🟠 CVE-2026-66027 - High (8.3)

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66027/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66027 - High (8.3)

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66027/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8789 - High (8.1)

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8789 - High (8.1)

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-57106 - Critical (10)

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-57106 - Critical (10)

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Discover the RefluXFS Linux vulnerability (CVE-2026-64600) in XFS that allows local users to overwrite protected files and gain root privileges.

#RefluXFS #CVE202664600 #LinuxKernel #Cybersecurity #XFS

https://meterpreter.org/refluxfs-linux-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Discover the RefluXFS Linux vulnerability (CVE-2026-64600) in XFS that allows local users to overwrite protected files and gain root privileges.

#RefluXFS #CVE202664600 #LinuxKernel #Cybersecurity #XFS

https://meterpreter.org/refluxfs-linux-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-58630 - Critical (10)

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-58630 - Critical (10)

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-56165 - Critical (9.8)

Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56165/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

got a red hat cve for the bug i found trying out superluminal on linux. this means that i'm a SECURITY RESEARCHER now! https://access.redhat.com/security/cve/cve-2026-16730

CVE-2026-62825 - Critical auth bypass in Azure Key Vault. CVSS 10.0. No patch available. Attackers can elevate privileges over network. Mitigate immediately. #CVE #Azure #infosec

https://www.valtersit.com/cve/CVE-2026-62825/

CVE-2026-24727 (CRITICAL, CVSS 9.3): SUNNET Corporate Training Mgmt System v10.3 allows admins to upload ZIP files with executable code, enabling server command execution. No patch yet — restrict admin access & monitor uploads. https://radar.offseq.com/threat/cve-2026-24727-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-sunnet-technology-co-ltd-fe23deeb060f5b6d #OffSeq #CVE202624727 #infosec 🛡️

CVE-2026-24727 (CRITICAL, CVSS 9.3): SUNNET Corporate Training Mgmt System v10.3 allows admins to upload ZIP files with executable code, enabling server command execution. No patch yet — restrict admin access & monitor uploads. https://radar.offseq.com/threat/cve-2026-24727-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-sunnet-technology-co-ltd-fe23deeb060f5b6d #OffSeq #CVE202624727 #infosec 🛡️

🟠 CVE-2026-14172 - High (7.8)

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14172 - High (7.8)

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-12981: CRITICAL vuln in CAFEHAUS API plugin ≤1.0.0 (WordPress). No authentication on password updates — attackers can reset any user password, including admins. Remove/disable plugin until fixed. https://radar.offseq.com/threat/cve-2026-12981-cwe-269-improper-privilege-management-in-cafehaus-api-47b92cb62ac9c312 #OffSeq #WordPress #Vulnerability #PrivilegeEscalation

🔴 CVE-2026-15704 - Critical (9.8)

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router.

The shared rou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Eclipse BaSyx Go Components (<=1.0.0) suffer a CRITICAL auth bypass (CVE-2026-15704): ABAC checks can be evaded by adding a trailing slash to API routes. Immediate upgrade to 1.0.1 is required. https://radar.offseq.com/threat/cve-2026-15704-cwe-863-in-eclipse-foundation-eclipse-basyx-go-components-eeb4ef03f595d434 #OffSeq #CVE202615704 #infosec #AppSec

🔴 CVE-2026-15704 - Critical (9.8)

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router.

The shared rou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Eclipse BaSyx Go Components (<=1.0.0) suffer a CRITICAL auth bypass (CVE-2026-15704): ABAC checks can be evaded by adding a trailing slash to API routes. Immediate upgrade to 1.0.1 is required. https://radar.offseq.com/threat/cve-2026-15704-cwe-863-in-eclipse-foundation-eclipse-basyx-go-components-eeb4ef03f595d434 #OffSeq #CVE202615704 #infosec #AppSec

🟠 CVE-2026-16870 - High (8.8)

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16870 - High (8.8)

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-54120 (CRITICAL, CVSS 9.9): Improper input validation in Microsoft Surface Management Services lets authorized attackers run code remotely. Patch now: https://radar.offseq.com/threat/cve-2026-54120-cwe-20-improper-input-validation-in-microsoft-surface-management-services-203a5e59f513d748 🖥️ #OffSeq #infosec #Microsoft #CVE202654120

CVE-2026-54120 (CRITICAL, CVSS 9.9): Improper input validation in Microsoft Surface Management Services lets authorized attackers run code remotely. Patch now: https://radar.offseq.com/threat/cve-2026-54120-cwe-20-improper-input-validation-in-microsoft-surface-management-services-203a5e59f513d748 🖥️ #OffSeq #infosec #Microsoft #CVE202654120

CRITICAL improper authorization vuln (CVE-2026-56160) in Azure Red Hat OpenShift (ARO): privilege escalation risk for authorized users. No active exploits. Microsoft has released a fix — ensure your ARO instances are updated. Details: https://radar.offseq.com/threat/cve-2026-56160-cwe-285-improper-authorization-in-microsoft-azure-red-hat-openshift-aro-9a561de9f992bb49 #OffSeq #Azure #CVE202656160

CRITICAL improper authorization vuln (CVE-2026-56160) in Azure Red Hat OpenShift (ARO): privilege escalation risk for authorized users. No active exploits. Microsoft has released a fix — ensure your ARO instances are updated. Details: https://radar.offseq.com/threat/cve-2026-56160-cwe-285-improper-authorization-in-microsoft-azure-red-hat-openshift-aro-9a561de9f992bb49 #OffSeq #Azure #CVE202656160

🔴 CVE-2026-56160 - Critical (9.1)

Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-50517: CRITICAL deserialization flaw (CVSS 9.9) in Microsoft 365 Copilot permits remote code execution by authorized attackers. Microsoft has issued a server-side fix — confirm your environment is protected. https://radar.offseq.com/threat/cve-2026-50517-cwe-502-deserialization-of-untrusted-data-in-microsoft-microsoft-365-copilot-71d778a5726cf6f5 #OffSeq #Microsoft365 #CloudSecurity #CVE202650517

CVE-2026-10697 - Improper Authentication in Progress MOVEit Transfer. CVSS 7.5. No patch yet. Mitigate immediately if affected. #CVE #Progress #infosec

https://www.valtersit.com/cve/CVE-2026-10697/

CVE-2026-65917 - IDOR in Cyberpanel IncBackups allows authenticated users to access/delete other tenants' backups via sequential job IDs. CVSS 8.8. No patch yet. Isolate or restrict access now. #CVE #CyberPanel #infosec

https://www.valtersit.com/cve/CVE-2026-65917/

Oracle drops 1,449 security patches like it's the new normal

Oracle가 분기 보안 업데이트에서 1,449건의 패치를 배포했으며, 이 중 Oracle Fusion Middleware 관련 취약점 10건은 CVSS 10.0이다. 특히 인증 없이 HTTP로 Oracle Data Integrator를 장악할 수 있는 CVE-2026-47056과 TCP를 통해 Oracle Coherence를 장악할 수 있는 CVE-2026-60217은 즉시 패치 우선순위가 높다. Oracle Database Server에도 저권한 원격 코드 실행 가...

https://www.theregister.com/security/2026/07/23/oracle-drops-1449-security-patches-like-its-the-new-normal/5277114

Oracle drops 1,449 security patches like it's the new normal

Oracle가 분기 보안 업데이트에서 1,449건의 패치를 배포했으며, 이 중 Oracle Fusion Middleware 관련 취약점 10건은 CVSS 10.0이다. 특히 인증 없이 HTTP로 Oracle Data Integrator를 장악할 수 있는 CVE-2026-47056과 TCP를 통해 Oracle Coherence를 장악할 수 있는 CVE-2026-60217은 즉시 패치 우선순위가 높다. Oracle Database Server에도 저권한 원격 코드 실행 가...

https://www.theregister.com/security/2026/07/23/oracle-drops-1449-security-patches-like-its-the-new-normal/5277114

📰 Check Point Patches Actively Exploited SmartConsole Auth Bypass Flaw

🚨 CRITICAL PATCH: Check Point fixes an actively exploited auth bypass zero-day (CVE-2026-16232, CVSS 9.3) in SmartConsole. Flaw allows full admin access. CISA added to KEV. Patch NOW. #CyberSecurity #ZeroDay #CheckPoint #Infosec

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/check-point-patches-actively-exploited-smartconsole-authentication-bypass-flaw/?utm_source=mastodon&utm_me…

(CISA TS-SOC) CVE-2026-16232 – Check Point SmartConsole Improper Authentication Vulnerability

Severity: CRITICAL Impact Summary: An unauthenticated remote attacker can obtain an application login token and use it to authenticate with full administrative privileges....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-16232-check-point-smartconsole-improper-authentication-vulnerability/

Geopolitical tensions escalated as US strikes on Iran continued and Houthi attacks on Saudi tankers raised oil prices. In cybersecurity, a critical Check Point zero-day (CVE-2026-16232) is actively exploited. US agencies warned of Iranian cyber campaigns targeting critical infrastructure PLCs and Russian state-backed phishing on Zimbra Collaboration Suite. AI agents are now a primary attack surface.

#Cybersecurity #Geopolitics #TechNews

Geopolitical tensions escalated as US strikes on Iran continued and Houthi attacks on Saudi tankers raised oil prices. In cybersecurity, a critical Check Point zero-day (CVE-2026-16232) is actively exploited. US agencies warned of Iranian cyber campaigns targeting critical infrastructure PLCs and Russian state-backed phishing on Zimbra Collaboration Suite. AI agents are now a primary attack surface.

#Cybersecurity #Geopolitics #TechNews

why am I confronted with this crime against language and common sense? https://discourse.ifin.network/t/cve-2026-16232-authentication-bypass-in-check-point-smart-console-eitw/680 thats why (eitw vuln)

CVE-2026-64811 High severity code execution in JetBrains IntelliJ IDEA before 2026.2 via dev container config before project trust. CVSS 7.8. Update immediately. #CVE #JetBrains #infosec

https://www.valtersit.com/cve/CVE-2026-64811/

(CISA TS-SOC) CVE-2026-50522 – Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Severity: CRITICAL Impact Summary: An unauthorized attacker can execute code over a network via deserialization of untrusted data....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-50522-microsoft-sharepoint-deserialization-of-untrusted-data-vulnerability/

(CISA TS-SOC) CVE-2026-50522 – Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Severity: CRITICAL Impact Summary: An unauthorized attacker can execute code over a network via deserialization of untrusted data....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-50522-microsoft-sharepoint-deserialization-of-untrusted-data-vulnerability/

@janl @jschauma not all LPE do fully break kernel namespaces ("containers”) - not sure about the quoted one though. While I don't disagree with your assessment, I'd still argue that containers made various security related features much more approachable and still provide value. In the end it always has been about defense in depth.

If we start to see more issues in KVM like CVE-2026-53359, we are really screwed! Then we're basically back to hardware isolation for everything that matters 🫣

@janl @jschauma not all LPE do fully break kernel namespaces ("containers”) - not sure about the quoted one though. While I don't disagree with your assessment, I'd still argue that containers made various security related features much more approachable and still provide value. In the end it always has been about defense in depth.

If we start to see more issues in KVM like CVE-2026-53359, we are really screwed! Then we're basically back to hardware isolation for everything that matters 🫣

📰 PoC Exploit 'Certighost' for Critical AD CS Flaw Now Public

PoC exploit 'Certighost' released for critical AD CS flaw CVE-2026-54121 (CVSS 8.8). Exploit allows low-privilege users to impersonate a Domain Controller, leading to full domain compromise. Patching is urgent. #ActiveDirectory #CyberSecurity #BlueTeam

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/certighost-exploit-released-for-critical-active-directory-flaw-cve-2026-54121/?utm_source=ma…

New.

GitHub/H0j3n: Certighost (CVE-2026-54121) https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

More:

The Hacker News: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html @thehackernews #infosec #vulnerability #Microsoft #Windows

Certighost Exploit Enables Low-Privilege AD Users to Impersonate Domain Controllers

A newly discovered exploit, dubbed Certighost, lets low-privileged Active Directory users impersonate Domain Controllers, posing a significant threat to security. This vulnerability, tracked as CVE-2026-54121, allows attackers to obtain a certificate for a Domain Controller and…

https://osintsights.com/certighost-exploit-enables-low-privilege-ad-users-to-impersonate-domain-controll?utm_source=mastodon&utm_medium=social

#ActiveDirectoryExploit #Certighost #Cve202654121 #DomainControllerImpersonation #IdentityAuthentication

A Proof-of-Concept was published for Microsoft Active Directory Certificate Services Privilege Escalation vulnerability CVE-2026-54121

https://db.gcve.eu/vuln/cve-2026-54121

#vulnerability #cybersecurity #cve_2026_54121

New.

GitHub/H0j3n: Certighost (CVE-2026-54121) https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

More:

The Hacker News: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html @thehackernews #infosec #vulnerability #Microsoft #Windows

New ADCS vuln + PoC dropped

Only requires a low priv user and results in a DC cert

Certighost (CVE-2026-54121)

https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

(CISA TS-SOC) CVE-2021-27137 – DD-WRT Stack-Based Buffer Overflow Vulnerability

Severity: HIGH Impact Summary: Allows unauthenticated attackers to execute arbitrary code on the device via a stack-based buffer overflow in the UPnP component....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2021-27137-dd-wrt-stack-based-buffer-overflow-vulnerability/

A Konnectivity vulnerability (CVE-2026-16242, CVSS 9.4) lets unauthenticated attackers proxy and modify control-plane traffic. See the fix and mitigation.

#Konnectivity #Kubernetes #CVE202616242 #CloudSecurity #ControlPlane #AuthBypass #InfoSec #PatchNow

http://securityonline.info/konnectivity-vulnerability-cve-2026-16242/?utm_source=mastodon&utm_medium=jetpack_social

A Konnectivity vulnerability (CVE-2026-16242, CVSS 9.4) lets unauthenticated attackers proxy and modify control-plane traffic. See the fix and mitigation.

#Konnectivity #Kubernetes #CVE202616242 #CloudSecurity #ControlPlane #AuthBypass #InfoSec #PatchNow

http://securityonline.info/konnectivity-vulnerability-cve-2026-16242/?utm_source=mastodon&utm_medium=jetpack_social

15-Year-Old Pre-Auth nginx RCE Across 13 Call Sites: Two-Pass Capture Clobbering CVE-2026-42533 – cyberstan #devopsish https://cyberstan.co.uk/nginx-rce/

15-Year-Old Pre-Auth nginx RCE Across 13 Call Sites: Two-Pass Capture Clobbering CVE-2026-42533 – cyberstan #devopsish https://cyberstan.co.uk/nginx-rce/

A public proof-of-concept details the Windows AppResolver LPE (CVE-2026-50454), a UAC bypass that chains an admin token to a SYSTEM shell.

#Windows #CVE202650454 #PrivilegeEscalation #UACBypass #InfoSec

https://securityonline.info/windows-appresolver-lpe-cve-2026-50454/?utm_source=mastodon&utm_medium=jetpack_social

A public proof-of-concept details the Windows AppResolver LPE (CVE-2026-50454), a UAC bypass that chains an admin token to a SYSTEM shell.

#Windows #CVE202650454 #PrivilegeEscalation #UACBypass #InfoSec

https://securityonline.info/windows-appresolver-lpe-cve-2026-50454/?utm_source=mastodon&utm_medium=jetpack_social

Odnaleziono backdoor w routerach Tenda

W oprogramowaniu popularnego – również w naszym kraju – chińskiego producenta sprzętu sieciowego Tenda, odkryto ukrytą funkcjonalność. Pozwala ona na dostęp do interfejsu zarządzania WWW na prawach administratora urządzenia przy pomocy zapisanego na stałe hasła. TLDR: Czyli mamy do czynienia z klasyczną tylną furtką, zwaną powszechnie backdoorem. Podatność została oznaczona identyfikatorem CVE-2026-11405 i polega na modyfikacji...

#WBiegu #Backdoor #Cve #Router #Tenda

https://sekurak.pl/odnaleziono-backdoor-w-routerach-tenda/

Odnaleziono backdoor w routerach Tenda

W oprogramowaniu popularnego – również w naszym kraju – chińskiego producenta sprzętu sieciowego Tenda, odkryto ukrytą funkcjonalność. Pozwala ona na dostęp do interfejsu zarządzania WWW na prawach administratora urządzenia przy pomocy zapisanego na stałe hasła. TLDR: Czyli mamy do czynienia z klasyczną tylną furtką, zwaną powszechnie backdoorem. Podatność została oznaczona identyfikatorem CVE-2026-11405 i polega na modyfikacji...

#WBiegu #Backdoor #Cve #Router #Tenda

https://sekurak.pl/odnaleziono-backdoor-w-routerach-tenda/

Clop ransomware targets Windchill, FlexPLM in data theft attacks

Clop(Cl0p) 랜섬웨어 조직이 인터넷에 노출된 PTC Windchill 및 FlexPLM 서버의 CVE-2026-12569(CVSS 9.3)을 악용해 인증 없이 원격 코드 실행을 수행하고 JSP 웹셸을 설치하는 정황이 확인됐다. 공격자는 제품 설계·제조 관련 민감 데이터를 유출한 뒤, 탈취한 이메일 계정을 이용해 다수 직원에게 갈취 메일을 보내는 방식으로 압박한다. PTC는 6월부터 패치를 제공했으며 CISA는 해당 취약점을 KEV 목록에 올려 연방기관에 3일...

https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/

Clop Exploits Critical Windchill Vulnerability, Turning Engineering Systems Into Targets for Data Extortion + Video

Introduction: A New Cyber Threat Against Industrial Innovation A new wave of cyberattacks is putting engineering organizations, manufacturing companies, and product development environments under increasing pressure. The notorious Clop threat group is reportedly exploiting a newly identified vulnerability, CVE-2026-12569, targeting exposed PTC Windchill…

https://undercodenews.com/clop-exploits-critical-windchill-vulnerability-turning-engineering-systems-into-targets-for-data-extortion-video/?utm_source=mastodon&utm_medium=jetpack_social

Clop Ransomware Targets PTC Windchill in Data Theft Attacks

A critical vulnerability, CVE-2026-12569, with a near-perfect CVSS score of 9.3 is being exploited by Clop ransomware attackers to breach PTC Windchill and FlexPLM systems, putting sensitive data at risk. Security patches are available, but urgent action is needed to prevent data theft.

https://osintsights.com/clop-ransomware-targets-ptc-windchill-in-data-theft-attacks?utm_source=mastodon&utm_medium=social

#ClopRansomware #Cve202612569 #PtcWindchill #Flexplm #RansomwareAttacks

📰 Russian APT 'Laundry Bear' Targets West with Zero-Click Zimbra Exploit

International advisory warns of Russian APT 'Laundry Bear' using a zero-click Zimbra exploit (CVE-2025-66376) in a widespread espionage campaign against Western targets. Actors steal emails & credentials. #ThreatIntel #Zimbra #CyberSecurity

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/russian-laundry-bear-apt-targets-west-with-zero-click-zimbra-exploit/?utm_source=mastodon&utm…

📰 Russian Hackers Use Zero-Click Zimbra Exploit in Global Spy Campaign

Russian state actors (Void Blizzard) are exploiting a zero-click Zimbra vulnerability (CVE-2025-66376) to steal credentials and emails. The campaign uses JavaScript injection via phishing emails. Patching is critical. #CyberEspionage #Zimbra #ThreatI...

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/russian-webmail-espionage-targets-zimbra/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Proofpoint uncovered that Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) was exploiting a previously unknown vulnerability against Zimbra mailservers for at least five months during 2025, until the issue was patched with CVE-2025-66376. https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits

Proofpoint uncovered that Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) was exploiting a previously unknown vulnerability against Zimbra mailservers for at least five months during 2025, until the issue was patched with CVE-2025-66376. https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits

🔴 New security advisory:

CVE-2026-47668 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-47668-dbgate-unauthenticated-rce-poc

#Cybersecurity #ZeroDay #ThreatIntel

(CISA TS-SOC) CVE-2026-0770 – Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Severity: UNKNOWN Impact Summary: Remote attackers can execute arbitrary code on affected installations. Timestamp: 2026-07-24T01:31:37.336Z ATT&CK Mapping…...

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-0770-langflow-inclusion-of-functionality-from-untrusted-control-sphere-vulnerability/

(CISA TS-SOC) CVE-2026-0770 – Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Severity: UNKNOWN Impact Summary: Remote attackers can execute arbitrary code on affected installations. Timestamp: 2026-07-24T01:31:37.336Z ATT&CK Mapping…...

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-0770-langflow-inclusion-of-functionality-from-untrusted-control-sphere-vulnerability/

CVE-2025-0679 named them. NVD and MITRE still can't agree on whether you had a fighting chance. You did not.

Update your Zimbra webmail client to the patched version immediately, or TA488 keeps the loot.

Reward: You've received a hollow Authenticator Token — pre-drained.

#ZeroDay #Zimbra #Espionage #CyberSecurity #2FA #AchievementUnlocked (2/2)

CVE-2025-0679 named them. NVD and MITRE still can't agree on whether you had a fighting chance. You did not.

Update your Zimbra webmail client to the patched version immediately, or TA488 keeps the loot.

Reward: You've received a hollow Authenticator Token — pre-drained.

#ZeroDay #Zimbra #Espionage #CyberSecurity #2FA #AchievementUnlocked (2/2)

Tycon Power Monitor Authentication Bypass CVE-2026-61884 Rated CVSS 9.8

https://securityonline.info/tycon-authentication-bypass-cve-2026-61884/?utm_source=mastodon&utm_medium=jetpack_social

Tycon Power Monitor Authentication Bypass CVE-2026-61884 Rated CVSS 9.8

https://securityonline.info/tycon-authentication-bypass-cve-2026-61884/?utm_source=mastodon&utm_medium=jetpack_social

(CISA TS-SOC) CVE-2026-60137 – WordPress Core SQL Injection Vulnerability

Severity: MEDIUM Impact Summary: Allows unauthenticated attackers to perform SQL injection, which can be chained with CVE-2026-63030 to achieve remote code execution on default WordPress installations....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-60137-wordpress-core-sql-injection-vulnerability/

(CISA TS-SOC) CVE-2026-63030 – WordPress Core Interpretation Conflict Vulnerability

Severity: CRITICAL Impact Summary: An attacker can exploit an interpretation conflict in WordPress Core to perform SQL Injection, which may be chained to achieve Remote Code Execution....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-63030-wordpress-core-interpretation-conflict-vulnerability/

(CISA TS-SOC) CVE-2026-60137 – WordPress Core SQL Injection Vulnerability

Severity: MEDIUM Impact Summary: Allows unauthenticated attackers to perform SQL injection, which can be chained with CVE-2026-63030 to achieve remote code execution on default WordPress installations....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-60137-wordpress-core-sql-injection-vulnerability/

(CISA TS-SOC) CVE-2026-63030 – WordPress Core Interpretation Conflict Vulnerability

Severity: CRITICAL Impact Summary: An attacker can exploit an interpretation conflict in WordPress Core to perform SQL Injection, which may be chained to achieve Remote Code Execution....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-63030-wordpress-core-interpretation-conflict-vulnerability/

(CISA TS-SOC) CVE-2026-60137 – WordPress Core SQL Injection Vulnerability

Severity: MEDIUM Impact Summary: Allows unauthenticated attackers to perform SQL injection, which can be chained with CVE-2026-63030 to achieve remote code execution on default WordPress installations....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-60137-wordpress-core-sql-injection-vulnerability/

(CISA TS-SOC) CVE-2026-60137 – WordPress Core SQL Injection Vulnerability

Severity: MEDIUM Impact Summary: Allows unauthenticated attackers to perform SQL injection, which can be chained with CVE-2026-63030 to achieve remote code execution on default WordPress installations....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-60137-wordpress-core-sql-injection-vulnerability/

Kimi K3 found 19 0days in latest Redis 8.8.0 in 1.5hrs

공개 GitHub 저장소가 Redis 6.2.22·7.4.9·8.6.4·8.8.0/8.8.1에서 인증된 사용자가 원격 코드 실행(RCE)을 얻을 수 있다는 PoC를 공개했다. 주장된 경로에는 Streams consumer-group의 shared-NACK double-free와 기본 번들 RedisBloom 모듈의 TDigest heap overflow, TopK wild free가 포함되며, 일부는 CVE-2026-25243 및 CVE-2026-25589 수정 우회라고 설명한다. 특히 RedisBloom이 포함된 8.8.x 배포와 EVAL·RESTORE·XGROUP 권한을 보유한 Redis 서비스는 공급망/...

https://github.com/berabuddies/redis-poc

Kimi K3 found 19 0days in latest Redis 8.8.0 in 1.5hrs

공개 GitHub 저장소가 Redis 6.2.22·7.4.9·8.6.4·8.8.0/8.8.1에서 인증된 사용자가 원격 코드 실행(RCE)을 얻을 수 있다는 PoC를 공개했다. 주장된 경로에는 Streams consumer-group의 shared-NACK double-free와 기본 번들 RedisBloom 모듈의 TDigest heap overflow, TopK wild free가 포함되며, 일부는 CVE-2026-25243 및 CVE-2026-25589 수정 우회라고 설명한다. 특히 RedisBloom이 포함된 8.8.x 배포와 EVAL·RESTORE·XGROUP 권한을 보유한 Redis 서비스는 공급망/...

https://github.com/berabuddies/redis-poc