en
DuneSlide: CVE-2026-50548 / CVE-2026-50549 — Zero-Click Prompt Injection to RCE in Cursor IDE
Cato AI Labs discloses DuneSlide: chaining prompt injection to sandbox escape and remote code execution in Cursor IDE.
Latest
en
Argo CD Repo-Server: 18-Month Unpatched Zero-Auth RCE Enables Full Kubernetes Cluster Takeover
Technical breakdown of the 18-month unpatched zero-authentication RCE in Argo CD enabling full Kubernetes takeover.
en
CVE-2026-8037: Progress Kemp LoadMaster Pre-Auth RCE — escape_quotes() Heap Failure, Active Exploitation
CVE-2026-8037 (CVSS 9.6) is a pre-auth OS command injection in Kemp LoadMaster rooted in escape_quotes() heap mishandling. watchTowr published a full PoC June 29; exploitation began the same day.
en
CVE-2026-45659: Microsoft SharePoint RCE Weaponized by Storm-2603 Warlock Ransomware — CISA KEV, Federal Deadline July 4
How Storm-2603 weaponized a SharePoint deserialization flaw to deploy Warlock ransomware across enterprise networks.
en
Adobe ColdFusion: Six CVSS 10.0 RCEs in One Update — CVE-2026-48276, 48277, 48281, 48282, 48283, 48316
Technical analysis of Adobe's emergency bulletin addressing six simultaneous CVSS 10.0 unauthenticated RCE flaws.
en
Security Roundup: Tata/Apple/Tesla Breach, Klue OAuth Supply Chain, Cisco UCM Webshells, Lantronix ICS Zero-Day, Atomic Arch AUR — Week of June 26, 2026
Weekly briefing: 630GB Apple/Tesla trade secrets leaked, Klue OAuth Salesforce data theft, Cisco UCM webshells, and Atomic Arch.
en
Atomic Arch: 1,500+ AUR Packages Backdoored with eBPF Rootkit and Credential Harvester
Investigation into Atomic Arch: over 1,500 Arch Linux AUR packages poisoned with eBPF stealth rootkits and credential grabbers.
en
CVE-2025-67038: Lantronix EDS5000 CVSS 9.8 Code Injection — CISA KEV, ICS/OT Alert, Federal Deadline Today
CISA issues urgent warning over critical CVSS 9.8 code injection in Lantronix industrial serial converters.
en
CVE-2026-20230: Cisco Unified CM SSRF → Root — Tor-Routed Webshell Drops Confirmed, Patch Now
Technical root cause of the Cisco Unified CM SSRF vulnerability exploited in the wild to drop Tor-routed root webshells.
en
Klue OAuth Breach: Icarus Steals Salesforce CRM Data from Huntress, Tanium, Recorded Future and Hundreds More
How threat group Icarus weaponized Klue OAuth app tokens to silently extract Salesforce data across hundreds of security vendors.
en
Tata Electronics Breach: 630 GB of Apple and Tesla Trade Secrets Leaked by World Leaks
How extortion group World Leaks breached Tata Electronics and leaked 630 GB of proprietary Apple and Tesla engineering assets.
en
Security Roundup: Cisco SD-WAN Zero-Day, DragonForce Teams Relay Backdoor, JetBrains AI Key Theft, Mastra npm RAT, FortiBleed — Week of June 19, 2026
A week defined by a novel ransomware C2 technique abusing Microsoft's own relay infrastructure, the sixth Cisco SD-WAN zero-day of the year, a coordinated campaign stealing AI API keys from 70,000 developer IDE installs, a supply chain attack backdooring 144 npm packages via a stale contributor account,