Intelligence · Updated daily
AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.
An unauthenticated path traversal in LaunchServer's HTTP file server allows remote attackers to read arbitrary files, including cryptographic signing keys and database credentials, enabling full authentication bypass and system compromise. This affects GravitLauncher ≤ 5.7.11 on default port 9274.
9router uses a publicly committed hardcoded JWT secret as a fallback when JWT_SECRET environment variable is not configured, allowing unauthenticated attackers to forge valid session tokens and gain full dashboard/API access. This affects multiple public instances where operators failed to set the environment variable.
US federal law enforcement seized NetNut, an Israeli residential proxy service operated by publicly-traded Alarum Technologies, following security research linking it to the Popa botnet comprising at least two million compromised devices. The action represents significant progress in disrupting a major abuse infrastructure that enabled attackers to mask malicious traffic through residential IP addresses.
A new memory disclosure vulnerability in Citrix NetScaler appliances is being actively exploited using publicly available proof-of-concept code to extract arbitrary data from HTTP responses. The rapid weaponisation following disclosure creates immediate risk for unpatched deployments.
Google's Threat Intelligence Group, working with the FBI and Lumen, significantly degraded the NetNut residential proxy network by reducing its device pool by millions. This coordinated action targets infrastructure used for credential stuffing, ad fraud, and anonymised malicious activity across compromised home devices.
Stelios Kouloglou, a European Parliament member investigating commercial spyware abuses, was infected with Pegasus spyware twice during his tenure on the PEGA committee. This represents a direct attack on parliamentary oversight mechanisms and suggests threat actors are targeting those scrutinising spyware exports.
Anthropic is removing Claude Fable 5 from subscription tiers on 7 July but clarified this is temporary, not a permanent discontinuation. The move signals potential resource or licensing constraints but maintains model availability through alternative access methods.
Fleet's Helm Deployer fails to validate cross-namespace secret references in `valuesFrom` configurations, allowing authenticated tenants to read arbitrary secrets and deploy unauthorized cluster-wide resources across tenant boundaries in multi-tenant environments.
Project Owner role in Rancher Manager can modify Pod Security Admission labels to deploy privileged containers, bypassing namespace isolation and escalating to cluster-level access. This is a critical RBAC enforcement failure with high real-world exploitation likelihood.
Ghost CMS fails to properly validate the x-ghost-preview header, allowing unauthenticated attackers to inject malicious content into cached responses. When frontend and admin share a domain, this enables account takeover of staff users.
Cisco Talos published a biographical profile of Martin Lee, EMEA Lead, discussing his career transition from virology to cybersecurity leadership. This is a human interest piece with no security incident or threat intelligence content.
Microsoft is implementing admin-enforced approval policies for external AI bots joining Teams meetings, reducing the surface for unauthorized automated participants in sensitive discussions. This addresses growing concerns about uncontrolled AI integration in enterprise collaboration platforms.
An unpatched remote code execution vulnerability in Argo CD's repo-server component allows unauthenticated attackers with network access to the internal port to execute arbitrary code and achieve full Kubernetes cluster compromise. No CVE has been assigned and no patch is currently available.
A 19-year-old suspect linked to Scattered Spider has been extradited to the US and faces charges for participating in breaches including a luxury jewellery retailer compromise in 2025. This marks a significant law enforcement action against an active criminal collective known for social engineering and supply chain targeting.
Medical device manufacturer Medtronic has notified customers of a data breach attributed to the ShinyHunters threat actor, exposing personal information that puts affected individuals at risk of identity theft and fraud.
Fission's container executor fails to validate user-supplied PodSpec content, allowing tenants with only function-creation rights to inject host namespace access and privileged containers, escalating to node-level compromise. This is a direct privilege-escalation path from application-level RBAC to infrastructure control.
Fission's Environment CRD failed to validate or filter dangerous Kubernetes pod security fields (`hostPID`, `hostNetwork`, `privileged`), allowing namespace users with basic create/update RBAC to spawn host-privileged pods and escape to node compromise. Pod Security Admission bypass due to missing namespace labels amplified the risk.
Fission's Environment CRD fails to validate SecurityContext on standalone container fields, allowing attackers to inject privileged containers that bypass admission controls. This is a second-order bypass of prior hardening patches.
Attackers are exploiting large language models' tendency to generate non-existent domain names and registering these hallucinated domains to intercept developer traffic and compromise software supply chains. This technique bridges AI model weaknesses with domain squatting to create plausible but fake package repositories and dependencies.
CVE-2026-33825, a Microsoft Defender vulnerability, was exploited as a zero-day in ransomware attacks before patches became available. This represents a significant breach in endpoint protection integrity.
A sustained password spray attack originating from an IPv6 range controlled by LSHIY LLC has targeted Azure CLI with over 81 million login attempts between mid-June and late June 2026, successfully compromising at least 78 Microsoft accounts. This represents a significant threat to organisations using Azure command-line tooling without robust account protection measures.
CIA Director John Ratcliffe characterised AI capabilities as 'digital nuclear weapons', reflecting US intelligence community reassessment of AI's strategic threat profile and likely signalling policy shifts in how the agency approaches AI security and governance.
The US Department of Commerce has lifted export controls on Anthropic's Claude Fable 5 and Mythos 5 models, enabling international availability. This represents a significant policy reversal with implications for global AI competition and regulatory frameworks.
Cybercriminals target email accounts as a primary objective because inbox control grants access to password resets, financial accounts, and identity verification across an individual's digital footprint. This represents a fundamental shift in attack prioritisation from specific services to the authentication hub itself.
CISA disclosed three vulnerabilities in Daktronics controllers used in highway signs and billboards, allowing remote attackers to compromise critical public infrastructure. This represents a significant gap in the security of operational technology systems that directly affect public safety and commerce.