July 7, 2026
A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary
A 16-year-old KVM hypervisor vulnerability (CVE-2026-53359) enabling guest-to-host escape is under public exploitation, with panic PoCs already available. Adobe ColdFusion CVE-2026-48282 (CVSS 10.0) is being actively exploited in the wild within hours of disclosure, with unauthenticated remote code execution possible. AI-powered coding agents are now a live attack surface, with researchers demonstrating agent hijacking, malicious skill injection, and data exfiltration through prompt injection in creator tools like YouTube's Ask Studio. Iran-linked hackers are deploying a new modular C2 framework called Cavern against Israeli targets, while ClickFix malware operators are leveraging blockchain as a resilient command infrastructure.