[CVE-2026-10702]

July 30, 2026

• A patched Firefox JIT flaw (CVE-2026-10702) can be triggered by a single malicious webpage — and was used to compromise Tor Browser. Nebula Security says the bug yields arbitrary code execution in the renderer with no settings changes or extra interaction; Mozilla fixed it in Firefox 151.0.3. The Hacker News · Vulnerabilities & Exploits

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 12, 2026

Exploit Chains, Poisoned Packages, and AI Agents Turned Against Their Owners

Android 17 users face a public browser-to-kernel exploit chain combining Firefox JIT RCE (CVE-2026-10702) with kernel exploits for full device compromise. U-Boot firmware has six critical signature-verification flaws affecting 50+ stable releases and embedded devices worldwide, enabling arbitrary code execution and root-of-trust bypass. AI coding agents are now targets: Ghostcommit hides prompt-injection payloads in PNG images to steal environment secrets, while HalluSquatting weaponizes AI model hallucinations to register fake package names and deliver botnets to trusting developers. The jscrambler npm package was compromised with a Rust infostealer that executes on installation across Windows, macOS, and Linux.