Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index906 entries

Vulnerabilities Malware Campaigns Supply Chain Policy Tools

Page 4 of 37

76–100 of 906

highCampaignActive

Multi-vector intelligence and malware campaign: Iranian APT activity, macOS CrashStealer, and strategic infrastructure targeting

SecurityWeek aggregates multiple concurrent threats: Iranian state actors tracking US military communications, CrashStealer malware targeting macOS users, ransomware targeting naval defence contractor TKMS, and broader supply-chain compromise vectors. This represents a portfolio of sophisticated, active threats across government, commercial, and critical infrastructure sectors.

18 July 2026US Military communications infrastructure, macOS platforms, TKMS (ThyssenKrupp Marine Systems) +2

criticalVulnerabilityContained

WordPress Core RCE Affects 6.9 and 7.0: Forced Auto-Updates Limit Exposure Window

An unauthenticated remote code execution flaw in WordPress core 6.9 and 7.0 allowed arbitrary code execution on unpatched installations. WordPress deployed forced auto-updates on Friday, rapidly patching affected versions to 6.9.5 and 7.0.2.

18 July 2026WordPress 6.9, WordPress 7.0

highSupply ChainActive

Fairlife production halt reveals operational resilience gap in food supply chain

Fairlife, a $1 billion+ dairy company, suspended US production across three states following a cyber incident. The outage highlights how food manufacturers remain exposed to operational disruption despite their role in critical infrastructure.

18 July 2026Fairlife LLC

highCampaignActive

Abbott's dual breach exposes risks in legacy healthcare infrastructure and cloud portals

Abbott Laboratories is investigating two concurrent cybersecurity incidents: unauthorised access to legacy Exact Sciences systems in its Cancer Diagnostics division and a separate breach of its LabCentral portal with alleged data theft. The incidents highlight vulnerabilities in healthcare IT infrastructure spanning both legacy systems and modern cloud platforms.

18 July 2026Abbott Laboratories, Exact Sciences Cancer Diagnostics, LabCentral portal

criticalVulnerabilityActive

Envoy Gateway Path Normalization Bypass Enables Unauthorized Filesystem Access and Credential Disclosure

A path normalization flaw in Envoy Gateway's Lua security validation allows attackers to bypass authentication checks and read sensitive files (Kubernetes tokens, TLS certs, environment variables) from gateway controller pods by submitting malicious EnvoyExtensionPolicy objects.

CVE-2026-53713

17 July 2026envoyproxy/gateway (versions < v1.7.4, < v1.8.1)

criticalVulnerabilityActive

Pheditor: Hardcoded Default Credentials with No Forced Change Policy

Pheditor ships with a hardcoded SHA-512 hashed default password ('admin') with no forced change mechanism, granting unauthenticated attackers immediate RCE and arbitrary file access on any unpatched deployment. This is a trivial pre-authentication compromise vector affecting all versions.

CVE-2026-55579

17 July 2026pheditor/pheditor

informationalPolicyEmerging

Cisco Talos Signals Coordinated Patch Release Cycle with Limited Technical Visibility

Cisco Talos has published a teaser article announcing a significant coordinated patching event, but the source material provides insufficient technical detail to assess specific vulnerabilities or their impact. The framing suggests multiple vendors may be releasing patches simultaneously.

17 July 2026

highPolicyActive

OT vulnerability disclosure dilemma: balancing safety against transparency in legacy industrial systems

SecurityWeek examines the structural tension in operational technology security where legacy systems, safety dependencies, and critical infrastructure protection create barriers to standard vulnerability disclosure practices. The piece highlights how OT environments differ fundamentally from IT, complicating the security research and patching ecosystem.

17 July 2026OT systems broadly, legacy industrial control systems

highCampaignResolved

Scattered Spider operatives sentenced for £29M TfL ransomware attack demonstrating persistent threat from young, organised cybercriminals

Two members of the Scattered Spider cybercriminal group, Owen Flowers (18) and Thalha Jubair (20), received 5.5-year sentences for orchestrating a 2024 ransomware attack against Transport for London that disabled 148 systems and forced 27,000 employees to reset credentials in person. The sentencing marks a significant law enforcement victory but group's capacity to cause infrastructure-level disruption.

17 July 2026Transport for London

highPolicyEmerging

US-Canada surveillance legislation dispute highlights encryption backdoor risks in Five Eyes alliance

Senator Ron Wyden opposes Canada's proposed lawful access legislation, arguing it would repurpose US technology infrastructure for surveillance and set a dangerous precedent. The dispute reflects ongoing tensions within the Five Eyes alliance over encryption backdoors and government access capabilities.

17 July 2026US technology infrastructure providers, Canadian telecommunications operators

highMalwareEmerging

ClickLock macOS malware uses process termination to force password disclosure

ClickLock is a new macOS information-stealer that terminates all visible processes to coerce users into entering their system login password, bypassing normal user friction and capturing credentials before defenders can respond.

17 July 2026macOS

highSupply ChainActive

npm Supply Chain Evolving to Multi-Stage, Persistent Attacks Beyond Package Poisoning

Unit 42 documents an escalation in npm ecosystem attacks post-Shai Hulud, shifting from simple malware injection to wormable payloads and CI/CD persistence mechanisms. This represents a maturation of supply chain targeting beyond initial compromise.

16 July 2026npm ecosystem, Node.js projects, CI/CD pipelines

highVulnerabilityEmerging

Cursor AI Editor Path Traversal to RCE via Malicious git.exe Injection

Cursor, an AI-powered code editor, automatically executes a git.exe binary from the project root without validation, allowing attackers to achieve arbitrary code execution by distributing malicious repositories. This is particularly concerning given Cursor's access to sensitive development environments and integration with build pipelines.

16 July 2026Cursor (AI code editor)

highMalwareEmerging

LLM-Generated IoT Botnet TuxBot v3 Shows Developer Capability Gap Despite AI Assistance

Researchers discovered TuxBot v3 Evolution, an IoT botnet framework apparently developed with LLM assistance, revealing that while AI can generate functional malware code, poor operational security by developers (ignoring safety disclaimers) remains a limiting factor in threat sophistication.

16 July 2026IoT devices (generic), Linux-based systems

informationalPolicyEmerging

Gold Eagle: US government centralises AI-driven vulnerability coordination across critical infrastructure

The Trump administration has launched Gold Eagle, a clearinghouse programme that uses artificial intelligence to help industry and government detect, prioritise and remediate cybersecurity vulnerabilities at scale. This represents a significant policy shift toward centralised vulnerability intelligence sharing.

16 July 2026Critical infrastructure operators, US government agencies, Private sector industry participants

highCampaignContained

Dutch Police Dismantle €100M Investment Fraud Scheme Targeting Tens of Thousands

Dutch law enforcement arrested multiple individuals operating an international investment fraud ring that defrauded tens of thousands of victims of over €100 million. The case highlights the persistence of large-scale financial fraud operations and the challenges in prosecuting cross-border criminal networks.

16 July 2026Individual investors across multiple countries

criticalVulnerabilityActive

FacturaScripts Path Traversal in File Upload Handler — Unauthenticated RCE via Directory Escape and .htaccess Write

Authenticated users can bypass file upload restrictions in FacturaScripts by injecting `../` sequences into client-supplied filenames, enabling arbitrary file writes outside the intended `MyFiles/` directory. Combined with `.htaccess` exclusion bypass, this escalates to remote code execution via executable file placement in web-accessible directories.

15 July 2026facturascripts/facturascripts

highVulnerabilityEmerging

6 GHz Wi-Fi Automated Frequency Coordination Trusts Unvalidated Client Data, Enabling Location Spoofing Attacks

Automated Frequency Coordination systems for 6 GHz Wi-Fi accept client-supplied location data without proper validation, allowing attackers to spoof their position and disrupt spectrum access for legitimate users and critical infrastructure.

15 July 2026Automated Frequency Coordination systems, 6 GHz Wi-Fi devices and access points

highVulnerabilityActive

Microsoft's AI-Assisted Vulnerability Discovery Drives 570-Patch Record, Signalling Acceleration in Patch Volume

Microsoft released 570 security patches in a single Patch Tuesday cycle, triple the previous month's record, with the vendor attributing the surge to artificial intelligence-aided vulnerability discovery. This represents a significant shift in patch cadence and raises questions about remediation capacity across enterprise environments.

15 July 2026Microsoft Windows, Microsoft Office, Microsoft other software products

criticalVulnerabilityActive

Microsoft's Record 622-Patch Release Signals Escalating Vulnerability Debt and Active Exploitation

Microsoft released 622 security patches in a single update, triple the previous monthly high, including at least two zero-day vulnerabilities currently under active attack. Immediate patching is essential for organisations running Microsoft products.

15 July 2026Microsoft (multiple products affected)

highPolicyActive

US prosecutes Russian bulletproof hosting operators: infrastructure enablers face indictment

The US Department of Justice has unsealed charges against alleged operators of Media Land and ML Cloud, St. Petersburg-based companies accused of providing hosting infrastructure and technical support specifically to cybercriminals. This represents a significant enforcement action targeting the operational backbone of organised cybercrime.

15 July 2026Cybercriminals using bulletproof hosting services

criticalVulnerabilityActive

SonicWall SMA1000 zero-days under active exploitation: RCE flaws demand immediate patching

SonicWall disclosed two zero-day remote code execution vulnerabilities in SMA1000 appliances (CVE-2026-15409 and CVE-2026-15410) that are already being exploited in the wild. Organisations running these secure access appliances must apply patches immediately to prevent authenticated attacker access.

CVE-2026-15409CVE-2026-15410

15 July 2026SonicWall SMA1000

criticalVulnerabilityActive

FacturaScripts REST API SQL Injection via Parenthesis Bypass in Where::sqlColumn

Authenticated SQL injection in FacturaScripts REST API filter parameter allows scoped API keys with minimal privileges to extract sensitive data (password hashes, session cookies) and achieve account takeover. The vulnerability bypasses identifier escaping through parenthesis-containing field names.

CVE-2026-45262

14 July 2026FacturaScripts/FacturaScripts (master branch, pre-2026-05 builds)

criticalVulnerabilityActive

Anyquery Server Mode: Unrestricted ATTACH DATABASE Enabling Arbitrary File Write and RCE

Anyquery's server mode fails to restrict SQLite's ATTACH DATABASE command, allowing unauthenticated remote attackers to write arbitrary files to any filesystem location the process can access, directly enabling code execution via web shells, SSH key injection, or cron job manipulation.

CVE-2026-50006

14 July 2026anyquery/anyquery

highVulnerabilityActive

Multi-Tenant Workflow Backup Isolation Bypass in n8n-MCP

Authenticated tenants in multi-tenant HTTP n8n-MCP deployments can access, modify, or delete other tenants' workflow version backups, exposing credential references and authorization headers. Patch 2.56.1 isolates backup storage per tenant.

CVE-2026-54052

14 July 2026n8n-mcp <= 2.56.0