campaign (ShadowRay 2.0) has used unpatched Ray instances to build a cryptocurrency mining botnet.

Detection strategies: Check Ray job logs for unexpected job submissions, particularly shell commands or curl-based install scripts. Look for outbound network requests from Ray processes to unfamiliar external addresses. Monitor for new or modified files in home directories on machines where Ray is running.

Recommended actions:

1. Upgrade Ray to version 2.52.0 immediately — FCEB agencies must patch by 20 August 2026.
2. Restrict Ray dashboard and API ports to localhost only; do not expose them on a network interface.
3. Avoid browsing untrusted websites while Ray is running locally.

No notable new vulnerability disclosed in the last 24 hours.

The Evooo1Bot botnet (covered in the AI & Emerging Threats section above) exploits a collection of previously known flaws across multiple device brands rather than a single newly disclosed CVE. No qualifying new CVE appears in today's brief.

CVE ID not confirmed in source — check the original advisory before acting.

What Evooo1Bot targets: Home routers, enterprise networking equipment, and IoT (Internet of Things — everyday devices connected to the internet, like smart routers and remote-terminal units) running Linux-based firmware.

What it is: Evooo1Bot is a new botnet — a network of hijacked devices secretly controlled by an attacker — built on leaked source code from the notorious Mirai malware. Researchers at Fortinet's FortiGuard Labs identified it after seeing coordinated attacks on edge devices across multiple regions since July 2026, as reported by Infosecurity Magazine.

Who's at risk: Anyone running an unpatched router or internet-connected device from brands including D-Link, NETGEAR, Tenda, and Telesquare, particularly where the device's admin interface is exposed directly to the internet.

CVSS: Not yet scored for the botnet itself — treat as High until confirmed.

Root cause: The botnet exploits known, unpatched vulnerabilities in edge devices — some dating back to 2007. Manufacturers issued fixes, but many devices in the field were never updated, leaving attackers with a large pool of targets to automate against.

Attack vector: Evooo1Bot scans the internet for vulnerable devices, fires exploit payloads at them, and once inside, installs a persistent agent. That agent connects back to attacker-controlled infrastructure and — most significantly — activates a SOCKS relay module that turns the compromised device into a proxy, concealing the attacker's real location while routing further attacks through the victim's network.

Recommended actions:

1. Log into your router's admin panel and apply any available firmware updates immediately.
2. Disable remote management interfaces unless you specifically need them — check your router settings for "Remote Access" or "WAN Management" and turn them off.
3. If your router model appears in the article (D-Link, NETGEAR, Tenda, Telesquare), check the manufacturer's support page for a patch or end-of-life notice.

What VMware vCenter Server is: Centralised IT management software that lets organisations control, monitor, and configure all their virtual machines and servers from a single platform.

What it is: A directory traversal flaw (a weakness that lets an attacker request files outside the intended folder structure) in vCenter's Syslog server component, leading to remote code execution (RCE — running attacker-supplied commands on the target machine).

Who's at risk: Any organisation with a vCenter server reachable over the network. No login is required to trigger the flaw.

CVSS: 9.8 (Critical — patch today).

Root cause: The Syslog server component fails to validate file path inputs, allowing a crafted request to escape the intended directory and reach sensitive system areas. There are no workarounds. Only patching resolves it.

Attack vector: An attacker with network access sends a specially crafted request to the vCenter Syslog server. The server processes the malformed path without restriction, granting file access and enabling arbitrary code execution. In active exploitation, attackers then drop the reverse_ssh tool, which phones home to attacker infrastructure, bypassing inbound firewall rules.

Detection strategies:

1. Look for unexpected outbound SSH connections from vCenter hosts to unknown external IPs.
2. Search for reverse_ssh binaries using QUIRSO's published YARA rule — but validate any hits, as the tool also has legitimate uses.
3. Check for new, unrecognised processes running under the vCenter service account.

Recommended actions:

1. Apply the emergency patch immediately: 9.1.0.0300, 9.0.2.0100, 8.0 U3k, or 8.0 U2f.
2. Restrict network access to vCenter — it should never be publicly internet-facing.
3. Review outbound connection logs for traffic to unfamiliar infrastructure since August 3.

What Adobe ColdFusion is: ColdFusion is Adobe's web application server platform, used by developers to build and host database-driven websites and internal business applications.

What it is: This is an OS command injection vulnerability (a flaw where an attacker can feed specially crafted input that the server executes as a system-level command, rather than treating it as ordinary data). It carries a CVSS score of 10.0 and can lead to arbitrary code execution on the host server.

Who's at risk: Any organisation running ColdFusion versions prior to 2025.0.12 or 2023.0.23 with internet-accessible deployments. Adobe rates this Priority 1, meaning active targeting is considered likely.

CVSS: 10.0 (Critical — patch today. Stop reading, go patch.)

Root cause: The application fails to sanitise user-supplied input before passing it to underlying operating system functions. An attacker can craft a request containing shell commands that the server interprets and executes with its own privileges, bypassing application-layer controls entirely.

Attack vector: An attacker sends a malicious request to an exposed ColdFusion endpoint, embedding OS commands inside a parameter the server processes unsafely. The server executes those commands directly, potentially allowing the attacker to install malware, create new administrative accounts, or move laterally (pivot from one compromised system to reach other machines on the same network) through internal infrastructure.

Detection strategies: Look for unusual child processes spawned from the ColdFusion application server process (e.g. cmd.exe or /bin/sh). Review web server access logs for malformed or unexpectedly long parameter strings in POST requests. Monitor for new user accounts or scheduled tasks created around the time of any suspicious ColdFusion traffic.

Recommended actions:

1. Update ColdFusion to version 2025.0.12 or 2023.0.23 immediately.
2. Restrict external access to ColdFusion admin and API endpoints at the firewall or reverse proxy level.
3. Enable application-level logging and alert on unexpected process spawning from the ColdFusion service account.

CVE ID not confirmed in source — check the original advisory before acting.

What SAP Commerce Cloud is: An enterprise e-commerce platform used by large retailers and manufacturers to manage online storefronts, product catalogues, and customer data.

What it is: A maximum-severity flaw caused by missing authorisation checks and insufficient input validation. An attacker with no account can send crafted requests to vulnerable internal functions and run arbitrary code on the server.

Who's at risk: Any organisation running an unpatched SAP Commerce Cloud (Data Hub Adapter) instance. If the endpoint is reachable — even internally — the risk is real.

CVSS: 10.0 (Critical). Patch today.

Root cause: SAP's Data Hub Adapter ships with a default authentication client that fails to enforce proper access controls. Functions downstream of that client do not validate the input they receive, meaning an unauthenticated request can reach and trigger code execution directly.

Attack vector: An attacker with network access to the endpoint sends specially crafted input through the default authentication client, bypassing authorisation entirely. Because the affected functions lack validation, that input reaches execution-level components. No credentials are needed. The attacker gains the ability to run any command on the host system.

Detection strategies: Look for unexpected outbound connections from the Commerce Cloud host. Review authentication logs for requests hitting Data Hub Adapter endpoints from unknown sources. Alert on processes spawned by the Commerce Cloud service account that do not match normal application behaviour.

Recommended actions:

1. Apply SAP's August 2026 patch and redeploy the updated Commerce Cloud version immediately.
2. As a temporary measure until patching is complete, configure an IP Filter Set to restrict access to the vulnerable endpoint to trusted sources only.
3. Review network exposure — this endpoint should never be reachable from the public internet.

What Progress Kemp LoadMaster is: LoadMaster is an application delivery controller and load balancer used by enterprises and government agencies worldwide to distribute web traffic across multiple servers and keep applications running reliably. Progress Software reports over 100,000 deployments, including across 80% of Fortune 500 companies.

What it is: A command injection flaw (a class of bug where an attacker can slip operating system commands into a field that should only accept data) in LoadMaster's API lets unauthenticated attackers run arbitrary commands on the appliance. No account, no password, no invitation required.

Who's at risk: Any organisation running an unpatched LoadMaster instance with its management interface reachable from the internet. Shadowserver estimates roughly 300 instances are currently exposed online.

CVSS: Critical — patch today. Stop reading, go patch.

Root cause: The API endpoints on LoadMaster failed to sanitise (properly clean and validate) inputs before passing them to underlying system commands. Think of it like a form on a website that accepts your name and then passes whatever you type directly into a command the server runs — if you type a name followed by a system instruction, both get executed. Progress released a fix in June.

Attack vector: An attacker sends a crafted HTTP request to one of the affected API endpoints with a payload (a string of commands) embedded where the application expects clean data. Because no authentication is required and the input is not validated, the server executes the attacker's commands with the privileges of the LoadMaster process. From there, the attacker can read files, install backdoors (hidden persistent access points), or move laterally (pivot from the compromised appliance to other systems on the same network).

Detection strategies: Look for unexpected outbound connections from LoadMaster appliances, particularly to unfamiliar external IPs. Review API access logs for malformed or unusually long input values in command endpoints. Check for new or modified files in system directories, and audit running processes for anything spawned by the LoadMaster service that should not be there.

Recommended actions:

1. Upgrade to GA v7.2.63.2 or LTSF v7.2.54.18 or later immediately — a patch has been available since June.
2. Restrict access to the LoadMaster management interface so it is not reachable from the public internet.
3. Monitor outbound traffic from LoadMaster appliances and alert on any connections to external hosts not in your approved list.

CVE ID not confirmed in source — check the original advisory before acting.

What Connective eID is: A browser extension used by over two million people in Belgium to authenticate their identity and sign documents digitally with their national electronic ID card. It is used by eight of Belgium's ten largest banks and more than 60 government agencies.

What it is: The extension failed to verify which website was allowed to communicate with it. Any website — including one running a malicious ad — could interact with the application without the user knowing.

Who's at risk: Anyone in Belgium who had the extension installed before late July 2026. Exposure required only visiting a compromised or malicious webpage.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: The application did not validate the origin (the source website) of incoming requests. It also allowed web pages to customise the text inside authentication pop-up boxes without displaying which site was making the request. Users had no way to tell a legitimate prompt from a fake one.

Attack vector: A malicious website silently triggers an authentication pop-up using official-looking text. The user enters their PIN, which the extension sends back to the requesting site. The attacker uses that PIN to generate unauthorised approval tokens and forge legally binding electronic signatures whenever the victim's physical eID card is in a card reader. A separate flaw — in how the extension handled local files — allowed remote code execution (RCE — when an attacker runs their own code on someone else's machine) just by having the user visit a webpage after downloading a disguised file.

Detection strategies: Unexpected authentication pop-ups while browsing unfamiliar sites. Unsigned documents appearing in your Belgian government portal history. Any prompt asking for your eID PIN outside of a known, intentional login flow.

Recommended actions:

1. Confirm your Connective eID extension is updated to the late July 2026 release or later.
2. If you signed documents or entered your PIN in the weeks before the patch, report this to your bank and check your CSAM.be account for unexpected activity.
3. Treat any eID PIN prompt on an unfamiliar website as a phishing attempt — cancel and close the tab.

CVE ID not confirmed in source — check the original advisory before acting.

What Atlassian Rovo is: An enterprise AI assistant embedded across Jira, Confluence, and Bitbucket that can autonomously conduct multi-step research tasks and interact with third-party tools including Slack, Microsoft 365, and Google Workspace.

What it is: The RovoBlast flaw let an attacker pre-load instructions into a victim's live Rovo session via a crafted URL. The assistant treated those external instructions as trusted user input and acted on them with the victim's full access permissions.

Who's at risk: Any organisation using Atlassian Rovo with third-party integrations enabled. Users need only click a malicious link while authenticated.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: The rovoChatPrompt URL parameter accepted and pre-filled content into the chat interface without sanitising or flagging its external origin. Rovo's autonomous agent features then executed whatever instructions appeared, since nothing distinguished attacker-supplied input from legitimate user requests. The organisation ID field could even be left blank, and Atlassian's routing still directed the request into the victim's own account.

Attack vector: An attacker crafts a URL embedding malicious instructions via rovoChatPrompt and sends it to an authenticated Rovo user. On click, Rovo loads the instructions silently. Its built-in ResearchAgent then queries connected data sources — Jira, Confluence, SharePoint — and pushes the results to an attacker-controlled external server, completing exfiltration (the unauthorised transfer of data outside an organisation) with no further user interaction required.

Detection strategies: Review Rovo activity logs for outbound URL requests to unfamiliar external domains. Look for ResearchAgent sessions that were not initiated by a recognisable internal workflow. Flag any Rovo session that accessed multiple data sources — Jira plus Confluence plus SharePoint — in rapid, automated succession.

Recommended actions:

1. Confirm the server-side fix is active on your Atlassian instance (Atlassian deployed it July 8, 2026).
2. Restrict Rovo's integration scope — remove access to any data source not actively in use.
3. Disable autonomous browsing and multi-step agent features unless operationally required.

CVE ID not confirmed in source — check the original advisory before acting.

What Cisco IOS XE is: The operating system that runs on a wide range of Cisco routers and switches used in corporate and government networks worldwide.

What it is: A command injection flaw (a bug where an attacker can sneak operating system commands into input fields the software was not designed to handle that way) in Cisco IOS XE Software, scoring 9.8 out of 10.

Who's at risk: Organisations running Cisco IOS XE in autonomous or controller mode on affected versions. Cisco says no active exploitation is known, but at CVSS 9.8, that window will not stay open long.

CVSS: 9.8 — Critical. Patch today.

Root cause: The software fails to properly neutralise special characters in user-supplied input. An attacker can inject commands that the underlying operating system executes directly, bypassing the intended application layer entirely.

Attack vector: An attacker submits crafted input containing operating system commands to the affected interface. The software processes it without stripping the dangerous characters, passes the payload to the OS, and executes it. Depending on privilege level, this could mean full device compromise from a remote connection.

Detection strategies: Look for unexpected process spawns from the IOS XE management interface in system logs. Monitor for unfamiliar outbound connections from network devices. Alert on any administrative commands executed outside of normal change windows.

Recommended actions:

1. Upgrade to a fixed IOS XE release: 17.9.10, 17.12.8, 17.15.6, 17.18.4, or 26.1.2
2. Restrict management interface access to trusted IP ranges only
3. Enable logging on all management plane activity and review alerts daily until patched

What JetBrains TeamCity is: A continuous integration and delivery (CI/CD) server — software development teams use it to automatically build, test, and deploy their code.

What it is: CISA has flagged this vulnerability as actively exploited in the wild, per the advisory on The Hacker News. The flaw involves deserialization of untrusted data (a process where software converts incoming data back into executable objects — dangerous when the incoming data is not verified) arriving over the agent polling protocol, the channel build agents use to check in with the server.

Who's at risk: Any organisation running an on-premise TeamCity server that is reachable over a network.

CVSS: 9.8 — Critical. Patch today. Stop reading and go patch.

Root cause: The server processes incoming serialized data (packaged data sent across a network connection) from the agent polling channel without confirming whether the sender is actually a legitimate, authenticated build agent. When software trusts the shape of data rather than its verified origin, an attacker can craft a malicious payload and submit it as though it came from a trusted source.

Attack vector: An unauthenticated attacker who can reach the TeamCity server's network port sends a specially crafted serialized payload over the agent polling protocol. The server deserializes it without authentication checks, executing arbitrary operating system commands at whatever privilege level the TeamCity process runs under. No account credentials are required. A successful hit can expose stored credentials, tamper with build configurations, and compromise software pipelines that push code into production environments.

Detection strategies:

1. Look for unexpected process executions spawned by the TeamCity server process in your endpoint logs.
2. Monitor agent polling protocol traffic for connections from IP addresses outside your known build agent pool.
3. Review TeamCity audit logs for configuration changes or credential access that does not correspond to a known user session.

Recommended actions:

1. Apply the patched TeamCity release immediately — FCEB federal agencies must do so by August 8, 2026.
2. Restrict network access to the TeamCity server so only authorised build agents and administrators can reach it.
3. Review and rotate any credentials stored within TeamCity as a precaution.

What cPanel & WHM is: cPanel is the control panel software that web hosting companies use to let customers manage websites, email accounts, and databases through a browser interface. WHM (Web Host Manager) sits above it, used by hosting administrators to manage the server itself.

What it is: An authenticated cPanel user can cross the privilege boundary between their own account and the server's administrative database identity, executing arbitrary SQL (Structured Query Language — the language used to read and modify databases) with full root-level database permissions. cPanel's own advisory notes this may extend to operating-system-level compromise depending on server configuration.

Who's at risk: Any server running an unpatched version of cPanel & WHM or WP Squared where users have access to the MySQL/MariaDB database feature. Shared hosting environments — where many customers share one server — carry the highest exposure.

CVSS: 9.4 (Critical — patch today.)

Root cause: The flaw lives in cPanel's database-renaming process. When a database is renamed, the system creates a replacement, moves data, recreates permissions, and removes the old database. SQL mode is not preserved during this process, causing subsequent SQL to execute in the database's root administrative context rather than the user's restricted one. The HackerOne CNA classifies this as CWE-89 (SQL injection), though cPanel's own advisory frames it as privilege escalation — two valid descriptions of the same underlying failure.

Attack vector: An attacker with a valid cPanel account triggers the database-rename workflow. Because SQL mode drops to root context mid-operation, commands they supply run with full administrative database privileges. From there, depending on configuration, the path to operating-system access may be short.

Detection strategies: Review database audit logs for unexpected SUPER-privilege operations or schema changes from non-administrative cPanel accounts. Look for database rename events followed immediately by unusual stored procedure creation or user grants. Monitor for unexpected OS-level activity from the database process user.

Recommended actions:

1. Update to a patched build: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or 138.1.6 for WP Squared.
2. If immediate patching is not possible, revoke the MySQL/MariaDB feature from cPanel user accounts in WHM as a temporary mitigation.
3. Audit which cPanel accounts currently have database access and restrict to those with a genuine need.

What N-able N-central is: N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) — companies that handle IT infrastructure for other businesses — to monitor, patch, and remotely access their clients' servers and devices.

What it is: This is an authentication bypass (a flaw that lets an attacker skip the login process entirely) that allows an unauthenticated user to take over admin accounts. Both on-premises and cloud-hosted versions are affected.

Who's at risk: MSPs and IT service providers running N-central below version 2026.3.1.7. Because MSPs manage systems for many clients, one compromised N-central console can expose every organisation that MSP supports.

CVSS: Not yet scored — treat as Critical until confirmed. Active exploitation is confirmed in the wild.

Root cause: This is a bypass of a previously patched flaw (CVE-2026-18556). Attackers found a new path around the fix and began exploiting it in late July 2026. The authentication layer failed to close all routes into privileged account access.

Attack vector: An attacker with network access sends a crafted request to the N-central console, bypasses authentication, and gains full admin control. From there, they can deploy scripts to managed endpoints, run remote sessions on critical servers, and register Cloudflare tunnels (persistent encrypted channels that survive even after server access is revoked) to maintain a foothold.

Detection strategies: Check N-central audit logs for admin account creation or logins from unrecognised IP addresses. Look for new Cloudflare tunnel registrations or unfamiliar services appearing on managed endpoints. Monitor for unexpected script deployments pushed through the N-central agent.

Recommended actions:

1. Upgrade to N-central version 2026.3.1.7 immediately.
2. Review indicators of compromise published by N-able and Huntress.
3. Audit admin accounts and active Cloudflare tunnels across your N-central environment.

CVE ID confirmed in source — verify details against the official SonicWall advisory before acting.

What SonicWall SMA1000 is: A hardware appliance organisations use to give remote workers secure access to internal corporate networks, sitting at the edge of the network as a gateway.

What it is: CVE-2026-15409 allows an unauthenticated attacker (someone with no account or credentials) to open a WebSocket tunnel (a persistent two-way connection channel) directly to restricted internal services. A second flaw, CVE-2026-15410 (CVSS 7.2), can then be used to escalate privileges to root, giving the attacker full control of the appliance. Ransomware group INC has been observed chaining both flaws together.

Who's at risk: Any organisation running SMA1000 appliances that have not applied the July 14 patch. Exploitation has been confirmed in the wild since at least June 22.

CVSS: 10.0 — Critical. Patch today. This is the highest possible score.

Root cause: The appliance failed to enforce authentication before allowing WebSocket connections to restricted service endpoints. Think of it like a secure building where the front desk waves anyone through without checking ID, because the system assumed only staff would know to walk up to that door.

Attack vector: An attacker sends an unauthenticated WebSocket request to the exposed endpoint. The appliance accepts the connection. From there, CVE-2026-15410 is used to elevate access to root. With root access, attackers have deployed backdoors and harvested credentials, and in some cases pivoted into internal corporate networks from the compromised appliance.

Detection strategies: Look for unexpected WebSocket connections to internal service ports originating from external IP addresses. Review SMA1000 authentication logs for access events with no corresponding valid session. Monitor for new or unrecognised files written to the appliance filesystem after June 22.

Recommended actions:

1. Apply the SonicWall patch released July 14, 2026, immediately.
2. Audit appliance logs for signs of compromise dating back to June 22.
3. Isolate any unpatched SMA1000 devices from internal networks until patching is complete.

CVE ID not confirmed in source — check the original advisory before acting.

What Coldcard is: Coldcard is a Bitcoin-only hardware wallet — a physical device that stores your private keys offline, made by Canadian company Coinkite.

What the flaw is: A 2021 firmware integration error caused wallet seed generation to use a weak software PRNG instead of the device's dedicated hardware RNG (random number generator). The software fallback produced seeds with far less entropy (unpredictability) than a secure wallet requires — roughly 40 bits on the Mk3, versus the 128 bits a standard 12-word seed should provide.

Who is at risk: Anyone whose seed was generated on an affected firmware version. Coinkite's advisory lists Mk3 versions 4.0.1 through 4.1.9 as vulnerable; Block's independent research also places Mk2 and Mk3 versions from 4.0.0 onward on the vulnerable path. Mk4 and Mk5 devices running firmware before 5.6.0, Q devices before 1.5.0Q, and Edge builds before 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q) are also affected. The version running today is irrelevant — what matters is the version running when the seed was first created.

Recommended actions:

1. Install the emergency firmware released July 31 for your model.
2. If your seed was generated on an affected version, generate a brand-new seed on patched firmware and transfer all funds to the new wallet immediately.
3. Do not restore your old seed to any device or wallet — the weakness is in the seed itself, not the device.

What Adobe Campaign Classic is: Adobe Campaign Classic is enterprise marketing software used by large organisations to manage and automate mass email, SMS, and direct mail campaigns.

What it is: A flaw in how the software checks whether a user has permission to perform certain actions allows an attacker to run arbitrary code (any program the attacker chooses) on the affected server, with no interaction required from a legitimate user. The flaw carries a CVSS (Common Vulnerability Scoring System — a standardised 0–10 scale for severity) score of 10.0: Critical. Patch today.

Who's at risk: Organisations running Adobe Campaign Classic prior to version 7.4.3 build 9398 on Windows or Linux. Exposure is highest for internet-facing installations.

CVSS: 10.0 (Critical) — Patch today.

Root cause: The software fails to correctly verify whether a requesting party is authorised before executing privileged operations. When authorisation checks are absent or bypassed, the server treats an attacker's request with the same trust as a legitimate administrator's. Adobe has not disclosed the precise technical mechanism publicly.

Attack vector: An attacker sends a crafted request to an affected Campaign Classic server without needing a valid account or any victim to click anything. The server, lacking proper authorisation checks, processes the request and executes attacker-supplied code under the permissions of whatever account the server runs as.

Detection strategies: Review server-side logs for unexpected process spawning from the Campaign Classic service account. Look for outbound connections to unfamiliar hosts originating from the application process. Flag any authentication or permission-related errors that appear in bulk or in unusual sequences.

Recommended actions:

1. Upgrade Adobe Campaign Classic to v7.4.3 build 9398 on all Windows and Linux deployments immediately.
2. Restrict network access to Campaign Classic servers to known, trusted IP ranges.
3. Monitor application logs for anomalous process execution or unexpected outbound traffic.

What Chrome is: Google Chrome is the world's most widely used web browser, installed on billions of devices for everyday browsing, work, and personal use.

What it is: Google's AI security tooling discovered a flaw hiding in Chrome's code for 13 years, disclosed in full this week via Security Week. The vulnerability is an insufficient data validation error in Chrome's Navigation component that allows a sandbox escape (a breakout from the restricted zone where untrusted web content is supposed to run, isolated from your actual files and system).

Who's at risk: Anyone running Chrome below version 145, on any operating system.

CVSS: 9.8 — Critical. Patch this week.

Root cause: Chrome runs web content inside a sandboxed renderer process, a walled-off environment designed to keep untrusted code away from your system. The Navigation component failed to properly validate data passed between that renderer and the browser's core process. This meant a compromised renderer could trick the browser into reading local files it should never be able to access.

Attack vector: An attacker crafts a malicious HTML page and lures the target into visiting it. The page exploits the validation gap in the Navigation component, escaping the sandbox and gaining access to local files on the device.

Recommended actions:

1. Open Chrome, go to Settings → Help → About Google Chrome, and confirm you are on version 145 or later.
2. Enable automatic updates if they are not already on.
3. If you manage a fleet of devices, prioritise this update across all Chrome installations this week.

CVE ID confirmed in source — read the full advisory here.

What Ruby on Rails is: Ruby on Rails is a popular open-source web development framework used to build web applications. Active Storage is its built-in system for handling file uploads.

What the flaw is: A critical vulnerability in Active Storage allows an unauthenticated attacker to read files directly from the web server by uploading a crafted image. Those files can include secrets that unlock deeper access to the entire application.

Who's at risk: Any web application built on the affected Rails versions that accepts image uploads from the public and uses libvips (an image-processing library) for processing. Applications using MiniMagick (an alternative image-processing library) are not exposed through this path.

CVSS: 9.5 — Critical. Patch today.

Root cause: libvips supports certain file-loading operations that its own maintainers flag as unsafe for hostile input. Active Storage did not restrict access to these operations. It passed untrusted uploaded files directly into them. No special upload endpoint was needed — even standard variant generation triggered the vulnerable path.

Attack vector: An attacker uploads a specially crafted file (reportedly a MATLAB/HDF5 format file) through any public upload form. libvips processes it and reads internal server files. The attacker recovers SECRET_KEY_BASE (a master signing key Rails uses to verify session data). With that key, an attacker can forge authenticated session tokens, enabling RCE (remote code execution — running arbitrary commands on the server) or lateral movement (moving from one compromised system into others connected to it).

Detection strategies:

• Unexpected or malformed file types appearing in upload logs (MATLAB, HDF5, or similar scientific formats submitted to image upload endpoints)
• Anomalous outbound network requests from your Rails worker processes, particularly curl-style callbacks to external addresses
• Unrecognised session tokens appearing in application logs after no corresponding login event

Recommended actions:

1. Upgrade Rails to 7.2.3.2, 8.0.5.1, or 8.1.3.1 immediately. Rails 7.1 and earlier are end-of-life and will not receive a backport.
2. If you cannot patch immediately and run libvips 8.13 or later, set the environment variable VIPS_BLOCK_UNTRUSTED=1 or call Vips.block_untrusted(true) via ruby-vips 2.2.1 or later.
3. Rotate all secrets readable by the application process: secret_key_base, master key, database credentials, cloud storage keys, and third-party API tokens.

CVE ID not confirmed in source — check the original advisory before acting.

What OpenWrt is: OpenWrt is an open-source operating system that replaces the factory firmware on home and small-business routers, giving users more control over their network hardware.

What it is: A stack overflow (a flaw where a program writes more data into a fixed memory area than it was designed to hold, overwriting adjacent memory) in the DHCPv6 request handler inside a component called odhcpd. An unauthenticated attacker on the network can trigger it with a single crafted network packet.

Who's at risk: Anyone running OpenWrt versions before 24.10.8 or 25.12.5 with DHCPv6 enabled — the default configuration on most deployments.

CVSS: 9.8 — Critical. Patch today.

Root cause: The odhcpd component processes incoming DHCPv6 requests into a fixed 512-byte stack buffer without adequately checking whether the incoming data fits before appending reply information. Because odhcpd runs as root, and because most embedded routers lack stack canaries (small memory guards that detect overflow attempts) or ASLR (address space layout randomisation, which randomises memory locations to hinder exploit code), an overflow reliably translates into remote code execution rather than just a crash.

Attack vector: An attacker sends a crafted DHCPv6 REQUEST to UDP port 547. No authentication is required. The malformed packet overflows the stack buffer inside odhcpd, allowing the attacker to redirect execution and run arbitrary commands as root. Public proof-of-concept code is available in the advisory.

Detection strategies: Check odhcpd logs for malformed or unexpected DHCPv6 REQUEST messages on port 547. Look for unexpected root-level processes spawned by odhcpd. Monitor for unusual outbound connections from your router immediately after DHCPv6 activity.

Recommended actions:

1. Update to OpenWrt 24.10.8 or 25.12.5 using the OpenWrt Firmware Selector.
2. If you cannot patch immediately, consider disabling DHCPv6 on interfaces not actively using IPv6.
3. Begin planning migration to the 25.12 series before the 24.10 branch reaches end of life in September 2026.

What TeamCity is: TeamCity is a continuous integration and delivery server made by JetBrains — software used by development teams to automatically build, test, and deploy code.

What it is: A critical authentication bypass that allows an unauthenticated attacker to reach internal server functionality and execute operating system commands — all without ever logging in.

Who's at risk: Any organisation running TeamCity On-Premises with an internet-facing or network-accessible server. TeamCity Cloud instances are already patched.

CVSS: 9.8 — Critical. Patch today.

Root cause: The flaw sits in the agent polling protocol, a communication channel normally used by build agents (automated workers) to check in with the TeamCity server. The server failed to properly enforce authentication checks on this channel, meaning an attacker can send requests through it as if they were a legitimate agent and reach privileged functionality they should never be able to access. Think of it like a staff entrance with a broken lock — the front desk checks every visitor, but this side door waves anyone through.

Attack vector: An attacker with HTTP or HTTPS access to the TeamCity server sends crafted requests through the agent polling endpoint, bypassing authentication entirely. Once past that check, they can issue operating system commands that run with the same permissions as the TeamCity server process itself — which in many deployments means access to stored credentials, build configurations, source code, and deployment pipelines. No user interaction and no existing account is required.

Detection strategies:

1. Review TeamCity server logs for unexpected or unauthenticated requests to agent polling endpoints, particularly from unfamiliar IP addresses.
2. Check for unexpected outbound connections from the TeamCity host, especially to unusual destinations.
3. Audit recently modified build configurations, stored credentials, or administrator accounts for changes you did not make.

Recommended actions:

1. Upgrade to TeamCity On-Premises version 2025.11.7 or 2026.1.3 immediately.
2. If upgrading now is not possible, install JetBrains' security patch plugin (available for versions 2017.1 and above) as an interim measure.
3. Place the TeamCity server behind a VPN or restrict network access so it is not reachable from the public internet.

What Fastjson is: Fastjson is an open-source Java library maintained by Alibaba that parses and generates JSON (a common data exchange format), used extensively in enterprise web services and APIs.

What it is: An attacker can send a specially crafted JSON request containing a malicious @type field (a directive that tells Fastjson which Java class to load) to a vulnerable application endpoint. Without any prior authentication or special privileges, this causes the server to load and execute attacker-controlled code.

Who's at risk: Developers and organisations running Java applications packaged as Spring Boot fat-JARs (self-contained executable files that bundle all dependencies) using Fastjson versions 1.2.68 through 1.2.83 with SafeMode left at its disabled default. Standard WAR deployments on Tomcat or Jetty are not affected.

CVSS: 9.0 (Critical — patch today; no fix yet exists, so apply mitigations immediately.)

Root cause: Fastjson's type-resolution path trusts an attacker-supplied @type value and converts it into a class-resource lookup. When running inside a Spring Boot fat-JAR, this lookup can traverse nested JAR paths, fetch attacker-controlled bytecode from a remote location, and then treat an @JSONType annotation in that retrieved resource as a verification signal. Because that annotation is treated as evidence the class is trustworthy, Fastjson loads and executes the class. The developer failure here is allowing attacker-controlled input to influence which code gets loaded and trusted at runtime — without any independent validation.

Attack vector: An attacker identifies a network-reachable endpoint that passes user-supplied JSON to JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class). They submit a payload embedding a crafted @type value pointing to a nested JAR path they control. Fastjson follows that path, retrieves the attacker's bytecode, reads the @JSONType annotation as a trust signal, and loads the class — executing the attacker's code with the full privileges of the Java process. No login, no existing access, and no classpath manipulation required.

Detection strategies:

1. Look for outbound connections from your Java application process to unexpected external hosts, particularly fetching .jar files.
2. Monitor application logs for @type values referencing unusual class names, nested JAR paths, or /proc/self/fd references.
3. Watch for unexpected child processes spawned by your Java application, or new files appearing in application directories without a deployment event.

Recommended actions:

1. Inventory all Fastjson dependencies, including transitive ones pulled in by other libraries, and confirm whether versions 1.2.68–1.2.83 are present.
2. Apply the immediate mitigation: add -Dfastjson.parser.safeMode=true to your JVM startup flags, or switch to the com.alibaba:fastjson:1.2.83_noneautotype build.
3. Begin planning migration to Fastjson2, which does not share this type-resolution path and is Alibaba's stated long-term fix.

What Active Directory Certificate Services is: Microsoft's built-in system for issuing digital certificates inside a corporate Windows network — used to prove that computers and users are who they claim to be.

What it is: A low-privileged domain user can trick the certificate authority into signing a certificate that belongs to a Domain Controller. That certificate then grants attacker-level access to the entire directory. Researchers codenamed it Certighost. A working public exploit was published on 24 July, per The Hacker News.

Who's at risk: Any organisation running an Enterprise Certificate Authority on Windows Server. No administrator account required — a standard domain login is enough.

CVSS: 8.8 (High — patch this week. Do not delay.)

Root cause: The certificate authority followed attacker-supplied directions about which server to contact during a fallback enrollment step, without first verifying it was a real Domain Controller. Microsoft's July 14 patch adds that verification check.

Attack vector: The attacker creates or reuses a computer account, runs rogue SMB (Server Message Block — a Windows file-sharing protocol) and LDAP (Lightweight Directory Access Protocol — a directory lookup protocol) listeners, and relays the certificate authority's authentication challenge to the real Domain Controller. The CA returns a certificate for the Domain Controller. The attacker uses that certificate to request all account password hashes via DCSync (a technique that impersonates directory replication to pull credential secrets).

Detection strategies: Monitor for new computer account creation by standard user accounts. Alert on unexpected SMB or LDAP connections originating from non-server hosts. Check for DCSync operations performed by accounts that are not Domain Controllers.

Recommended actions:

1. Install Microsoft's July 14 cumulative update on all AD CS hosts immediately.
2. If patching is delayed, apply the chase-fallback mitigation documented in the researchers' advisory.
3. Review logs for computer account creation by non-admin users in the past 30 days.

CVE ID not confirmed in source — check the original advisory before acting.

PTC Windchill and FlexPLM are enterprise Product Lifecycle Management (PLM) platforms — software used by engineering, manufacturing, and supply chain teams to design and manage products from concept through to production. They are widely used in aerospace, defence, automotive, and medtech.

What it is: CVE-2026-12569 is a critical unsafe deserialization vulnerability (a flaw where an application processes attacker-supplied data as trusted executable instructions without verifying it first). Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the vulnerable server, as reported by Bleeping Computer.

Who's at risk: Any organisation running internet-exposed Windchill or FlexPLM instances that has not applied the patches released from 17 June 2026. PTC serves over 30,000 customers globally.

CVSS: 9.3 (Critical — patch this week. This is actively being exploited.)

Root cause: The application deserializes attacker-controlled input without validating whether the resulting object is safe to process. Think of it like a mailroom that opens every parcel and assembles its contents without checking whether the instructions inside are legitimate or malicious. The server trusts the data structure entirely, allowing attackers to embed executable instructions inside a crafted request.

Attack vector: An unauthenticated attacker sends a specially crafted HTTP request to an internet-exposed Windchill or FlexPLM instance. The server deserializes the payload, executes the embedded code, and the attacker gains remote control. From there, Clop operators have been deploying JSP webshells (small server-side scripts that give persistent remote command access) to extract sensitive product design and manufacturing data.

Detection strategies: Look for unexpected JSP files in application directories. Monitor outbound connections from PLM servers to unfamiliar external IPs. Check for extortion emails arriving from support@cryptohox.com, a confirmed Clop contact address.

Recommended actions:

1. Apply PTC's security patches (available from 17 June 2026) immediately.
2. Place Windchill and FlexPLM instances behind a VPN or trusted access gateway — remove direct internet exposure.
3. If compromise is suspected, isolate the affected server, collect forensic logs, and rotate all exposed credentials before restoring service.

What Windmill is: Windmill is an open-source developer platform that lets teams build and run automated scripts, workflows, and internal tools through a web interface.

What it is: An unauthenticated path traversal flaw (where an attacker navigates outside the intended file directory by inserting ../ sequences into a file request) in Windmill's log file retrieval endpoint. No login is required to trigger it.

Who's at risk: Anyone running a Windmill instance below version 1.603.3 that is exposed to the internet. VulnCheck identified approximately 170 vulnerable systems across 24 countries. Risk is highest where the SUPERADMIN_SECRET environment variable is configured, as reading it grants full superadmin access and arbitrary code execution.

CVSS: 7.5 (High) — patch this week.

Root cause: The filename parameter passed to the get_log_file endpoint was concatenated directly into a file path with no sanitisation checks. The server trusted whatever string the user supplied and opened the corresponding file. Version 1.603.3 adds input sanitisation to block traversal sequences.

Attack vector: An attacker sends a crafted unauthenticated request to /api/w/{workspace}/jobs_u/get_log_file/{filename}, substituting the filename for a traversal string such as ../../../proc/1/environ. The server returns the contents of that file. If SUPERADMIN_SECRET is present in that environment file, the attacker uses it as a Bearer token to authenticate as superadmin and execute arbitrary code. Active exploitation has targeted /etc/passwd for credential reconnaissance.

Detection strategies:

1. Look for HTTP requests to /api/w/*/jobs_u/get_log_file/ containing ../ or %2e%2e sequences in server access logs.
2. Monitor for unexpected reads of /etc/passwd or /proc/1/environ in file access logs.
3. Alert on any Bearer token authentication from IP addresses that have not previously logged in.

Recommended actions:

1. Upgrade Windmill to version 1.603.3 or later immediately.
2. Restrict public internet access to the Windmill management interface.
3. Rotate the SUPERADMIN_SECRET value and audit recent superadmin session activity.

CVE ID confirmed in source — verify details at the official Microsoft advisory before acting.

What Microsoft SharePoint Server is: SharePoint is Microsoft's on-premises collaboration platform used by organisations to host internal websites, share documents, and manage team workflows.

What it is: A critical deserialization flaw — where a server processes attacker-supplied data as trusted instructions rather than plain input — allows an unauthenticated attacker to run arbitrary code remotely. Reported by The Hacker News.

Who's at risk: Any organisation running on-premises SharePoint Server (Subscription Edition, 2019, or 2016) that has not applied Microsoft's July 2026 Patch Tuesday update. Cloud-hosted SharePoint Online is not affected.

CVSS: 9.8 — Critical. Patch today.

Root cause: The server deserializes (converts back into executable objects) data submitted through a SharePoint sign-in endpoint without first confirming the data is safe. Think of it like a mail room that opens every package and executes whatever instructions are inside, without checking the sender. Attackers submit a crafted payload that the server converts into runnable code.

Attack vector: Security firm watchTowr has observed active exploitation following the release of a public proof-of-concept. Attackers are sending a single unauthenticated request to extract the server's machine keys. Those keys can then be used to forge trusted tokens and maintain persistent access even after a patch is applied — which is why credential rotation matters as much as patching here.

Detection strategies: Look for unauthenticated POST requests to SharePoint sign-in endpoints; unexpected machine key access in IIS logs; and any newly persisted .NET deserialization payloads in SharePoint application directories.

Recommended actions:

1. Apply Microsoft's July 2026 Patch Tuesday update immediately.
2. Rotate machine keys and credentials on any SharePoint server that may have been exposed before patching.
3. Review IIS logs for suspicious unauthenticated requests to sign-in endpoints dating back to the PoC release.

CVE ID not confirmed in source — check the original advisory before acting.

What ServiceNow is: ServiceNow is a cloud-based platform used by businesses to manage IT operations, employee workflows, and customer service processes.

What it is: CVE-2026-6875 is a sandbox escape vulnerability — meaning an attacker can break out of the restricted code environment ServiceNow uses to run user-submitted logic, then execute arbitrary code (run any command they choose) on the underlying server, all without logging in.

Who's at risk: Organisations running self-hosted ServiceNow instances that have not applied the June 2026 patches. Cloud-managed customers on supported versions should confirm their instance is current.

CVSS: 9.5 (Critical — patch today).

Root cause: The flaw exists in a pre-authentication endpoint (/assessment_thanks.do), meaning the server processes attacker-controlled input before verifying who is sending it. The sandbox meant to contain that code execution can be escaped via a documented gadget chain, giving the attacker full control of the ServiceNow instance and any connected proxy servers.

Attack vector: An attacker sends an HTTP POST request to the publicly accessible /assessment_thanks.do endpoint with a crafted payload. No credentials are needed. The sandbox escape gadget routes the request to the same code execution primitive identified in the published proof-of-concept exploit, resulting in complete instance compromise. Active exploitation has been observed in the wild.

Detection strategies: Look for unexpected POST requests to /assessment_thanks.do in your web server logs. Monitor for new or unusual processes spawned by the ServiceNow application user. Alert on any outbound connections from your ServiceNow host to unfamiliar external IP addresses.

Recommended actions:

1. Apply the June 2026 patches immediately (Brazil EA/GA, Australia Patch 2, Zurich Patch 7b/9, Yokohama Patch 12 HF1b/13).
2. Restrict external access to your ServiceNow instance at the network level where possible.
3. Review ServiceNow logs for POST activity against the affected endpoint going back to April 2026.

What NGINX is: NGINX is a web server used by a large portion of the internet to deliver websites and handle web traffic — it sits between your browser and the application behind it.

What it is: A heap buffer overflow (a flaw where a program writes more data into a reserved memory block than it can hold, corrupting adjacent memory) in NGINX's string-assembly engine. It is triggered by a specific server configuration involving regex-based map directives. Read the full advisory here.

Who's at risk: Any server running NGINX 0.9.6 through 1.31.2 with the affected regex map configuration. This includes NGINX Plus and related F5 products.

CVSS: 9.2 (Critical — patch today).

Root cause: NGINX's two-pass evaluation system measures the required buffer size in one pass, then writes data in a second. A regex evaluated between passes overwrites the shared capture state. The buffer is sized for the original value but filled with attacker-controlled data, causing the overflow.

Attack vector: A remote, unauthenticated attacker sends a crafted HTTP request. On servers where ASLR (address space layout randomisation, a memory protection mechanism) is disabled, this may enable remote code execution (RCE). One researcher argues the flaw itself can bypass ASLR on default Ubuntu 24.04 systems.

Detection strategies: Watch for unexpected NGINX worker crashes or restarts in your process logs. Unusual or malformed HTTP requests in access logs — particularly oversized or regex-heavy payloads — warrant investigation.

Recommended actions:

1. Upgrade to NGINX 1.30.4 (stable) or 1.31.3 (mainline), or NGINX Plus 37.0.3.1.
2. If patching immediately is not possible, switch affected regex maps to named captures as a temporary mitigation.
3. Monitor for unexpected worker restarts as a potential sign of active probing.

CVE ID not confirmed in source — check the original advisory before acting.

What 7-Zip is: 7-Zip is a free, widely used file compression and extraction tool for Windows that handles formats including ZIP, RAR, and XZ archives.

What it is: A heap-based buffer overflow (a flaw where a program writes more data than a memory region can hold, spilling into adjacent memory) exists in how 7-Zip processes XZ-compressed archive data. A specially crafted archive file can trigger this overflow and allow an attacker to run arbitrary code on the victim's machine, according to Bleeping Computer.

Who's at risk: Anyone running 7-Zip below version 26.02 on Windows who opens archive files from untrusted sources.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: 7-Zip's XZ decompression routine failed to track remaining available space in the output buffer correctly. Without that check, the decoder could write beyond the buffer's boundary, corrupting adjacent memory in a way an attacker can control. The fix in version 26.02 adds a boundary check so the decoder stops before overflowing.

Attack vector: An attacker crafts a malicious XZ archive and delivers it via phishing email or a compromised download link. The victim opens the file in 7-Zip. During decompression, the malformed data triggers the buffer overflow. The attacker's code executes with the same privileges as the user who opened the file. No elevated access is needed on the attacker's side — just a convincing enough reason for the victim to open the file. Think of it like a parcel that explodes when the recipient cuts the tape.

Detection strategies: Watch for 7-Zip processes spawning unexpected child processes (particularly cmd.exe or PowerShell). Monitor for unusual outbound network connections originating from the 7-Zip process. Check for newly created scheduled tasks or registry run keys appearing immediately after archive extraction.

Recommended actions:

1. Download and install 7-Zip version 26.02 manually from 7-zip.org — there is no automatic update.
2. Until patched, avoid opening archive files received from unknown senders or unfamiliar websites.
3. If you manage endpoints, consider application control policies that alert on unexpected child processes spawned by archive utilities.

What WordPress is: WordPress is the software that powers roughly half of all websites on the internet, from personal blogs to major news outlets.

What it is: A flaw in WordPress's REST API (the interface that lets external tools communicate with a site) batch-route endpoint can be chained with a separate SQL injection (a technique where an attacker inserts malicious database commands into a field that should only accept plain data) to let a completely anonymous user run code on any affected site. No login required.

Who's at risk: Any site running WordPress 6.9.0 through 7.0.1. Sites on 6.8.x are exposed to the SQL injection component only, not the full code-execution chain. A working proof-of-concept is publicly available.

CVSS: 7.5 (High — patch this week). Note: WordPress's own advisory rates the RCE chain Critical; the formal CVE score does not fully reflect code-execution impact. Treat this as Critical and patch today.

Root cause: WordPress's WP_Query function fails to check whether the author__not_in parameter is an array before using it. When a string is passed instead, the raw value drops into the database query unfiltered. The batch endpoint separately allows sub-request arrays to fall out of sync when one sub-request errors, causing a subsequent request to run under the wrong handler and bypass the endpoint's access controls.

Attack vector: An unauthenticated attacker sends a crafted batch request to /wp-json/batch/v1. A deliberate error in one sub-request shifts the handler assignment. The attacker's input then reaches the vulnerable WP_Query parameter, executing arbitrary database commands and ultimately arbitrary code on the server.

Recommended actions:

1. Update to WordPress 6.8.6, 6.9.5, or 7.0.2 immediately. Auto-updates may not have applied if you disabled them — verify manually.
2. Check your version now at wp2shell.com, where Searchlight Cyber has published a dedicated checker.
3. Review server logs for unusual requests to /wp-json/batch/v1.

What FortiSandbox is: A Fortinet security product that analyses suspicious files and network traffic in an isolated environment to detect malware before it reaches the rest of a network.

What it is: An OS command injection vulnerability (where an attacker sends specially crafted input that the system mistakenly runs as a system-level command) that allows an unauthenticated attacker to execute arbitrary commands via malicious HTTP requests.

Who's at risk: Any organisation running an unpatched FortiSandbox deployment reachable from the internet. No login required to exploit this.

CVSS: 9.1 — Critical. Patch today.

Root cause: The software fails to properly sanitise user-supplied input before passing it to underlying system functions. Think of it like a form that accepts your name but also accidentally runs anything you type as a terminal command.

Attack vector: An attacker sends a crafted HTTP request to the FortiSandbox interface — no credentials, no user interaction needed. The system processes the malicious input as a command and executes it with elevated privileges.

Recommended actions:

1. Upgrade to FortiSandbox 4.4.9 or 5.0.6 immediately.
2. If running cloud or PaaS versions without an available patch, discontinue use until patched.
3. Restrict external access to the FortiSandbox management interface at the network level.

CVE ID not confirmed in source — check the original advisory before acting.

What Zoom is: Zoom is the video conferencing and online meetings platform used by hundreds of millions of people worldwide for work calls, webinars, and remote collaboration.

What it is: A critical input validation flaw — where software fails to properly check data it receives before acting on it — in Zoom's Windows client that could allow an unauthenticated attacker to take over a victim's account entirely. No login required on the attacker's end.

Who's at risk: Anyone running Zoom Desktop Client for Windows, Zoom VDI Client for Windows, or Zoom Meeting SDK for Windows on an unpatched version. The attack is possible over a network connection.

CVSS: 9.8 (Critical — patch today, do not delay).

Root cause: The application does not properly validate input received over the network before processing it. Think of it like a reception desk that waves through anyone claiming to be a guest without checking their name against the list — and then hands them a master key.

Attack vector: An attacker with network access sends malformed input to the Zoom client. Because the application does not verify what it receives, the attacker can manipulate the client's behaviour, ultimately gaining control of the account. No interaction from the victim is required beyond having Zoom running.

Recommended actions:

1. Open Zoom and update to the latest version immediately via Help → Check for Updates.
2. If you manage Zoom across an organisation, push the update via your MDM or endpoint management platform today.
3. Monitor for any unexpected account activity or unauthorised sessions in your Zoom admin console.

What SonicWall SMA 1000 is: A hardware and virtual appliance that organisations use to give remote workers secure access to internal corporate networks and applications.

What it is: An SSRF vulnerability (Server-Side Request Forgery — a flaw where an attacker tricks a server into making network requests on their behalf, effectively using the server as a proxy to reach internal systems) that can be triggered by anyone on the internet, no login required. SonicWall confirmed active exploitation in multiple investigated cases.

Who's at risk: Any organisation running an internet-exposed SMA 1000 appliance on a firmware version below the patched releases. No authentication is required to trigger this flaw.

CVSS: 10.0 (Critical — patch today. Stop reading, go patch.)

Root cause: The appliance's web-facing API does not adequately validate or restrict the destination of outbound requests it generates. When the server accepts a user-controlled value and uses it to construct an outbound request without checking whether that destination is legitimate, an attacker can point it anywhere — including internal infrastructure that should never be reachable from outside.

Attack vector: A remote, unauthenticated attacker sends a crafted HTTP request to the appliance's public-facing API endpoint. The request contains an attacker-controlled destination address. Because the appliance fails to validate this input, it forwards the request to the specified location — which may be an internal server, a cloud metadata service, or other network resource behind the firewall. The appliance's response to the attacker reveals information about that internal destination, giving the attacker a foothold to map internal infrastructure or pivot further. No credentials are needed at any step.

Detection strategies:

1. In extraweb_access.log, look for HTTP 200 responses to requests targeting /__api__/login or /__api__/logout — these URIs do not exist in legitimate appliance configuration and should never appear with a success status.
2. In extraweb_access.log, look for requests to /wsproxy with unusual or unexpected host parameters returning HTTP 101 (connection upgrade) status codes.
3. Check whether /var/lib/unit/conf.json contains routing entries for /__api__/login or /__api__/logout — their presence in that file indicates the configuration has been tampered with.
4. In ctrl-service.log, look for hotfix rollbacks that reference path traversal names (file paths containing sequences like ../ that are designed to escape expected directories).

Recommended actions:

1. Upgrade immediately to firmware version 12.4.3-03453 or 12.5.0-02835 (or higher). CISA's patch deadline for federal agencies is July 17, 2026 — everyone else should treat that date as their own deadline.
2. If any of the detection indicators above are present, re-image physical appliances or redeploy virtual ones from scratch. Do not attempt to clean a potentially compromised appliance in place.
3. After patching or reimaging, rotate all user and administrator passwords and reset any time-based one-time password (TOTP) tokens associated with the appliance.

What Balbooa Forms is: A drag-and-drop form builder for Joomla websites that lets site owners create contact forms with file upload functionality.

What it is: The plugin fails to restrict which file types users can upload. An attacker can submit a PHP script through the form's upload feature and trigger it to run on the server, achieving RCE (remote code execution — the ability to run arbitrary commands on a machine they don't own).

Who's at risk: Any Joomla site running Balbooa Forms below version 2.4.1. CISA has added this to its Known Exploited Vulnerabilities (KEV) catalog, meaning active exploitation is confirmed in the wild, according to Bleeping Computer.

CVSS: Not yet scored — treat as Critical. CISA ordered federal agencies to patch within three days.

Root cause: The upload feature lacks validation on file type. Think of it as a secure post box with a slot wide enough to fit a crowbar — the opening exists for legitimate use, but nothing checks what comes through it.

Attack vector: An attacker visits a Joomla site running the vulnerable plugin, submits a PHP file through the public-facing upload form, then navigates directly to that file's URL on the server to execute it. This worked as a zero-day from July 8, one day before a patch was released.

Recommended actions:

1. Update Balbooa Forms to version 2.4.1 immediately.
2. Audit your server for unexpected PHP files in upload directories.
3. If you cannot patch immediately, disable file upload functionality in the plugin settings.

CVE ID not confirmed in source — check the original advisory before acting.

What a CMS is: A content management system (CMS) is software that powers websites, letting users publish and manage content without writing code directly. WordPress, Drupal, and Joomla are common examples.

What it is: Australia's cybersecurity agency has issued a warning about an active global campaign targeting websites running outdated or unpatched CMS platforms, according to Bleeping Computer. Full technical details were not available at the time of writing, but the advisory signals active exploitation in the wild.

Who's at risk: Anyone running a website built on a CMS platform that has not been recently updated. Small businesses, personal sites, and organisations without dedicated IT support are particularly exposed.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: CMS platforms are complex, widely deployed, and frequently extended with third-party plugins. Older versions accumulate known vulnerabilities that attackers scan for and exploit systematically. Unpatched installs are standing targets.

Attack vector: Attackers scan the internet for CMS installations matching known vulnerable version signatures. Once identified, they deliver exploit payloads targeting those specific flaws, potentially gaining the ability to alter site content, steal visitor data, or use the server as a launchpad for further attacks.

Detection strategies: Check your CMS admin panel for a version number and compare it against the vendor's latest release. Review recent file modification timestamps in your web root for unexpected changes. Monitor for new admin user accounts you did not create.

Recommended actions:

1. Update your CMS and all installed plugins to their latest versions today.
2. Remove or disable any plugins or themes that are no longer maintained.
3. Enable login attempt limiting and two-factor authentication on your CMS admin account.

What Gitea is: Gitea is an open-source, self-hosted platform for storing and managing source code — think a version of GitHub or GitLab that a company runs on its own servers.

What it is: The official Gitea Docker image (a pre-packaged container used to deploy Gitea quickly) shipped with a configuration that trusted identity headers from any IP address on the internet. An attacker could send a single HTTP header claiming to be any user, including an administrator, and Gitea would believe them — no password required.

Who's at risk: Anyone running the official Gitea Docker image up to and including version 1.26.2 with default settings. Roughly 6,200 Gitea instances are currently exposed on the public internet, though the exact number of vulnerable deployments is unknown.

CVSS: Critical. Patch today.

Root cause: The Docker image set REVERSE_PROXY_TRUSTED_PROXIES=*, meaning it accepted the X-WEBAUTH-USER header (a field that tells Gitea who the user is) from any source, not just from a trusted internal proxy. Think of it like a hotel front desk that accepts a note saying "I'm the hotel manager" from anyone who walks in off the street — with no ID check whatsoever.

Attack vector: An attacker sends a standard HTTP request to an exposed Gitea instance and includes a header naming any account — admin, gitea_admin, or any known username. Gitea processes the header as a verified identity and grants full access. No credentials, no tokens, one line of a request. Sysdig researchers confirmed active exploitation began at least 13 days before public disclosure.

Detection strategies: Review access logs for requests containing X-WEBAUTH-USER headers arriving from external IP addresses. Look for unexpected admin account activity, particularly repository access, user creation, or settings changes. Check for authentication events with no corresponding password or token validation entries.

Recommended actions:

1. Upgrade to Gitea version 1.26.4 immediately (1.26.3 introduced a regression; 1.26.4 resolves both the CVE and that regression).
2. If upgrading is not immediately possible, set REVERSE_PROXY_TRUSTED_PROXIES to specific trusted IP addresses rather than the wildcard *.
3. Review access logs for suspicious activity to determine whether compromise has already occurred.

What UniFi Connect is: UniFi Connect is a Ubiquiti platform for managing displays, intercom systems, and building access hardware — popular in small offices, schools, and home setups.

What it is: This flaw allows anyone on the same network to inject and execute arbitrary commands directly on the host device, with no authentication required. It is an improper access control vulnerability, meaning the software fails to verify whether a user has permission before carrying out sensitive operations.

Who's at risk: Anyone running UniFi Connect Application version 3.4.16 or earlier on a network where other users or devices are present. Home lab users, small businesses, and schools using Ubiquiti gear are all in scope.

CVSS: 10.0 (Critical) — Patch today. This is a perfect score. Stop reading, go patch.

Root cause: The application does not enforce access controls before processing certain commands. A network-adjacent attacker can send a crafted request that the device treats as a trusted instruction, then execute commands at the system level. There is no authentication barrier in the way.

Attack vector: An attacker on the local network sends a specially crafted request to the UniFi Connect service. The device processes it without checking who sent it, executes the embedded command, and hands the attacker control of the host. No credentials needed.

Recommended actions:

1. Update UniFi Connect Application to version 3.4.20 or later immediately.
2. Restrict network access to UniFi management interfaces to trusted devices only.
3. Review other UniFi products in your environment — Ubiquiti patched six additional critical flaws across UniFi Talk, Access, Protect, and OS in the same release cycle.

CVE ID confirmed in source — see the full disclosure from The Hacker News.

What the Linux Kernel is: The kernel is the core of the Linux operating system — the layer that manages memory, processes, and hardware on behalf of every program running on the machine.

What it is: Researchers at Nebula Security disclosed GhostLock, a flaw that lets any logged-in user gain full root (administrator-level) control of an unpatched Linux machine. It has existed in the codebase since 2011 and requires no special permissions or network access to trigger.

Who's at risk: Anyone running an unpatched Linux system — particularly cloud servers, shared hosting environments, containers, and CI runners (automated build systems) where an attacker may already have low-level local access.

CVSS: 7.8 (High — patch this week. Do not put this one off.)

Root cause: The flaw lives in the kernel's futex (fast userspace mutex — a primitive that coordinates access between competing processes) priority inheritance code. When a lock operation hits a dead end and backs out, a cleanup routine fires at the wrong moment and wipes the wrong task's record. The kernel is then left holding a pointer — a reference to a memory address that has already been freed and reassigned. Trusting that stale pointer is a use-after-free vulnerability (acting on memory that has been handed to someone else, like a hotel key-card that still opens a room after check-out).

Attack vector: From a standard local user account, an attacker triggers the flawed futex path to corrupt kernel memory. Nebula's team chained several steps from that corruption to redirect kernel execution, ending with arbitrary code running at root level. The published exploit achieves this in roughly five seconds on tested hardware. Because Nebula has released working exploit code publicly, any attacker can now run it without needing to understand the underlying mechanics.

Detection strategies:

1. Unexpected privilege escalation events in system audit logs — look for a non-root process spawning root-level child processes without a corresponding authorised sudo call.
2. Kernel crash logs (check /var/log/kern.log or journalctl -k) referencing futex or memory faults may indicate failed exploitation attempts.
3. On systems with eBPF (extended Berkeley Packet Filter — a kernel feature that lets programs observe system activity in real time) monitoring enabled, watch for anomalous syscall sequences from unprivileged processes targeting futex operations.

Recommended actions:

1. Install your distribution's latest kernel update — confirm the patch includes commit 3bfdc63936dd and verify it is not an early build that introduced the subsequent crash bug CVE-2026-53166.
2. Prioritise patching shared and multi-tenant machines first: cloud servers, containers, and CI runners are highest risk.
3. If patching is delayed, enable RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER build options as partial mitigations — these raise the bar for exploitation but do not close the flaw.

What Adobe ColdFusion is: A commercial platform used by developers to build and deploy enterprise websites and web applications.

What it is: A maximum-severity flaw allowing an unauthenticated attacker — one with no account or prior access — to execute arbitrary code remotely on an unpatched ColdFusion server. Adobe released a patch and urged administrators to apply it within 72 hours, per Bleeping Computer.

Who's at risk: Any organisation running ColdFusion versions 2025.9, 2023.20, or earlier with internet-facing deployments.

CVSS: 10.0 (Critical — patch today, full stop.)

Root cause: The flaw requires no authentication and no user interaction to trigger. An attacker simply sends a crafted request to the server. The underlying failure is in how ColdFusion handles external input before verifying who is sending it, allowing code execution before any identity check occurs.

Attack vector: Exploitation began within two hours of Adobe's public disclosure, captured by KEVIntel's global honeypot network. An attacker sends a malicious HTTP request to an exposed ColdFusion instance, gains code execution, and can subsequently read files, install backdoors, or pivot deeper into the network. No credentials needed.

Detection strategies: Look for unexpected outbound connections from your ColdFusion server, unusual process spawning from the ColdFusion service account, and unfamiliar files written to the web root directory.

Recommended actions:

1. Apply Adobe's patch immediately — the 72-hour window has already passed for most organisations.
2. Place ColdFusion servers behind a web application firewall (WAF) if not already done.
3. Restrict external access to ColdFusion admin interfaces at the network level.

What ClamAV is: ClamAV is a free, open-source antivirus scanning engine maintained by Cisco's Talos group, widely used inside email gateways, file upload systems, and security tooling at organisations of all sizes.

What it is: CVE-2026-20215 is a flaw in ClamAV's parser for 7z archives (a compressed file format). When processing a crafted 7z file, the parser mishandles a substream count value in a way that causes it to allocate too little memory, then write data beyond the boundary of that allocation — a classic heap overflow (writing data outside a reserved memory block, like overfilling a labelled box and spilling into the next one). This is one of seven flaws patched in ClamAV releases 1.5.3 and 1.4.5, as reported by Help Net Security.

Who's at risk: Any system running ClamAV that scans untrusted or user-submitted archive files — mail gateways, file upload services, and endpoint security tools are all exposed if unpatched.

CVSS: Not yet scored — treat as High until confirmed. Patch this week.

Root cause: The parser fails to validate the substream count before using it to calculate memory allocation size. A value crafted to be unexpectedly large causes the system to allocate insufficient space, after which the parser writes beyond that space when reading the archive's contents. The developer did not enforce an upper bound on the count before allocation.

Attack vector: An attacker crafts a malformed 7z archive and submits it to any service that scans files with ClamAV — an email attachment, a file upload form, or a shared folder under active monitoring. When ClamAV processes the file, the malformed substream count triggers the overflow. Depending on what sits in adjacent memory, this could crash the scanner or potentially be developed into code execution.

Detection strategies: Monitor for unexpected ClamAV process crashes or restarts. Look for scan jobs that terminate without producing a result on 7z files specifically. Unusual volumes of malformed archive submissions from a single source are worth investigating.

Recommended actions:

1. Upgrade ClamAV to version 1.5.3 (recommended) or 1.4.5 immediately — both are available on the ClamAV GitHub releases page.
2. If immediate patching is not possible, restrict ClamAV from scanning untrusted 7z archives at the gateway level as a temporary measure.
3. Enable logging for scanner crashes and set up alerts if the ClamAV daemon exits unexpectedly.

What SimpleHelp is: SimpleHelp is a remote support and monitoring tool used by IT teams and managed service providers to access and manage computers remotely.

What it is: CVE-2026-48558 is an authentication bypass (a flaw that lets attackers skip the login process entirely) in SimpleHelp RMM. Attackers are actively exploiting it to install Djinn Stealer on victim machines.

Who's at risk: Any organisation running an unpatched SimpleHelp RMM server that is reachable from the internet.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: The flaw exists in SimpleHelp's authentication layer, which fails to properly verify that a request comes from a legitimate, credentialed user before granting access. An attacker can craft a request that bypasses this check entirely. Think of it like a staff entrance that checks for a badge but accepts a blank card.

Attack vector: An attacker sends a specially crafted request to an exposed SimpleHelp server. The server skips credential validation and grants access. The attacker then deploys Djinn Stealer, which harvests credentials for cloud platforms, source control systems, package registries, and AI development tools across Windows, macOS, and Linux.

Detection strategies:

• Unexpected new processes or files appearing on machines managed via SimpleHelp
• Outbound connections to unfamiliar hosts from the SimpleHelp server process
• Credential alerts from cloud platforms shortly after SimpleHelp activity

Recommended actions:

1. Apply the vendor patch immediately — check the official SimpleHelp advisory
2. Restrict SimpleHelp server access to trusted IP ranges only
3. Audit logs for unauthorised access attempts against your SimpleHelp instance

CVE ID confirmed in source — see the full runZero advisory before acting.

What FatFs is: FatFs is a tiny open-source library that lets embedded devices — security cameras, drones, hardware crypto wallets, industrial controllers — read and write USB drives and SD cards using the FAT and exFAT formats found on most removable storage.

What it is: An integer overflow (a maths error where a calculation wraps around and produces a nonsense result) in the code that mounts a FAT32 volume can generate a false file size. Downstream memory operations treat that false value as real, which can corrupt the device's memory and allow an attacker to run their own code.

Who's at risk: Any device running firmware that uses FatFs to handle removable storage or firmware update files. This includes consumer IoT products, industrial equipment, drones, and crypto wallets built on platforms such as Espressif ESP-IDF, Zephyr, MicroPython, ArduPilot, and others. Physical access to a USB or SD slot is the most common trigger, though some firmware update flows can be reached without physical media at all.

CVSS: 7.6 (High) — patch this week. Do not delay.

Attack vector: An attacker crafts a malformed FAT32 storage image on a USB drive or SD card and inserts it into the target device. FatFs processes the volume header, the integer overflow fires, and the resulting false size value propagates into memory operations without further validation. On hardware lacking standard memory protections — common in embedded systems — this becomes code execution. Some firmware update pipelines that parse FAT volumes can trigger the same path remotely.

Recommended actions:

1. If you build firmware that handles FAT or exFAT media, audit which version of FatFs you bundle and apply any vendor-supplied patches immediately.
2. Check whether your platform vendor (Espressif, STMicroelectronics, Zephyr, etc.) has issued a patched SDK release and update to it.
3. Where possible, restrict physical access to USB and SD ports on deployed devices — especially kiosks, ATMs, or public-facing hardware.

What Cursor is: Cursor is an AI-powered code editor used by software developers to write, edit, and review code, with a built-in AI agent that can execute terminal commands automatically on the developer's behalf.

What it is: Researchers at Cato Networks discovered a critical flaw, part of a vulnerability set referred to as DuneSlide (the collective name given to this pair of related flaws by Cato), that allows an attacker to break out of Cursor's sandbox (the restricted environment designed to contain what the AI can touch) and execute commands directly on the underlying operating system. A companion flaw also exists but is tracked separately. Full details are in the Security Week advisory.

Who's at risk: Developers running Cursor on any operating system who have not yet updated to version 3.0.

CVSS: 9.8 — Critical. Patch today.

Root cause: Cursor's sandbox is supposed to restrict the AI agent's terminal commands to the current working directory. However, when a non-default value is assigned to the working_directory parameter, that path gets added to the system's allow list without proper validation. This means an attacker-controlled value can expand the sandbox boundary to include locations outside the project — locations the developer never intended the AI to touch.

Attack vector: An attacker embeds a malicious payload inside content that Cursor's AI agent is asked to read — for example, inside a file, a prompt, or a connected MCP server request (a type of external service integration). The injected instruction tells the AI to set its working directory to an attacker-chosen path. From there, the attacker can overwrite Cursor's own sandbox executable, meaning all subsequent commands run outside any sandbox restrictions entirely. The attacker achieves full remote code execution (the ability to run arbitrary commands on your machine) without ever needing direct access to your system.

Detection strategies:

• Check application logs for unexpected changes to the working_directory parameter, particularly paths outside your active project folder.
• Monitor for modifications to the cursorsandbox executable on disk — changes to this file outside of an official update are a strong indicator of compromise.
• Look for unusual outbound network connections originating from Cursor's process, especially to unfamiliar external addresses.

Recommended actions:

1. Update Cursor to version 3.0 or later immediately — patches for this flaw were included in that release.
2. Until updated, avoid opening or ingesting files from untrusted or external sources inside Cursor.
3. Review any MCP server integrations connected to your Cursor installation and remove any you did not explicitly configure.

What Adobe ColdFusion is: ColdFusion is Adobe's web application server platform, used by organisations to build and run database-driven websites and internal business applications.

What it is: CVE-2026-48276 is an unrestricted file upload flaw. An attacker can send a file of any type to the server — including executable code — without the server checking whether it should be allowed. This leads to remote code execution (RCE), meaning the attacker can run commands on the server as if they were sitting at its keyboard.

Who's at risk: Any organisation running ColdFusion 2023 below Update 21 or ColdFusion 2025 below Update 10 with internet-accessible endpoints.

CVSS: 10.0 (Critical — patch today.)

Root cause: The server fails to validate the type of file being uploaded. Think of it as a secured door with a sign saying "no weapons," but no one actually checking bags. Any file gets through, including ones designed to execute on the server.

Attack vector: An attacker sends a crafted HTTP request containing a malicious file to a ColdFusion upload endpoint. Because the server performs no type-checking, the file is accepted and stored. The attacker then triggers its execution, gaining full control of the underlying server. No authentication is required.

Detection strategies: Review web server logs for unexpected file uploads to ColdFusion endpoints. Look for newly created files with executable extensions in upload directories. Monitor for unusual outbound connections from the ColdFusion server process.

Recommended actions:

1. Update ColdFusion 2023 to Update 21 and ColdFusion 2025 to Update 10 immediately.
2. Restrict public access to file upload endpoints at the network or firewall level.
3. Review server logs for signs of recent exploitation before patching.

CVE ID not confirmed in source — check the original advisory before acting.

What NetScaler ADC and NetScaler Gateway are: Citrix NetScaler products are network appliances used by organisations to manage, secure, and accelerate traffic flowing into their applications and services.

What it is: An external file path control flaw that allows an unauthenticated attacker to read arbitrary files from the appliance's filesystem. No login is required.

Who's at risk: Any organisation running an unpatched NetScaler appliance with the management interface (NSIP, Cluster Management IP, or SNIP with management access) exposed to untrusted networks.

CVSS: 7.7 (High) — patch this week.

Root cause: The appliance fails to properly validate or restrict user-supplied input that controls which file path is accessed during a request. Because no authentication check gates this operation, the flaw is reachable by anyone who can reach the management interface.

Attack vector: An attacker sends a crafted, unauthenticated HTTP request to the management interface, supplying a manipulated file path. The appliance processes it without validating who made the request or whether the path is permitted, and returns the contents of the targeted file. Configuration files and credentials are realistic targets.

Recommended actions:

1. Upgrade to NetScaler ADC and Gateway 14.1-72.61 or 13.1-63.18 or later immediately.
2. Restrict management interface access (NSIP/SNIP) to trusted internal networks only — never expose it to the public internet.
3. Review access logs on the management interface for unexpected file-read requests from unfamiliar sources.

What LoadMaster is: An application delivery controller and load balancer that enterprises use to manage and distribute incoming traffic across servers — it sits at the network edge, making it a high-value target.

What it is: An unauthenticated attacker can send a specially crafted request to LoadMaster's API and execute arbitrary commands as the root (highest-privilege) user. No login required.

Who's at risk: Any organisation running an affected LoadMaster version with the API enabled and network-accessible. A working proof of concept is now public as of June 29.

CVSS: 9.8 (Critical) — patch today.

Root cause: A function called escape_quotes() was meant to sanitise user input before passing it to a shell command. It allocated a memory buffer (a reserved block of storage for temporary data) without clearing it, and never wrote a null terminator (a marker character that tells the system "the string ends here"). Without that marker, the system reads past the sanitised input into adjacent memory — which an attacker can pre-load with a command injection payload (malicious commands disguised as ordinary input).

Attack vector: The attacker sends a JSON request to the /accessv2 endpoint, embedding a crafted apiuser value alongside dozens of extra keys each carrying the command to execute. The system sanitises the first value, keeps reading past it, and executes the attacker's commands as root. No credentials needed at any point.

Detection strategies: Look for unusual POST requests to /accessv2 with abnormally large JSON bodies or unexpected key counts. Monitor for root-level process spawning triggered by the LoadMaster process. Alert on any shell commands initiated from the LoadMaster API service.

Recommended actions:

1. Upgrade to GA v7.2.63.2 or LTSF v7.2.54.18 immediately.
2. If patching is not immediately possible, restrict API access to trusted IP ranges at the firewall.
3. Review LoadMaster API access logs for anomalous requests sent before the patch was applied.

What libssh2 is: A C library that gives software the ability to connect to SSH servers — it is embedded inside widely-used tools including curl, Git, and PHP, meaning it quietly runs inside many applications you use every day without advertising its presence.

What it is: A critical memory corruption flaw in the function that reads incoming SSH packets during a connection handshake. A malicious or compromised SSH server can trigger it with no credentials and no interaction from the user. The result is potential remote code execution (RCE — an attacker running their own commands on your machine) on the connecting client. A public proof-of-concept has been published, per The Hacker News.

Who's at risk: Any software that links libssh2 and connects to an SSH server — especially tools reaching external or untrusted servers. Many copies are bundled directly inside applications (statically linked — meaning the library is baked permanently into the application's own code), so updating your operating system's package manager may not touch them.

CVSS: 9.2 (Critical — patch today.)

Root cause: The packet-parsing code read an attacker-controlled length value from the incoming SSH packet but only rejected values below 1. No upper limit was enforced. When a very large length value is supplied, arithmetic to calculate the required buffer size wraps around to a tiny number (this is an integer overflow — when a number exceeds the maximum a fixed-size counter can hold and loops back to near zero). libssh2 then allocates a small buffer but later writes the full oversized packet into it, writing past the end of that buffer in memory — a heap out-of-bounds write (writing data beyond the boundary of an allocated memory block). The fix adds a single check rejecting any length above the permitted maximum before the arithmetic runs.

Attack vector: An attacker who controls or compromises an SSH server waits for a vulnerable client to connect. During the handshake, the server sends a crafted packet with an oversized length field. libssh2 miscalculates the buffer size, allocates too little memory, and then overwrites adjacent memory. Depending on the application and how libssh2 is embedded, this can lead to code running under that application's privileges. No user interaction is required beyond initiating the connection.

Detection strategies:

1. Unexplained crashes or memory errors in applications that make SSH connections (curl jobs, Git operations, backup agents)
2. Anomalous outbound connections following an SSH handshake to an external server
3. SSH client processes spawning unexpected child processes or making unusual network connections

Recommended actions:

1. Inventory every application and appliance that uses libssh2, including statically bundled copies — curl, Git, and PHP deployments are the most common carriers
2. Apply the patch by using distro backports where available (Debian already has a repaired build in testing) or build from source including commit 97acf3d
3. Until patched, restrict outbound SSH connections to trusted, verified servers and confirm host keys are checked before connecting

CVE ID not confirmed in source — check the original advisory before acting.

What Cisco Unified Communications Manager is: Cisco Unified Communications Manager (Unified CM) is enterprise software that manages phone calls, video conferencing, and messaging for large organisations — essentially the switchboard that ties all internal communications together.

What it is: According to a weekly roundup published by Help Net Security, a flaw in Cisco Unified CM is being actively exploited. The source does not supply the CVE ID, CVSS score, or specific patch version numbers. The full technical detail lives in the official Cisco advisory, which was not provided as a source for this issue.

Who's at risk: Organisations running Cisco Unified CM as part of their enterprise communications infrastructure. Active exploitation means attackers are not waiting — if your organisation uses this product, treat this as urgent.

CVSS: Not confirmed in available source — treat as High until the official advisory is reviewed.

Root cause: Insufficient detail is available from the source to describe the root cause with accuracy. Speculating on the flaw mechanism without a confirmed advisory would be irresponsible — check the Cisco Security Advisories portal directly.

Attack vector: Unknown from available source. The Help Net Security roundup confirms active exploitation is occurring but does not describe the attack method. Consult the official Cisco advisory for specifics.

Detection strategies:

1. Review authentication and access logs on your Unified CM servers for unexpected login attempts or privilege escalation events.
2. Monitor network traffic for unusual connections to or from Unified CM nodes, particularly outbound to unfamiliar external addresses.
3. Check whether any new admin accounts have appeared in your Unified CM configuration without a corresponding change request.

Recommended actions:

1. Visit the Cisco Security Advisories portal and search for the latest Unified Communications Manager advisory to obtain the confirmed CVE ID, CVSS score, and patch version.
2. Apply the vendor-recommended patch immediately given confirmed active exploitation.
3. Restrict administrative access to Unified CM to trusted internal IP ranges while patching is underway.

What Amazon Q Developer is: Amazon Q Developer is an AI-powered coding assistant, built as a Visual Studio Code extension, that offers code suggestions, automated refactoring, and the ability to connect to external tools and services.

What it is: A high-severity flaw in how the extension handled Model Context Protocol (MCP) servers — local processes an AI assistant can spawn to reach databases, APIs, or build tools. The extension would automatically read and act on an MCP configuration file found inside an open workspace, without asking the user for permission first.

Who's at risk: Any developer who opens a repository containing a malicious .amazonq/mcp.json file in an unpatched version of the extension. No special privileges are needed on the attacker's side — just getting a developer to open the repo.

CVSS: 8.5 (High — patch this week.)

Root cause: The extension trusted configuration files found in an open workspace without first confirming the user wanted to run what those files defined. Treating a file dropped into a folder as an instruction to execute, rather than as untrusted input to review, is the entire flaw.

Attack vector: An attacker plants a .amazonq/mcp.json file inside a public or shared repository. When a developer opens that repository in VS Code with Amazon Q Developer installed, the extension reads the file and launches the MCP server it defines — as a local process that inherits the developer's full environment, including AWS keys and other cloud credentials loaded in that session. From git clone to cloud compromise takes a single workspace open, no further clicks required.

Detection strategies:

1. Review any repository opened recently for an unexpected .amazonq/mcp.json file, especially one not committed by a known contributor.
2. Audit AWS CloudTrail logs for API calls made shortly after a developer's IDE session began, particularly from credentials tied to a workstation rather than a service role.
3. Check Amazon Q Developer's extension version against AWS's patched release — anything before May 12, 2026 is exposed.

Recommended actions:

1. Update the Amazon Q Developer extension to the patched version immediately.
2. Rotate any AWS credentials that were active in a VS Code session where an untrusted repository was opened.
3. Treat any repository-supplied configuration file as untrusted input — review it before opening the workspace in an editor with AI-assistant integrations enabled.