July 27, 2026
GitLab default-config RCE received a full technical write-up detailing memory-corruption bugs in the Oj JSON parser, and a working NGINX RCE exploit (CVE-2026-42533) was open-sourced. A Linux kernel local privilege-escalation flaw (CVE-2026-31431) affects all mainstream distributions with no vendor patches yet, while a Fortinet FortiClient kernel driver vulnerability enables credential theft. Multiple new offensive tools emerged including Nocturne (Windows loader), NaX (C2 beacon), beignet (macOS shellcode), Waypoint (EDR-bypass driver), and RootHound (Linux privilege-escalation mapper). Claude Opus 5 achieved 30.2% on ARC-AGI-3 benchmark while WallBreaker jailbreak claims emerged targeting the model. Supply-chain attacks continued with malicious npm/PyPI packages including a Shai-Hulud worm variant and a disguised @copilot-mcp/apex macOS infostealer.
July 12, 2026
Android 17 users face a public browser-to-kernel exploit chain combining Firefox JIT RCE (CVE-2026-10702) with kernel exploits for full device compromise. U-Boot firmware has six critical signature-verification flaws affecting 50+ stable releases and embedded devices worldwide, enabling arbitrary code execution and root-of-trust bypass. AI coding agents are now targets: Ghostcommit hides prompt-injection payloads in PNG images to steal environment secrets, while HalluSquatting weaponizes AI model hallucinations to register fake package names and deliver botnets to trusting developers. The jscrambler npm package was compromised with a Rust infostealer that executes on installation across Windows, macOS, and Linux.
June 30, 2026
watchTowr published a critical pre-auth RCE exploit for Progress Kemp LoadMaster (CVE-2026-8037), a network-edge appliance commonly fronting enterprise services. Oracle E-Business Suite (CVE-2026-46817) and SimpleHelp (CVE-2026-48558) vulnerabilities are being actively exploited in the wild; the latter drops Djinn Stealer, a new cross-platform infostealer targeting cloud and AI credentials. Microsoft removed 119 malicious Edge extensions in the StegoAd campaign (2.6M installs) that used steganography to hide credential-stealing and ad-fraud payloads, while Mustang Panda exploits Zoho WorkDrive against Indian government targets and ShinyHunters breaches Oracle PeopleSoft systems affecting NAIC and Nissan. Coinbase and other major tech companies are shifting internal AI workloads to Chinese open-weight models (GLM 5.2, Kimi 2.7, DeepSeek V4) to reduce costs, raising supply-chain and data-leakage concerns.
June 25, 2026
Cisco Catalyst SD-WAN Manager zero-day CVE-2026-20245 allows attackers to escalate from admin accounts to root by uploading malicious CSV files, as disclosed by Mandiant. Microsoft and Europol disrupted the shared infrastructure behind Amadey and StealC infostealers in Operation Endgame, recovering ~27M credentials and seizing over $47M. Anthropic alleges Alibaba illicitly extracted capabilities from Claude, highlighting emerging model-distillation IP-theft disputes. A stealthy Mistic RAT serves as entry point for initial-access broker Woodgnat (aka KongTuke), feeding multiple ransomware families including Qilin, Interlock, and Black Basta.