GhostLock (CVE-2026-43499): A 15-Year-Old Futex Bug Gives Any Local User Root — and Breaks Out of Containers
A use-after-free in the Linux kernel's futex requeue-PI code, present since 2011, lets any unprivileged local user gain root with a public, 97%-reliable exploit that also escapes Docker and Kubernetes containers.
Accenture Confirms Breach After Threat Actor '888' Lists 35GB of Source Code and Azure Credentials for Sale
A threat actor known as 888 is selling 35GB of alleged Accenture source code, RSA/SSH keys, and Azure access tokens on a cybercrime forum; Accenture has confirmed an incident but not disclosed the access vector.
Januscape (CVE-2026-53359): A 16-Year-Old KVM Bug Lets Guests Escape to the Host
A use-after-free in KVM's shadow MMU, present since 2010, lets a guest VM with nested virtualization corrupt host kernel memory and potentially execute code on the hypervisor — patched July 4 across Intel and AMD x86.
CVE-2026-11405: Undocumented Admin Backdoor in Tenda Router Firmware, No Patch Available
CERT/CC disclosed a hardcoded backdoor password mechanism in Tenda router firmware that grants full admin access regardless of the real password — Tenda has not responded to coordination attempts since May, and there is no patch.
Gitea CVE-2026-20896: Docker Images Trusted a Spoofable Header for Admin Access, Now Under Active Probing
Gitea's official Docker images shipped with reverse-proxy header trust wide open by default, letting anyone who can reach the port impersonate any user including an admin — Sysdig has now caught the first in-the-wild probing, 13 days after disclosure.
PixelSmash: A 50KB Video File Turns FFmpeg's MagicYUV Decoder into RCE Against Jellyfin, Nextcloud, and OBS
A heap out-of-bounds write in FFmpeg's MagicYUV decoder (CVE-2026-8461, CVSS 8.8) lets a single crafted media file achieve remote code execution against Jellyfin, Nextcloud, and other self-hosted server infrastructure that auto-processes uploaded video.
DHS Confirms Breach of HSIN, the Federal-State-Local Information-Sharing Backbone
DHS confirms an unattributed threat actor breached HSIN and a connected SharePoint environment used by fusion centers and law enforcement nationwide, with the intrusion window overlapping World Cup security planning.
SimpleHelp OIDC Auth Bypass (CVE-2026-48558) Under Active Exploitation, Deploying Djinn Stealer Against Dev Credentials
A critical unsigned-token flaw in SimpleHelp RMM's OIDC login is being exploited to plant a cross-platform infostealer that hunts for cloud, source-control, and AI-assistant credentials.
The Login Path Is the Target: Inside the PAM/OpenSSH Backdoor Playbook Attackers Keep Reusing
Sygnia's Operation Highland found a China-nexus group living inside an air-gapped network for a decade by backdooring pam_unix.so and sshd. It's the same target the XZ Utils and Ebury campaigns went after — because the Linux authentication stack is the softest hard target in your fleet.
JADEPUFFER: First Documented Ransomware Attack Run End-to-End by an AI Agent
Sysdig documents JADEPUFFER, an LLM-driven agent that autonomously exploited a year-old Langflow RCE (CVE-2025-3248) to breach, pivot, and encrypt a production database with zero human operator input.
Adobe ColdFusion APSB26-68: Six CVSS 10.0 Flaws, and Exploitation Started Within Hours
Adobe's APSB26-68 bulletin patches 11 ColdFusion flaws — six rated CVSS 10.0 — including a Remote Development Services path-traversal bug (CVE-2026-48282) that attackers began probing within hours of disclosure.
Bad Epoll (CVE-2026-46242): A Six-Instruction Race in epoll() Roots Linux 6.4+ and Android
A use-after-free race in the Linux epoll subsystem, introduced by a 2023 commit, lets an unprivileged local user gain root with a 99%-reliable exploit — and the same code path may be reachable from Chrome's renderer sandbox on Android.
CVE-2026-8451: A New CitrixBleed-Pattern Memory Overread Is Already Under Active Exploitation
Citrix patched CVE-2026-8451, a pre-auth memory overread in NetScaler's SAML IdP parser that leaks session tokens — and attackers were already exploiting it within 24 hours of disclosure.
DuneSlide: Zero-Click Prompt Injection Chains to Full RCE in Cursor IDE (CVE-2026-50548, CVE-2026-50549)
Two critical Cursor IDE flaws, dubbed DuneSlide, let a poisoned MCP response or web search result steer the agent's own sandbox into overwriting its enforcement binary — zero-click prompt injection to unsandboxed remote code execution, patched in Cursor 3.0.
CVE-2026-8037: Pre-Auth Root RCE in Progress Kemp LoadMaster Now Under Active Exploitation
CVE-2026-8037, a CVSS 9.8 uninitialized-heap flaw in Progress Kemp LoadMaster's escape_quotes() function, lets unauthenticated attackers run root commands on the load balancer's management API. eSentire observed exploitation attempts starting June 29.
GuardFall: Decades-Old Bash Quoting Tricks Defeat Safety Guards in 10 of 11 Open-Source AI Coding Agents
Adversa AI's GuardFall research shows that quote removal, $IFS spacing, command substitution, and other decades-old shell tricks bypass the command guards in opencode, Goose, Cline, Aider, and seven other open-source AI coding agents — turning a poisoned README into silent credential theft.
Oracle E-Business Suite Payments Flaw Under Active Exploitation Before Patch Window Closed
CVE-2026-46817, a CVSS 9.8 unauthenticated takeover flaw in Oracle E-Business Suite's Payments module, is being mass-exploited via the ibytransmit endpoint — patched in May but hit in the wild before any public PoC existed.
Public PoC Drops for Critical libssh2 Heap Overflow — curl, Git, and PHP All Carry the Flaw
A public PoC was released June 29 for CVE-2026-55200, a CVSS 9.2 heap overflow in libssh2 ≤ 1.11.1 that lets a malicious SSH server execute code on any connecting client. curl, Git, PHP, and a long tail of appliances all link the library.
Ubiquiti UniFi OS Server Triple-CVE Chain Enables Unauthenticated Root RCE
Three max-severity CVEs (2026-34908/09/10) in UniFi OS Server chain from an Nginx auth bypass to root command injection — CISA added all three to KEV on June 23 amid Mirai/Gaafgyt botnet exploitation.
Squidbleed: 29-Year-Old Heap Over-Read in Squid Proxy Leaks Cleartext HTTP Traffic (CVE-2026-47729)
A Heartbleed-style heap buffer over-read in Squid's FTP gateway, tracing to a 1997 commit, lets trusted proxy users drain other users' cleartext HTTP requests including credentials, cookies, and session tokens.