THREAT OPS › Threat News

Threat Intelligence News

12121 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

[NVD] CVE-2026-53362 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclennvd · 2026-07-04
[NVD] CVE-2026-53359 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and compnvd · 2026-07-04
[NVD] CVE-2026-14613 (MEDIUM 4.3) — A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a spnvd · 2026-07-03
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaignsecurelist · 2026-07-03
[NVD] CVE-2026-9547 (HIGH 7.4) — When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key typnvd · 2026-07-03
[NVD] CVE-2026-9546 (HIGH 7.5) — A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer strnvd · 2026-07-03
[NVD] CVE-2026-9545 (HIGH 7.5) — In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second timenvd · 2026-07-03
[NVD] CVE-2026-9080 (HIGH 7.3) — Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.nvd · 2026-07-03
[NVD] CVE-2026-8932 (HIGH 7.5) — libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. Honvd · 2026-07-03
[NVD] CVE-2026-8927 (CRITICAL 9.1) — When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent nvd · 2026-07-03
[NVD] CVE-2026-8926 (CRITICAL 9.1) — When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such nvd · 2026-07-03
[NVD] CVE-2026-8924 (CRITICAL 9.1) — A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.nvd · 2026-07-03
[NVD] CVE-2026-8458 (MEDIUM 6.5) — libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid onvd · 2026-07-03
[NVD] CVE-2026-12064 (HIGH 7.5) — When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options nvd · 2026-07-03
[NVD] CVE-2026-11856 (CRITICAL 9.8) — Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header fieldnvd · 2026-07-03
[NVD] CVE-2026-11586 (HIGH 7.5) — By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.nvd · 2026-07-03
[NVD] CVE-2026-11564 (CRITICAL 9.1) — libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handnvd · 2026-07-03
[NVD] CVE-2026-11352 (HIGH 7.5) — An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connectednvd · 2026-07-03
[NVD] CVE-2026-10536 (CRITICAL 9.8) — A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. Durnvd · 2026-07-03
Risky Bulletin: FatFs bugs enable physical access attacks on a load of devicesriskybiz_news · 2026-07-03
[NVD] CVE-2026-8921 — External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more nvd · 2026-07-03
[NVD] CVE-2026-12960 — An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' senvd · 2026-07-03
How We Added WebAuthn to a Browser-Based RDP Clientunit42 · 2026-07-02
[NVD] CVE-2026-38970 (HIGH 7.5) — pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.nvd · 2026-07-02
SecOps for the AI Age: Detecting and Responding to AI‑Related Incidentszscaler_threatlabz · 2026-07-02
ClamAV Vulnerabilities Affecting Cisco Products: July 2026cisco_psirt · 2026-07-02
[NVD] CVE-2026-58381 (MEDIUM 6.1) — A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code envd · 2026-07-02
FBI Seizes NetNut Proxy Platform, Popa Botnetkrebs · 2026-07-02
Whistleblowersoftware.com: confidentiality and anonymity leakage to third partiesfulldisclosure · 2026-07-02
OpenBlow Multiple Deanonymization Vulnerabilitiesfulldisclosure · 2026-07-02
Wordfence Intelligence Weekly WordPress Vulnerability Report (June 22, 2026 to June 28, 2026)wordfence · 2026-07-02
Catan and Mousetalos · 2026-07-02
Indirect Prompt Injection in Web Content Targets AI Agentszscaler_threatlabz · 2026-07-02
Remus Stealer: A New, Not-So-New Infostealerflashpoint · 2026-07-02
When To Choose SSE vs. SASE: A Decision Framework for Security Leaderszscaler_threatlabz · 2026-07-02
It’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)watchtowr · 2026-07-02
Statistical Report on Malware Targeting Linux SSH Servers in Q2 2026ahnlab · 2026-07-02
Statistical Report on Malware Targeting Windows Database Servers in Q2 2026ahnlab · 2026-07-02
Statistical Report on Malware Targeting Windows Web Servers in Q2 2026ahnlab · 2026-07-02
Attack Technique Trend Report for Q2 2026ahnlab · 2026-07-02
Google’s Continued Disruption of Malicious Residential Proxy Networksmandiant_gti · 2026-07-02
Context Engineering | Compaction & Agent Memory for Automated Malware Analysissentinelone · 2026-07-02
GPT-5.5-Cyber built a zlib fuzzing lab in a daytrailofbits · 2026-07-02
The AI Arms Race: How Adversaries are Weaponizing AI for Speed and Scaleeclecticiq · 2026-07-02
Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projectssecurelist · 2026-07-02
Vulnerability & Patch Roundup — June 2026sucuri_blog · 2026-07-02
Srsly Risky Biz: America won't beat the distillation ecosystemriskybiz_news · 2026-07-02
Varonis Recognized as a Customers’ Choice for Data Security Posture Management for Third Consecutive Yearvaronis_blog · 2026-07-02
Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3elastic_security · 2026-07-02
Recorded FutureがGartner® サイバー脅威インテリジェンス・テクノロジー部門のMagic Quadrant™のリーダーの１社に位置づけられました。recordedfuture · 2026-07-02
[NVD] CVE-2026-58263 (HIGH 7.2) — Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event hanvd · 2026-07-01
[NVD] CVE-2026-58592 (HIGH 8.3) — Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by renvd · 2026-07-01
An AI Agent That Can’t See the Whole Path Is Just a Faster Way to Be Wrongzscaler_threatlabz · 2026-07-01
[NVD] CVE-2026-56152 (MEDIUM 5.3) — Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authnvd · 2026-07-01
[NVD] CVE-2026-34105 (HIGH 8.8) — Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract nvd · 2026-07-01
[NVD] CVE-2026-34104 (HIGH 8.8) — Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\".$_GET['name'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.nvd · 2026-07-01
[NVD] CVE-2026-34103 (HIGH 8.8) — Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract databnvd · 2026-07-01
[NVD] CVE-2026-34102 (HIGH 8.8) — Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.nvd · 2026-07-01
[NVD] CVE-2026-34101 (HIGH 8.8) — Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL nvd · 2026-07-01
[NVD] CVE-2026-34100 (HIGH 8.8) — Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injenvd · 2026-07-01
[NVD] CVE-2026-20191 (HIGH 7.5) — A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container.  This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sendnvd · 2026-07-01
Cisco Advance Notification for Publication of July 1, 2026, Security Advisoriescisco_psirt · 2026-07-01
Cisco Unified Communications Manager Server-Side Request Forgery Vulnerabilitycisco_psirt · 2026-07-01
The June 2026 Apple Security Update Reviewzdi_blog · 2026-07-01
Ransom & Dark Web Issues Week 1, July 2026ahnlab · 2026-07-01
[NVD] CVE-2026-53354 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may complete before the global observation of writes which are nvd · 2026-07-01
Vulnerability Prioritization Is Missing the AI-Era Pointsonatype · 2026-07-01
Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsulafortinet_research · 2026-07-01
22nd June – Threat Intelligence Reportcheckpoint_research · 2026-07-01
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Techniquecheckpoint_research · 2026-07-01
Martin Lee: Running through the Arctic (and the threat landscape)talos · 2026-07-01
Overview of Content Published in Junedidier_stevens · 2026-07-01
Risky Bulletin: Researcher drops giant cache of zero-daysriskybiz_news · 2026-07-01
Unmasking the crawls with Attribution Business Insightscloudflare_security · 2026-07-01
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vectorunit42 · 2026-07-01
[CISA KEV] CVE-2026-45659 — Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerabilitycisa_kev · 2026-07-01
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Toolrecordedfuture · 2026-07-01
[Breach] Fluke — 821,100 accounts exposedhibp_breaches · 2026-07-01
CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)watchtowr · 2026-06-30
Update: base64dump.py Version 0.0.30didier_stevens · 2026-06-30
Five Eyes Cyber Agencies Signal a New AI Security Consensus: “We Must Act Now”zscaler_threatlabz · 2026-06-30
What’s in the SOSS? Podcast #64 – S3E16 The Heartbeat of the Kernel: Why Upstream is the Ultimate Security Strategy with Greg Kroah-Hartmanopenssf_blog · 2026-06-30
America250 Fourth of July Threat Assessmentflashpoint · 2026-06-30
The Hidden National Security Threat Inside AI-Driven Softwaresonatype · 2026-06-30
[NVD] CVE-2026-58016 (HIGH 7.5) — A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` onvd · 2026-06-30
[NVD] CVE-2026-58015 (MEDIUM 5.9) — A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, nvd · 2026-06-30
[NVD] CVE-2026-58014 (HIGH 7.3) — A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds accessnvd · 2026-06-30
[NVD] CVE-2026-58013 (MEDIUM 6.5) — A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor informationvd · 2026-06-30
[NVD] CVE-2026-58012 (MEDIUM 6.5) — A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 invd · 2026-06-30
[NVD] CVE-2026-58011 (MEDIUM 6.5) — A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentnvd · 2026-06-30
[NVD] CVE-2026-58010 (MEDIUM 6.5) — A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can caunvd · 2026-06-30
What’s New in GovCloud: June 2026 Zscaler Product Updateszscaler_threatlabz · 2026-06-30
Shipping post-quantum cryptography to Pythontrailofbits · 2026-06-30
Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental Appcyble · 2026-06-30
[NVD] CVE-2026-56809 (MEDIUM 6.1) — Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who accesses a crafted URL.nvd · 2026-06-30
[NVD] CVE-2026-14164 (HIGH 7.5) — A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can triggernvd · 2026-06-30
SSE Components Explained: SWG, ZTNA, CASB, and How They Work Togetherzscaler_threatlabz · 2026-06-29
Accelerating EDR Evasion with LLM-Driven Analysisspecterops · 2026-06-29
Between Two Nerds: Set cyberspace ablazeriskybiz_news · 2026-06-29
[NVD] CVE-2026-43746 (MEDIUM 6.5) — A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.nvd · 2026-06-29