60
60
60
60
60
60
60
60
60
35
ZDI-26-678: Adobe Photoshop DCM File Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI disclosed a CVSS 7.8 integer overflow remote code execution flaw (CVE-2026-75863) in Adobe Photoshop DCM file parsing.
The Zero Day Initiative published advisory ZDI-26-678 describing an integer overflow remote code execution vulnerability in Adobe Photoshop, tracked as CVE-2026-75863 with a CVSS 7.8 score. The flaw occurs while parsing DCM files. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. No in-the-wild exploitation is reported.
32
Adobe releases out-of-band patches for critical issues in Acrobat Reader, Photoshop, Bridge, ColdFusion
60
60
35
55
30
June 2021 Patch Tuesday: Microsoft fixes six actively exploited zero-days
60
60
60
60
Why the current tech backlash feels different
The Verge's Decoder mailbag discusses the current tech backlash, arguing AI hype overstates verifiability outside software engineering.
Nilay Patel's Decoder mailbag episode addresses listener feedback on the widely discussed 'software brain' essay. He argues AI hype is concentrated on software because code is verifiable through compilation, while domains like drug discovery, math and science lack equivalent verifiability. The episode also touches on AI backlash, surveillance, data centers and upcoming midterm coverage.
18
Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day
Adobe patched over 170 flaws, including in-the-wild zero-day CVE-2026-75650 (CVSS 10) in Adobe Commerce/Magento enabling unauthenticated RCE and web shell deployments.
Adobe released fixes for more than 170 vulnerabilities across Experience Manager, Acrobat Reader, Photoshop and other products. The Commerce zero-day CVE-2026-75650 (CVSS 10) allows unauthenticated code injection leading to remote code execution and has been exploited since September 4. Sansec reported multiple threat actors deploying backdoors and web shells via the bug, dubbed StyleSmuggler, which triggers injected code through Magento's Payment Transaction Failed Reminder email. Adobe also patched critical Campaign Classic command injection CVE-2026-82004 and two critical ColdFusion RCE flaws (CVE-2026-48273, CVE-2026-75746).
88
Instagram’s AI detection is a mess (again)
Instagram is mislabeling ordinary edited photos as AI Content while some AI imagery goes unlabeled, repeating a 2024 detection failure.
The Verge documents weeks of erroneous AI Content labels on Instagram, including images edited only with Canva's Background Remover or an iPhone Photos app, while some generative images escape tagging. Canva said some of its assistive AI tools were being tagged as generative and claims the issue is fixed, though users still report tagging. Meta scans IPTC and C2PA metadata and uses signals like Google's SynthID, but remains vague about detection criteria; one tester found only Meta AI-created or edited images reliably triggered labels, and an image-poisoned photo was tagged. A similar mislabeling wave hit Instagram in 2024.
35
42
55
Adobe addressed critical bugs in Illustrator, After Effects Software
60
42
60
60
60
30
55
30
60
45
45
57
Troy Hunt
Troy Hunt warns ShinyHunters' Carhartt breach claim of 50GB and millions of records is unverified, while Sri Lanka joins Have I Been Pwned.
Troy Hunt's blog roundup centers on a cautionary tale about data breach claims: ShinyHunters claims it compromised Carhartt and stole over 50GB of compressed data containing millions of customer records, employee information and loyalty data, but Hunt stresses criminal claims require verification. The feed also covers Sri Lanka CERT becoming the 48th government onboarded to Have I Been Pwned's free government monitoring service, following Nepal as the 47th. Other commentary addresses ransomware economics, Brinks Home's lawyer-heavy extortion FAQ, and the Origin Energy breach in Australia.
30
August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?
August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.
July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.
40
60