en
CVE-2026-56164 & CVE-2026-56155: Microsoft's SharePoint and AD FS Zero-Days in the July 622-CVE Patch Tuesday
Deep dive into Microsoft's record 622-CVE Patch Tuesday featuring active SharePoint and Active Directory Federation Services zero-days.
News
en
CVE-2026-15409 & CVE-2026-15410: Inside the SonicWall SMA 1000 Zero-Day Chain
Technical root cause and exploit chain analysis for the maximum-severity SonicWall SMA 1000 zero-day pair.
en
Security Roundup: SonicWall Zero-Days, Microsoft's Record Patch Tuesday, and the Klue Breach Fallout (Week of July 13, 2026)
Weekly briefing: SonicWall SMA 1000 zero-day chain, Microsoft 622-CVE Patch Tuesday, Accenture breach, and GhostApproval AI trust flaws.
en
Security Roundup: Adobe ColdFusion CVSS 10 Wave, SharePoint Warlock Ransomware, LoadMaster Pre-Auth RCE, Argo CD Kubernetes Zero-Auth — Week of July 3, 2026
Weekly briefing: Adobe ColdFusion 6x CVSS 10.0 wave, SharePoint Warlock ransomware, and Cursor IDE DuneSlide prompt injection.
en
DuneSlide: CVE-2026-50548 / CVE-2026-50549 — Zero-Click Prompt Injection to RCE in Cursor IDE
Cato AI Labs discloses DuneSlide: chaining prompt injection to sandbox escape and remote code execution in Cursor IDE.
en
Argo CD Repo-Server: 18-Month Unpatched Zero-Auth RCE Enables Full Kubernetes Cluster Takeover
Technical breakdown of the 18-month unpatched zero-authentication RCE in Argo CD enabling full Kubernetes takeover.
en
CVE-2026-8037: Progress Kemp LoadMaster Pre-Auth RCE — escape_quotes() Heap Failure, Active Exploitation
CVE-2026-8037 (CVSS 9.6) is a pre-auth OS command injection in Kemp LoadMaster rooted in escape_quotes() heap mishandling. watchTowr published a full PoC June 29; exploitation began the same day.
en
CVE-2026-45659: Microsoft SharePoint RCE Weaponized by Storm-2603 Warlock Ransomware — CISA KEV, Federal Deadline July 4
How Storm-2603 weaponized a SharePoint deserialization flaw to deploy Warlock ransomware across enterprise networks.
en
Adobe ColdFusion: Six CVSS 10.0 RCEs in One Update — CVE-2026-48276, 48277, 48281, 48282, 48283, 48316
Technical analysis of Adobe's emergency bulletin addressing six simultaneous CVSS 10.0 unauthenticated RCE flaws.
en
Security Roundup: Tata/Apple/Tesla Breach, Klue OAuth Supply Chain, Cisco UCM Webshells, Lantronix ICS Zero-Day, Atomic Arch AUR — Week of June 26, 2026
Weekly briefing: 630GB Apple/Tesla trade secrets leaked, Klue OAuth Salesforce data theft, Cisco UCM webshells, and Atomic Arch.
en
Atomic Arch: 1,500+ AUR Packages Backdoored with eBPF Rootkit and Credential Harvester
Investigation into Atomic Arch: over 1,500 Arch Linux AUR packages poisoned with eBPF stealth rootkits and credential grabbers.
en
CVE-2025-67038: Lantronix EDS5000 CVSS 9.8 Code Injection — CISA KEV, ICS/OT Alert, Federal Deadline Today
CISA issues urgent warning over critical CVSS 9.8 code injection in Lantronix industrial serial converters.