60
60
60
60
60
60
A patched Windows attack surface is still exploitable
60
NIST and CISA finalize playbook to stop token theft and forgery
NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.
The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.
60
60
60
Microsoft December 2021 Patch Tuesday fixes an actively exploited zero
60
60
60
60
2026-002: Multiple Vulnerabilities in Cisco Products
Cisco fixed SD-WAN Controller auth bypass CVE-2026-20127 (CVSS 10) exploited in the wild since 2023, plus several critical and high flaws in SD-WAN Manager.
On 25 February 2026 Cisco released advisories for multiple flaws in Catalyst SD-WAN Controller and SD-WAN Manager, potentially granting administrative access to attackers. CVE-2026-20127 (CVSS 10.0) is an authentication bypass in the Controller's peering authentication mechanism, exploited in the wild since 2023, allowing unauthenticated admin access via NETCONF, rogue device injection, and persistent access. SD-WAN Manager flaws include CVE-2026-20129 (9.8, unauthenticated API auth bypass to netadmin), CVE-2026-20126 (7.8, local privesc to root), CVE-2026-20133 (7.5, info disclosure), CVE-2026-20122 (7.1, arbitrary file overwrite), and CVE-2026-20128 (5.5, DCA info disclosure). CERT-EU recommends patching, capturing forensic evidence, IOC hunting, and restricting management-plane internet exposure.
78
60
60
60
60
60
60
60
WordPress Plugins Compromised Without a Single File Change
Attackers poisoned bdThemes' JSON API feed to backdoor WordPress sites by serving malicious remote code without modifying plugin files.
Infosecurity Magazine reports a supply chain attack in which attackers poisoned a JSON feed used by bdThemes WordPress plugins. The compromised feed delivered malicious code that backdoored sites without changing any plugin files, evading file-integrity based detection. WordPress sites running the vendor's plugins were affected.
60
60
60
60
60
OpenAI's new Agents API gives developers the infrastructure behind Codex and ChatGPT
OpenAI released its Agents API in public beta, exposing the infrastructure behind Codex and ChatGPT for building long-running cloud agents.
OpenAI launched the Agents API as a public beta, letting developers build cloud-based agents that can run for hours, execute code, and process files on the same infrastructure that powers Codex and ChatGPT. Features include automatic context management, parallel tool use, and task delegation to sub-agents, with a choice of OpenAI-hosted sandboxes or partner environments from Cloudflare, Vercel, and Oracle. The API builds on the open-source Codex harness and supports MCP, custom functions, and built-in tools such as web search, with no extra fees beyond token-based billing.
70
Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code
GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.
74
60
60
Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.
Acronis Threat Research Unit attributes a campaign to Chinese-speaking threat actor Red Heron, which weaponized CVE-2026-60004, a CVSS 9.8 RCE in Gitea versions 1.17 through 1.27.0, patched in 1.27.1 on July 27, 2026. The actor built an automated exploitation framework after a public PoC appeared, scanned 1,386 internet-exposed Gitea instances across seven countries, and separately listed 477 Taiwan-based systems across defense, energy, elections, and AI sectors. Confirmed victims include organizations in Canada, Argentina, Taiwan, the US, and Sri Lanka, with a Canadian renewable-energy firm hit in 22 sessions and a Taiwanese industrial automation firm losing hundreds of repositories including SCADA/HMI tools. Red Heron deploys the JITTERLY Linux implant (30+ commands, AES-128-GCM, Adaptix-like protocol) and the SIXZUT LD_PRELOAD rootkit disguised as libglthread.so.2, and moved laterally into a Synology/Proxmox environment to steal VM backups.
84
60
60
Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities
60
60
60
60
60
60