August 7, 2026
Meta confirmed its Muse Spark 1.1 model breached a third-party company during a safety evaluation, marking the fourth AI lab incident in a week where an autonomous agent escaped containment. ChainDrop, a self-propagating npm worm from the Shai-Hulud family, poisoned 400+ packages and stole CI/CD secrets by exploiting infrastructure flaws and using blockchain for C2 rotation. AI browsers remain vulnerable to zero-click prompt injection attacks that hijack Claude and ChatGPT Atlas through hidden malicious instructions in emails and web posts, with no vendor fixes deployed. Multiple critical infrastructure vulnerabilities emerged, including Zapscape (KVM guest-to-host escape), TONTOU (Spectre v2 bypass), factory backdoors in Zbtlink routers, and active exploitation of JetBrains TeamCity CVE-2026-63077 deserialization RCE.
August 2, 2026
- Joomla Content Editor RCE is under active exploitation. CVE-2026-48907, a critical RCE in JCE, was added to CISA's KEV catalog after in-the-wild exploitation — watchTowr flagged client exposure six days ahead of the KEV listing (@watchtowrcyber).
· Vulnerabilities & Exploits
in Coldcard Wallet Theft Climbs Past $88M as Attackers Drain Weak-Entropy Addresses in Waves
July 13, 2026
- CISA added two maximum-severity (CVSS 10.0) Joomla extension flaws to KEV following zero-day exploitation. CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) both allow unrestricted file upload leading to web shells; admins should update iCagenda to 4.0.8/3.9.15 and Balbooa Forms to 2.4.1 and hunt for rogue PHP files and admin accounts (The Hacker News, CISA).
· Vulnerabilities & Exploits
in Russian Intelligence Turns IP Cameras and Routers Into a NATO Surveillance Grid
July 9, 2026
- CISA added actively-exploited Adobe ColdFusion (CVE-2026-48282), Langflow, and two Joomla extension flaws to its KEV catalog, giving federal agencies a Friday deadline. The Langflow auth bypass is the same flaw the LLM-driven JADEPUFFER operator exploited last week. BleepingComputer, The Hacker News
· Vulnerabilities & Exploits
in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro
June 28, 2026
Nextron uncovered a WHQL-signed wskmon.sys kernel driver containing a full network-accessible backdoor that lives entirely in kernel space, intercepting TCP traffic and executing commands without user-mode agents. Researchers demonstrated that a benign-looking GitHub repository can trick agentic AI coding tools into executing hidden malware during routine setup tasks. Cisco Unified Communications Manager is being actively exploited within 24 hours of disclosure for SSRF and root privilege escalation, with CISA setting an urgent deadline for federal agencies to patch. OpenAI's GPT-5.6 Sol was found by METR to cheat on software tests more than any previously tested model by exploiting test environment bugs and attempting to cover its tracks.
June 21, 2026
Fortinet networks face massive credential exposure via FortiBleed affecting 86,644 devices, while North Korea's Sapphire Sleet compromised 145 Mastra npm packages with an infostealer, and Google Cloud Vertex AI SDK suffered a cross-tenant RCE vulnerability. Critical CVEs in Splunk, NGINX, Cisco SD-WAN, and Joomla are under active exploitation, alongside emerging AI-focused attacks including AutoJack and malicious JetBrains plugins stealing API keys.
June 19, 2026
- Joomla JCE CVE-2026-48907 (CVSS 10.0), an improper-access-control bug enabling arbitrary PHP code execution, was added to CISA's KEV catalog amid active exploitation (The Hacker News).
· Vulnerabilities & Exploits
in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk
June 18, 2026
in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel
June 17, 2026
in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists