Short, tactical, daily. The weekly Issues are the verdict — these are the notes scrawled in between.
-
PHP2Shell (CVE-2026-109618/109619) is under active exploitation across ~70% of websites, GitLab ships a CVSS 10.0 unauthenticated RCE fix, and LiteLLM's pipeline was compromised to push a credential-stealing package.
-
PHP2Shell (CVE-2026-109618/109619) details leaked ahead of patch, a FortiSIEM RCE PoC is public, and Qilin/INC are actively exploiting Palo Alto CVE-2026-0257 to bypass MFA.
-
Four live supply-chain compromises (OVHcloud CLI, Rank Math PRO, AOMEI, Plex2Shell) plus active ClickFix exploitation of a Siemens DLL flaw mean trusted updaters are the attack surface today.
-
Broadcom Wi-Fi root RCE with public PoC, active exploitation of a SiteGuard WAF command injection flaw, and an OpenCode breach that may have leaked customers' AI provider API keys.
-
ConnectWise disabled seven application identities after attackers used them to compromise Microsoft 365 tenants, and Drupal patched two critical RCE flaws.
-
ConnectWise Cloud Backup credential abuse hits 173 M365 tenants, a maxed-out Magento RCE (CVE-2026-103849) awaits exploitation, and an AOMEI Backupper supply-chain poisoning shows your backups can be the payload.
-
Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 since August, and attackers are actively backdooring Nextcloud servers via Collabora RCE CVE-2026-110447.
-
Two actively exploited edge-device zero-days land the same day: PAN-OS management interface RCE (CVE-2026-0322) and a Cisco Secure Email Gateway root-RCE, both with vendor-confirmed in-the-wild abuse.
-
Attackers are chaining Ivanti Connect Secure zero-days for unauthenticated root on fully patched appliances, with one bug still unpatched, while Microsoft ships a record 1,411-flaw Patch Tuesday including an exploited Windows bug.
-
GitLab's CVSS 10.0 unauth RCE, an actively exploited SonicWall SMA 1000 SSRF, and a real-world Danfoss refrigeration controller attack lead today's signal.
-
Two maximum-severity flaws (Bricksforge CVE-2026-85097 and SonicWall CVE-2026-102255) are under active exploitation, both days after disclosure.
-
Active exploitation of unpatched AhsayCBS backup servers plus a credential-stealing GitHub Actions campaign hitting hundreds of repos through hijacked maintainer accounts.
-
Citrix NetScaler (CVE-2026-107406) and AhsayCBS (CVE-2026-105133/105134) are the day's edge-device priorities, with AhsayCBS already under active exploitation.
-
FortiBleed attackers are actively locking admins out of FortiGate VPNs, SonicWall shipped a CVSS 10.0 pre-auth fix for SMA1000, and LMCache has an unpatched RCE with no fix available.
-
Atlassian's CVE-2026-21589 hits Jira/Confluence/Bitbucket while two WordPress plugin XSS flaws are under active exploitation.
-
Rejetto HFS servers are under active scanning for CVE-2026-61500, Atlassian ships a 9.3 pre-auth file read bug across 8 products, and Microsoft patches an out-of-band Exchange privilege escalation.
-
Two actively exploited bugs today: Citrix NetScaler zero-day CVE-2026-88779 and Rejetto HFS session-forgery flaw CVE-2026-61500, both with real-world attacks underway.
-
ShinyHunters suspect 'Rey' detained in Jordan and cooperating with the FBI, while China-aligned TA419 runs AitM phishing against U.S. AI policy experts.
-
Warlock ransomware is actively exploiting SharePoint flaws against critical infrastructure while GitLab and Dell ship fixes for critical RCE and authentication bypass bugs.
-
Fortinet FortiMail zero-day CVE-2026-104286 is under active exploitation and in CISA KEV, while Warlock continues hitting critical infrastructure through SharePoint flaws.
-
Cisco Catalyst SD-WAN Manager zero-day (CVE-2026-76504) is under active exploitation and now in CISA KEV, while Citrix NetScaler post-exploitation activity and a MikroTik RouterOS pre-auth RCE round out a rough day for edge gear.
-
Citrix NetScaler CVE-2026-88772 is under active exploitation with public exploit details, and Apple CVE-2026-86950 is being weaponized in targeted attacks.
-
Apple patched an actively exploited CoreGraphics zero-day (CVE-2026-86950) while thousands of Supabase databases sit wide open and the MCP Python SDK leaks OAuth secrets.
-
Citrix confirms two actively exploited NetScaler RCE zero-days now in CISA's KEV, while ShinyHunters retools its Oracle PeopleSoft exploit.
-
Two unpatched Citrix NetScaler RCE zero-days are under active exploitation, SharePoint CVE-2026-65660 hit CISA's KEV, and ShinyHunters found a WAF bypass for the PeopleSoft flaw.
-
CISA flags actively exploited SharePoint, MikroTik, and WSO2 flaws while Kiteworks tells customers to physically shut down servers over an imminent attack warning.
-
Roundcube CVE-2026-48842 and CISA KEV additions for WSO2 and Adobe Commerce are all under active exploitation, and North Korea drained $351.6M from Bitget.
-
WordPress CVE-2026-87902, Check Point VPN CVE-2026-85102, and MikroTik's MikroTrick chain are all under active exploitation with unauthenticated RCE.
-
F5, Check Point, and Arista are all patching zero-days under active exploitation, and your perimeter security appliances are the target.
-
Zyxel and Veeam flaws are under active exploitation, and a Microsoft-signed driver is being weaponized to disable EDR before deploying the Rapuncel stealer.
-
Colorado water utilities had OT settings tampered with, and CISA flagged three actively exploited Linux kernel flaws.
-
Researchers chained flaws to take over OpenAI staff accounts, while the BragJack PoC hijacks AI browser agents through a single malicious extension.
-
Cisco ISE hits a perfect 10 auth bypass zero-day, Orkes Conductor has a pre-auth RCE under active exploitation, and CISA adds three Linux kernel flaws to KEV with public exploits floating around.
-
Two critical unauthenticated RCE bugs (Check Point management servers and Orkes Conductor, the latter already exploited) plus a Brevo supply-chain compromise pushing ClickFix to 100k sites lead today's stack.
-
Cisco patches an actively exploited max-severity ISE auth-bypass zero-day while a hard-coded credential flaw in Issabel PBX (CVE-2026-89026) is under attack.
-
WSO2 API Manager JWT bypass (CVE-2026-5430) is under active exploitation with forged admin tokens, while attackers plant PHP web shells via a WooCommerce plugin flaw and Google patches an actively exploited Pixel modem zero-day.
-
Cisco's Secure Email Gateway zero-day (CVE-2026-76461) is under active exploitation for unauthenticated root RCE, while a maximum-severity GitLab path traversal (CVE-2026-85706) and China-linked exploitation of Gitea and a Chrome/Windows chain round out today's must-patch list.
-
ConnectWise ScreenConnect, GitLab, and JFrog Artifactory are all under active exploitation right now, and the ScreenConnect flaw is spreading worm-like.
-
CISA flags five actively exploited flaws in Artifactory, ScreenConnect, and RouterOS, while the Dutch NCSC warns of imminent exploitation against two critical Check Point VPN bugs.
-
A CVSS 10 GitLab file-read flaw (CVE-2026-85706) is under active probing within hours of disclosure, JFrog Artifactory flaws are being chained to drop a Rust backdoor, and ShinyHunters is phishing M365 accounts under a passkey theme.
-
Cisco FMC CVE-2026-20079 (CVSS 10.0) and PaperCut NG/MF flaws are under active exploitation, with three threat clusters hitting FMC and a Russian actor using AI agents to compromise 395 organizations.
-
Cisco FMC CVE-2026-20079 and WatchGuard Firebox are under active exploitation, and four spy groups are burning the same Chrome/Windows BlueMoon exploit chain.
-
N-able N-central (CVE-2026-86218) and F5 BIG-IP APM are under active exploitation, while a Chrome V8 zero-day (CVE-2026-87491) rounds out today's high-signal patch-now list.
-
Adobe's max-severity Magento zero-day (CVE-2026-75650, StyleSmuggler) is under active exploitation, MikroTik RouterOS is being taken over via exposed SSH, and N-able N-central patched an exploited zero-day.
-
Three active-exploitation problems today: N-able N-central RCE, MikroTik RouterOS router hijacks, and an unpatched ConnectWise ScreenConnect flaw.
-
An unpatched StyleSmuggler zero-day is backdooring Magento and Adobe Commerce stores, MikroTik routers are being hijacked over exposed SSH, and JetBrains got breached through its own unpatched TeamCity.
-
Citrix NetScaler auth bypass (CVE-2026-19490) is under active exploitation and PaperCut RCE chain is hitting schools; patch both now.
-
Chrome V8 zero-day CVE-2026-85046 is under active exploitation while attackers hammer WordPress Elementor Pro and Super Forms RCE flaws with over 440,000 attempts.
-
CISA flags seven exploited flaws including a 10.0 SonicWall SMA 1000 SSRF zero-day, while JFrog Artifactory and Sangoma Switchvox are under active exploitation.
-
SonicWall SMA1000 zero-days (CVE-2026-83548/83549) are being chained for unauthenticated RCE, while JFrog Artifactory (CVE-2026-82329) and Langflow (CVE-2026-0768) are under active exploitation days after disclosure.
-
PaperCut NG/MF zero-days (CVE-2026-82078, CVE-2026-81578) are now in CISA KEV and driving data theft, while JFrog Artifactory auth bypass CVE-2026-82329 is under active exploitation days after disclosure.
-
Fire Ant is inside Cisco IOS XR routers and TACACS servers, and PaperCut shipped a second emergency patch for two actively exploited CVEs.
-
Microsoft details TerminalFix, a ClickFix variant abusing Windows Terminal, while five critical WordPress flaws (including CVE-2026-76581) open the door to site takeover and RCE.
-
PaperCut ships a second emergency patch after attackers bypass the first, GiveWP hits max severity with unauthenticated RCE, and CISA adds an actively exploited ownCloud flaw to the KEV catalog.
-
PaperCut zero-day under active exploitation, three CVSS 10.0 ServiceNow flaws are patched but self-hosted instances remain exposed, and 8,300+ Gitea servers are being hit with RCE.
-
CISA set a Saturday deadline for CVE-2026-8452 in Citrix NetScaler as it hits KEV under active exploitation, while a zero-click RCE chain lands in the Avada WordPress theme.
-
CISA confirms active exploitation of a critical Gitea RCE (CVE-2026-60004) as attackers drop miner payloads, and a new SLEEPWALKER Windows backdoor waits silently for a single crafted packet before executing.
-
CISA flags a max-severity Oracle WebLogic bug (CVE-2026-21962) under active exploitation, alongside two miniOrange WordPress SAML auth bypasses being hit in the wild and a three-day patch deadline for a Zimbra takeover flaw.
-
CISA orders a three-day patch on an actively exploited Zimbra flaw, while Iran-linked actors took a UK power plant offline for four days.
-
Check Point's BTR.sys technique weaponizes Microsoft Defender's own signed driver to delete security software at boot, while 9,300+ leaked AWS keys remain live and a new phishing kit plants attacker passkeys for post-reset persistence.
-
Max-severity Entra ID RCE (CVE-2026-69836) and GitLab CVE-2026-19478 are both under active exploitation, while a poisoned arrayref Rust crate slips build-time malware into the supply chain.
-
Active exploitation hits Zimbra and GitLab while Citrix NetScaler's auth bypass waits for its turn; patch the edge before it patches you.
-
CISA flags active exploitation of a critical Windows IKE RCE while Clop's Windchill web shell and MLflow SSRF attacks show the mass-exploitation crews are already inside.
-
Actively exploited Ray RCE and Windows Task Host flaw hit CISA KEV, while two critical unauthenticated bugs (Forminator RCE and GitLab GraphQL) land with mass exposure.
-
China-nexus APT is exploiting VMware vCenter CVE-2026-59310 to drop Babuk-derived ransomware, while SAP Commerce Cloud CVE-2026-58231 fell to attackers three days after disclosure.
-
Attackers are exploiting a public macOS Screen Sharing auth-bypass PoC to drop Monero miners, while a service provider flaw led to €30M in Commerzbank fraud.
-
Two active exploitation campaigns dominate today: VMware vCenter CVE-2026-59310 is being used for reverse SSH persistence, while an unpatched GeoServer SQLi zero-day is under attack.
-
Lazarus is burning a Windows zero-day (CVE-2026-68820) against defense firms while SharePoint (CVE-2026-55040) falls to public PoC exploitation.
-
Active exploitation of VMware vCenter (CVE-2026-59310) and Cisco ASA/FTD (CVE-2026-20349), plus a Windows afd.sys zero-day (CVE-2026-68820) in this month's Patch Tuesday.
-
SonicWall SMA1000 flaws are under active ransomware exploitation, Gunra ransomware is chaining Fortinet and Schneider Electric bugs against critical infrastructure, and a maximum-severity Metabase SQL zero-day still has no CVE.
-
A CVSS 10.0 Metabase SQLi zero-day is being exploited to steal customer data, Progress Kemp LoadMaster's CVE-2026-8037 hit CISA KEV after nearly 800 exploit attempts, and N-able N-central attackers are persisting on managed systems.
-
Cisco patches three 9.9-severity SD-WAN/IOS XE bugs, Switzerland confirms a SharePoint breach, and the Microsoft 365 AitM phishing campaign is actively hijacking finance-team inboxes.
-
JetBrains TeamCity CVE-2026-63077 is under active exploitation, CISA added Langflow, N-central, and Apache Tomcat flaws to KEV with a 3-day fix deadline, and a Zbtlink router backdoor ships unauthenticated root shells.
-
CISA confirms active exploitation of Langflow, Tomcat, and N-central flaws while the self-propagating ChainDrop worm rips through npm and CVE-2026-59774 hands unauthenticated file reads on Gitea.
-
N-able N-central auth bypass CVE-2026-18577 is in CISA KEV under active exploitation, INC Ransomware is hammering SonicWall SMA 1000, and Unit 42's Pass-ta-key attacks show malware can lift Google-synced passkeys.
-
N-able N-central authentication bypass (CVE-2026-18577) is under active exploitation after an incomplete fix, and INC Ransomware is hitting SonicWall SMA1000 appliances for root access.
-
A firmware PRNG flaw in Coldcard hardware wallets enabled a $70M Bitcoin sweep across 1,196 addresses in 41 minutes.
-
CISA warns of active PLC attacks on U.S. water utilities, Adform's ad script was poisoned to swap crypto wallet addresses, and Adobe patched a CVSS 10.0 auth flaw in Campaign Classic.
-
Iran-linked actors hit 30-plus Minnesota water systems while unauthenticated RCE flaws land in TeamCity and VMware, both prime targets for the same playbook.
-
Cisco FMC static-credential zero-day (CVE-2026-20316) is in CISA KEV, Russia's Void Blizzard is riding an OWA zero-day for persistent mailbox access, and 30-plus Minnesota water utilities got hit in a coordinated OT attack.
-
Active exploitation of a Check Point SmartConsole auth bypass (CVE-2026-16232) now has a public PoC, while coordinated OT intrusions hit Minnesota water utilities and Gitea/vBulletin ship critical RCE fixes.
-
Two maximum-severity flaws under active exploitation (Arista VeloCloud CVE-2026-16812 and an unpatched Fastjson RCE), plus a critical unauthenticated TeamCity bug with a fix already out.
-
A threat actor is hijacking public Wi-Fi captive portals to phish Microsoft 365 credentials from traveling staff, while healthcare breaches at DentaQuest and MCBS expose over 24 million people.
-
The SourTrade malvertising campaign has browsers assemble malware in memory to dodge URL-based detection, while ClickFix cryptominer lures hit Steam forums.
-
A public PoC for an authenticated RCE in self-managed GitLab lands the same day as an active hotel Wi-Fi DNS campaign harvesting Microsoft 365 credentials.
-
Russia's Laundry Bear exploited a Zimbra zero-click flaw to loot Western mailboxes, Redis shipped seven fixes after public authenticated RCE PoCs dropped, and NodeBB patched eight high-severity bugs with exploit code already live.
-
Check Point's actively exploited SmartConsole auth bypass (CVE-2026-16232) leads, alongside two Linux local root flaws with public PoCs.
-
SharePoint CVE-2026-50522 and the wp2shell WordPress flaws are under active exploitation with machine-key theft and rapid webshell deployment, both post-patch persistence problems.
-
Three flaws are under active exploitation this week: WordPress wp2shell (CVE-2026-63030 + CVE-2026-60137), ServiceNow AI Platform CVE-2026-6875, and the Palo Alto GlobalProtect bypass now driving Qilin ransomware.
-
ServiceNow CVE-2026-6875 and WordPress WP2Shell flaws are under active exploitation, while a critical unauthenticated NGINX RCE (CVE-2026-42533) sits one crafted request away from your edge.
-
Public exploits are live for WordPress Core 'wp2shell' RCE, and 7-Zip patched a malicious-archive RCE in 26.02.
-
WordPress core wp2shell RCE has a public PoC and Inc ransomware is chaining SonicWall SMA zero-days for root, both under active or imminent exploitation.
-
A critical SharePoint RCE (CVE-2026-58644) is under active exploitation with a CISA July 19 deadline, while CISA also flags two exploited Fortinet FortiSandbox flaws.
-
CISA sets a Saturday deadline for the actively exploited Oracle E-Business Suite flaw while Zoom patches a 9.8 account-takeover bug for Windows.
-
Two SonicWall SMA1000 zero-days (CVE-2026-15409/15410) and three actively exploited SharePoint flaws are under attack right now, while Microsoft ships a record 570-plus patch load.
-
CISA flags active exploitation of Joomla iCagenda and Balbooa Forms RCE flaws, while a Jscrambler npm supply chain compromise and ShinyHunters OAuth abuse of Salesforce show trusted code and connections remain the soft entry.
-
CISA adds two max-severity Joomla extension flaws (CVE-2026-48939 and iCagenda) to KEV after zero-day exploitation, while Progress tells ShareFile customers to shut down servers over a credible threat.
-
A compromised jscrambler 8.14.0 npm release runs a Rust infostealer on install across Windows, macOS, and Linux.
-
Progress tells ShareFile admins to power off Storage Zone Controllers over a credible threat, Gitea's Docker auth bypass is under active exploitation, and a compromised Injective Labs npm package is stealing wallet keys.
-
Okta and Bleeping Computer detail active vishing-driven Entra passkey enrollment attacks (O-UNC-066, Helix) hitting Microsoft 365, while attackers actively exploit the 'Ill Bloom' wallet flaw and a poisoned Injective npm package to drain crypto.
-
A China-linked cluster is actively exploiting Roundcube to hijack university mail, Tenda ships an unpatched firmware backdoor (CVE-2026-11405), and Microsoft finally patched the RoguePlanet Defender zero-day (CVE-2026-50656).
-
Active exploitation of max-severity ColdFusion (CVE-2026-48282), Langflow, and Gitea (CVE-2026-20896) flaws, plus GhostLock (CVE-2026-43499), a 15-year-old Linux root escape hitting every mainstream distro.
-
NetScaler is under active exploitation again with a public PoC, while BeyondTrust ships critical pre-auth bypass fixes and a 16-year-old KVM escape (Januscape) drops with a working proof-of-concept.
-
Opera GX patched a zero-click flaw that let malicious sites auto-install mods and exfiltrate page data, while Google and the FBI disrupted the NetNut residential proxy botnet.
-
A local-root Linux kernel flaw (CVE-2026-46242) now has a fix and hits Android, while North Korea's npm typosquats keep bleeding developer secrets.
-
Anubis affiliates are exploiting Citrix Bleed 2 (CVE-2025-5777) for ransomware access while FortiBleed actors monetize thousands of compromised Fortinet firewalls with a Nextcloud zero-day.
-
Three active-exploitation items lead today: SharePoint RCE CVE-2026-45659 hits CISA KEV, Cisco confirms Unified CM exploitation, and an unpatched Argo CD flaw threatens full Kubernetes cluster takeover.
-
Active exploitation of Langflow RCE (CVE-2026-33017) and an ongoing Azure CLI password spray dominate today, alongside a batch of max-severity Adobe ColdFusion patches.
-
Three actively exploited critical flaws hit at once: SimpleHexlp CVE-2026-48558, Oracle EBS CVE-2026-46817, and Windows Defender 'BlueHammer,' all with confirmed in-the-wild abuse.
-
Active exploitation hits SimpleHelp (CVE-2026-48558) and Oracle EBS (CVE-2026-46817), while a public PoC drops for the libssh2 client flaw CVE-2026-55200.