Tag: vulnerability
-
Google Released Gemini 3.5 Flash Cyber AI, a Specialized AI Model for Vulnerability Hunting
Google DeepMind unveiled Gemini 3.5 Flash Cyber, an AI model for vulnerability discovery and patching, available only to governments and trusted partners. Google DeepMind announced Gemini 3.5 Flash Cyber on Tuesday, a security-focused AI model built on top of the existing 3.5 Flash architecture and designed specifically to find, validate, and patch software vulnerabilities. It…
-
New RefluXFS Linux flaw lets attackers gain root privileges
A nine-year-old race condition vulnerability in the Linux kernel’s XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/linux/new-refluxfs-linux-flaw-lets-attackers-gain-root-privileges/
-
Critical FreePBX Flaws Let Unauthenticated Attackers Execute Code and Take Over Administrator Accounts
Critical security vulnerabilities in FreePBX have been disclosed, exposing organizations to risks of unauthenticated remote code execution and the takeover of administrator accounts. These flaws, tracked under GitHub advisories GHSA-37j8-fhxx-9vhp and GHSA-g27h-xf3q-h3rm, affect FreePBX versions 16 and 17, carrying a CVSS v4 base score of 9.3, which highlights their severity. Security researchers warn that these…
-
Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code
A critical heap buffer overflow vulnerability in FreeRDP’s Windows client could allow a malicious Remote Desktop Protocol (RDP) server to corrupt memory and potentially execute arbitrary code on a connecting client. This flaw specifically affects the Clipboard Redirection (CLIPRDR) virtual channel in wfreerdp, where an attacker-controlled response can exceed the size that the client originally…
-
Exim Vulnerability Lets Attackers Access Files Outside the Mail Spool
A high-severity directory traversal vulnerability has been discovered in the Exim mail transfer agent. This flaw allows local attackers to access files outside the intended mail spool directory and potentially escalate their privileges. It is tracked as EXIM-Security-2026-06-22.1 and assigned GCVE-25-2026-07-45-1. The vulnerability affects Exim versions 4.88 through 4.99.4 and was announced on July 22,…
-
AI Agents Now the Enterprises Fastest Growing Exposed Attack Surface
Sophos report warns that the rapid adoption of AI by businesses is leaving them vulnerable to a new source of cyber threats First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-agents-attack-surface/
-
Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)
Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/check-point-vulnerability-cve-2026-16232/
-
Check Point patches actively exploited SmartConsole authentication bypass flaw
Check Point addressed a critical authentication bypass flaw, tracked as CVE-2026-16232, in SmartConsole that is being actively exploited. Check Point has released security updates to fix multiple vulnerabilities, including CVE-2026-16232 (CVSS score of 9.3), a critical authentication bypass flaw affecting Security Management and Multi-Domain Management (MDSM). The vulnerability, which is under active exploitation, allows unauthenticated…
-
Ubuntu Snap-Confine Vulnerability Allows Unprivileged Users to Execute Code as Root
A recently disclosed vulnerability in Ubuntu’s snap ecosystem, identified as CVE-2026-8933, presents a critical local privilege escalation flaw. This vulnerability allows unprivileged users to execute arbitrary code with root privileges. Qualys discovered the issue in snap-confine, a core component used by snapd to set up execution environments for snap applications. It affects specific Ubuntu releases…
-
Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access
Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild.The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass affecting the Check Point SmartConsole login process that allows an First seen…
-
GitHub revamps bug bounty program with new VIP tier, payout changes
GitHub is changing its bug bounty program to reward higher-quality vulnerability reports and reduce low-effort submissions, including AI-generated reports. The changes will … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/github-bug-bounty-program-changes/
-
Oracle July 2026 Patch Fixes 1,434 CVEs Across 334 Products
Oracle has released its July 2026 Critical Patch Update, delivering one of its largest quarterly security releases to date. The latest Oracle security patch addresses more than 1,400 vulnerabilities across hundreds of products, with the company indicating that artificial intelligence likely played a significant role in identifying most of the flaws. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/july-2026-critical-patch-update-oracle/
-
Google Unveils CodeMender AI Agent for Automated Vulnerability Detection and Remediation
Google has unveiled CodeMender, a managed AI security agent designed to identify, validate, and remediate software vulnerabilities at machine speed. Announced in preview on July 22, 2023, the tool is available through the Gemini Enterprise Agent Platform and can also function as a core component of Google’s AI Threat Defense offering. This launch comes as…
-
26 Unauthenticated Vulnerability Advisories Expose Firewalls, VPNs, Switches, and Load Balancers
A structural risk in enterprise infrastructure: unauthenticated, remotely exploitable vulnerabilities embedded in the very devices designed to secure networks. In the 30 days ending July 17, 2026, 61 advisories across 14 vendors were disclosed, including six critical issues. However, the more consequential signal lies elsewhere 26 of those advisories require no authentication. They are reachable…
-
Sicherheitslücke in Adobe-Erweiterung ermöglichte Zugriff auf WhatsApp Web
Eine Schwachstelle in der Chrome-Erweiterung Adobe Acrobat ermöglichte den Zugriff auf Inhalte von WhatsApp Web. Adobe hat den Fehler behoben. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/whatsapp-web-adobe
-
Multi-patch vulnerability fixes can leave open source exposed
Vulnerability management runs on a shorthand. A CVE shows a linked patch, someone applies it, and the ticket moves to closed. That shorthand covers most open source fixes. A … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/research-multi-patch-vulnerability-fixes/
-
Critical RefluXFS Linux Kernel Flaw Lets Local Attackers Gain Root Access
A critical vulnerability in the Linux kernel, identified as CVE-2026-64600 and referred to as RefluXFS. This vulnerability enables an unprivileged local user to gain root access on systems that utilize reflink-enabled XFS filesystems. The flaw resides in the XFS copy-on-write path and has reportedly existed since the release of Linux kernel version 4.1 in 2017.…
-
Anthropic Launches Claude Security Plugin to Scan Codebases for Vulnerabilities Before Commit
Anthropic has launched the Claude Security plugin for Claude Code in beta, enhancing its AI-assisted development platform with security scanning capabilities designed to identify vulnerabilities earlier in the software development lifecycle. The company stated that developers can scan code changes before committing them or initiate comprehensive security reviews across an entire codebase directly from the…
-
Critical Adobe Acrobat Chrome Extension Flaw “HermeticReader” Lets Hackers Hijack WhatsApp Chats of 300M+ Users
Guardio Labs has disclosed a critical vulnerability chain in the Adobe Acrobat Chrome extension that could allow a malicious website to hijack and exfiltrate rendered WhatsApp Web data from affected users. This vulnerability is tracked as CVE-2026-48294 and has impacted Adobe Acrobat extension version 26.5.2. The extension is installed across approximately 329 million browsers. Adobe…
-
Zugangsdaten erneuern: SharePoint-Schwachstelle bedroht Unternehmensnetze
Sicherheitsforscher beobachten Angriffe auf Microsoft SharePoint über die Schwachstelle CVE-2026-50522. Angreifer entwenden dabei Maschinenschlüssel. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/sharepoint-schwachstelle-2
-
The AI code vulnerabilities that grow with your app
Theori built 28 apps with AI coding agents and scanned each one through its pentesting platform. Five models did the building, split between Anthropic and OpenAI, across apps … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/report-ai-code-vulnerabilities/
-
Adobe Acrobat extension vulnerability allowed WhatsApp data theft
First seen on scworld.com Jump to article: www.scworld.com/brief/adobe-acrobat-extension-vulnerability-allowed-whatsapp-data-theft
-
Ubuntu snap-confine vulnerability grants root access
First seen on scworld.com Jump to article: www.scworld.com/brief/ubuntu-snap-confine-vulnerability-grants-root-access
-
SharePoint vulnerability steals machine keys; fourth recent exploit
First seen on scworld.com Jump to article: www.scworld.com/news/sharepoint-vulnerability-steals-machine-keys-fourth-recent-exploit
-
CVE-2026-8933: Ubuntu security flaw breaks Snap sandbox protections
Qualys disclosed CVE-2026-8933, a high-severity Ubuntu flaw that lets local attackers gain root privileges through a race condition in snap-confine. Qualys has disclosed a high-severity local privilege escalation vulnerability, tracked as CVE-2026-8933 (CVSS score of 7.8), affecting default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw stems from a race condition introduced during a…
-
Adobe Acrobat Chrome extension bug enabled silent WhatsApp data theft
Adobe patched CVE-2026-48294, a flaw in Adobe Acrobat Chrome extension that could let attackers steal WhatsApp Web chats by luring users to a webpage. Guardio Labs researcher Shaked Biner disclosed HermeticReader, a vulnerability chain in the Adobe Acrobat Chrome extension that allowed any attacker-controlled webpage to silently steal a visitor’s WhatsApp chats, contacts, profile name,…
-
Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs
Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment.The high-severity flaw, tracked as CVE-2026-8933 (CVSS score: 7.8), impacts default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The disclosure comes as…
-
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over 314 million users, which, if exploited, could facilitate a silent hijack of a user’s WhatsApp data.The shortcoming has been codenamed HermeticReader by Guardio Labs. It’s officially tracked as CVE-2026-48294 (CVSS score: 7.4), with the vulnerability First…