Security news, decoded.

The Head Mare hacktivist group has exploited unpatched vulnerabilities in TrueConf video conferencing servers to replace client installers with malicious versions containing backdoors. These exploits allow attackers to execute arbitrary code and deploy PhantomCore and PhantomGraph backdoors. Kaspersky researchers discovered the attacks in July, revealing that the threat actors used default open ports and internal flaws to gain privileged access and maintain persistence on compromised systems. TrueConf users who connect to affected servers could unknowingly download infected installers. The company issued patches for vulnerable versions on June 18.

A high-severity vulnerability affecting Metabase’s data visualization and business intelligence software has been actively exploited in attacks targeting unpatched systems. The flaw, rated with a CVSS score of 10.0, enables attackers to inject arbitrary SQL queries into the application database, granting them full administrative control without needing to authenticate. Attackers can then modify configurations, extract credentials, access sensitive data, or export files from connected databases. Metabase Cloud is already updated, but users running self-hosted instances should apply the latest patches right away. Affected versions include multiple ranges from x.58.0 up to certain points before fixes were introduced. As a temporary measure, blocking the "/api/session/resetpassword" endpoint is recommended until updates are applied.

N-able has issued another round of hotfixes for its N-central product following the detection of active exploitation attempts targeting a newly disclosed vulnerability, CVE-2026-18577. This zero-day flaw allows attackers to bypass authentication and gain remote administrative access, which has been used in real-world attacks since July 31, 2026. Affected versions are all prior to 2026.3.1.7, and users are urged to apply Hotfix 2 immediately—even if they previously installed Hotfix 1—as it includes critical additional protections. The company also recommends reviewing internal systems for signs of compromise using the provided IoCs and service templates.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity command injection vulnerability in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, CVE-2026-8037 (CVSS score: 9.6), allows unauthenticated attackers to execute arbitrary code remotely. It follows reports of over 792 exploitation attempts from 65 IP addresses across 18 countries between July 16 and August 4, 2026. CISA urges immediate patching by FCEB agencies to comply with BOD 26-04.

A critical unauthenticated remote code execution (RCE) vulnerability has been identified in JetBrains TeamCity, tracked as CVE-2026-63077. The flaw stems from improper XStream configuration that allows unsafe deserialization of attacker-controlled XML payloads through the agent polling protocol. Attackers can exploit this without authentication to execute arbitrary commands on affected servers. CISA confirmed exploitation in the wild after adding the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026. JetBrains patched the issue in version 2026.1.3 by resetting XStream permissions before applying TeamCity's allowlist. A proof-of-concept script demonstrates how attackers could deploy a malicious JSP file to achieve persistent server-side command execution. Organizations running vulnerable versions should update to 2026.1.3 or later immediately. Indicators of compromise include unusual error logs referencing HSQLMetadataStorage$SchemaMismatchException and unexpected .jspws files in the webroot directory.

WordPress has addressed a severe pre-authentication cross-site scripting (XSS) vulnerability affecting all versions of the platform, which could lead to remote code execution under specific conditions. Tracked as CVE-2026-64638 with a CVSS score of 8.9, this flaw allows an unauthenticated attacker to inject malicious JavaScript into the login screen, triggering execution in any user’s browser upon visiting a crafted link. If an administrator then interacts with a malicious page, the XSS can escalate to PHP code execution on the server, enabling attackers to upload plugins or modify sensitive data. The issue was resolved in WordPress 7.0.3, with patches applied retroactively to the 4.7 branch. Sites running older versions are still at risk and should upgrade immediately.

Hackers compromised approximately 200 accounts in Switzerland’s Federal Office of Information Technology, Systems and Telecommunication (BIT) by exploiting vulnerabilities in its Microsoft SharePoint servers. The breach was discovered following unusual activity observed on July 28, prompting BIT to isolate the affected systems and patch the flaws. By July 31, investigators confirmed that both user and technical account credentials had been stolen. While the exact vulnerabilities used have not been specified, the agency suspects one of two recently patched SharePoint flaws—CVE-2026-56164 or CVE-2026-50522—were exploited. BIT is working with Microsoft and the Federal Office for Cybersecurity (BACS) to assess the incident. Fortunately, no sensitive data appears to have been leaked.

An 18-year-old use-after-free vulnerability in the Linux SCTP networking stack allows local attackers to gain full root access on a host and potentially escape containers. Tracked as CVE-2026-64564 and named SCTPhantom, the flaw was recently addressed in stable kernel versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148. The bug, present since 2008, stems from improper handling of dynamic address reconfiguration in SCTP connections, allowing malicious actors to manipulate pointers leading to arbitrary code execution. While no public exploits have emerged yet, Tencent researchers demonstrated successful container escapes under specific configurations. System administrators using older kernels with active SCTP support should upgrade immediately.

A new AI-assisted research system called HTTP Terminator, developed by James Kettle at PortSwigger, has uncovered innovative HTTP desynchronization techniques following an analysis of 30,000 possible vectors. During this process, a related manual investigation also revealed a previously unknown zero-day flaw in Apache Traffic Server, tracked as CVE-2026-63078. The vulnerability, which affects how the server processes requests, has now been patched but lacks clear documentation linking it to a specific version in official records. The research highlights the potential of AI in identifying complex web security issues, including new desync methods like 'dangling-byte' that improve the reliability of response queue poisoning attacks.

Security researcher Malcolm Stagg has uncovered a novel threat known as NatJack, which abuses weaknesses in Network Address Translation (NAT) mechanisms to hijack active TCP sessions, spoof DNS responses, and exhaust NAT resources. The technique was presented at Black Hat USA 2026 and affects both Windows NAT via Hyper-V and Linux Netfilter conntrack. Two specific vulnerabilities—CVE-2026-56181 (Windows, CVSS 8.3) and CVE-2026-63913 (Linux, CVSS 8.2)—have been identified, though the broader attack concept relies on design assumptions rather than a single flaw. Mitigations include isolating untrusted systems from shared NAT environments and applying available OS updates.

At the 2026 Black Hat USA conference in Las Vegas, multiple vendors showcased groundbreaking cybersecurity advancements. 1Password introduced Privileged Access, a new privileged access management (PAM) solution that eliminates standing credentials by creating temporary accounts only when needed. The company also highlighted research showing many AI-generated patches fail to fix vulnerabilities effectively. Meanwhile, Cogent Security launched VR-1, an AI model trained specifically for cybersecurity tasks, emphasizing contextual awareness and environment-based reasoning. Other notable releases included RapidFort’s continuous threat elimination platform and Zenity’s discovery of a large-scale malicious skills campaign. These developments reflect growing focus on AI security, runtime protection, and proactive threat mitigation.

Microsoft and Apple have issued new security updates addressing several critical and high-severity vulnerabilities across their platforms. Microsoft resolved more than a dozen issues affecting services such as Active Directory, Azure, Entra, SharePoint, and Teams, including three with a maximum severity score of 10/10 (CVE-2026-63508, CVE-2026-56162, CVE-2026-65667) that could enable privilege escalation or remote code execution. Apple addressed a flaw (CVE-2026-65400) allowing unauthorized access to Screen Sharing through a missing authentication check, impacting recent macOS versions. These patches follow recent rounds of updates from both companies, underscoring the need for organizations to stay current with security releases.

Researchers discovered severe vulnerabilities in AI-powered coding agents from Google, Anthropic, and OpenAI, allowing attackers to extract sensitive secrets from continuous integration (CI) workflows using a simple GitHub issue. The flaws were demonstrated during an attack that exploited default configurations of each vendor's tools, leading to the disclosure of two CVEs. CVE-2026-12537, affecting Gemini CLI, enables remote code execution on CI runners with a CVSS score of 10.0 and is fixed in version 0.39.1. CVE-2026-54316 in Claude Code leaks API keys through a public download counter, rated as Moderate by Anthropic but high at 9.1 by NVD, and resolved in 2.1.163. Neither Codex nor its associated findings received a specific patch or CVE, though OpenAI updated its documentation and workflows. Users are advised to apply updates and review their CI processes for potential exposure.

Microsoft's July 2026 Patch Tuesday marked a record with more than 600 CVEs across nearly all its products, including Windows, SharePoint, and Office. Despite the massive volume, only three of these vulnerabilities were reported as either exploited or publicly disclosed. The rise in vulnerability discovery driven by AI is reshaping how organizations approach patch management. Experts emphasize the importance of prioritizing critical risks—such as internet-facing or known-exploited flaws—rather than applying every patch indiscriminately. A notable issue highlighted was the actively exploited SharePoint remote code execution vulnerability (CVE-2026-50522), which attackers use to maintain access post-patching. As August Patch Tuesday approaches, expect another large batch of fixes, especially as AI continues to accelerate threat detection.

On August 6, 2026, WordPress released version 7.0.3 to address 12 security issues ranging from reflected and stored cross-site scripting (XSS) to privilege escalation, server-side request forgery (SSRF), and more. Among the notable fixes is a high-risk unauthenticated XSS flaw that could lead to remote code execution if triggered by an administrator clicking a malicious link. Other vulnerabilities include several stored XSS risks requiring contributor-level access, as well as a privilege escalation issue affecting Multisite setups. Patchstack has implemented real-time protections for these critical flaws, but administrators are strongly advised to upgrade to 7.0.3 immediately to ensure full mitigation.

A newly disclosed vulnerability in the Linux Kernel Virtual Machine (KVM) could enable an attacker with elevated privileges within a Level 1 (L1) guest VM to break out of the virtual environment and execute arbitrary code on the underlying host system. The flaw, identified as CVE-2026-64561, stems from a stale-root check ordering issue in KVM's shadow memory management unit (MMU), potentially leading to a use-after-free condition. Security researcher Hyunwoo Kim revealed a proof-of-concept demonstrating how this flaw can be leveraged to create a file on the host system. The vulnerability specifically impacts systems where nested virtualization is enabled and exposed to untrusted guests. A patch has been merged into the upstream Linux kernel and is recommended for all administrators using such configurations. Affected versions include multiple stable releases up to 7.2-rc5.

Cisco has issued security updates to fix 12 high-risk vulnerabilities affecting its Catalyst SD-WAN and IOS XE Software. These include three flaws rated 9.8 on the CVSS scale. The issues stem from internal testing and AI-assisted discovery and are not yet known to be exploited. Affected users are advised to upgrade their software to the latest patched versions to prevent potential attacks.

A novel attack dubbed INTERRUPT INJECTION has been revealed to bypass existing Spectre v2 defenses in Intel and AMD CPUs. This technique allows an unprivileged Linux program to manipulate hardware interrupts during the time window between branch predictor sanitization and its reuse, enabling potential data leaks such as reading sensitive files like /etc/shadow. The method was successfully demonstrated on AMD Zen 2 processors running Linux 6.14 with all default Spectre v2 mitigations enabled. Researchers from MIT CSAIL disclosed the vulnerability to AMD and Intel in February 2026, prompting AMD to release a kernel-level fix. While a patch exists within the Linux kernel, it lacks a CVE identifier or specific version reference, requiring administrators to verify individual systems for the fix. Intel claims mitigation is unnecessary at this stage.

This week's ThreatsDay highlights include a new remote code execution vulnerability in the Odysseus AI workspace and a set of critical flaws in Samsung devices that could lead to full system compromise with a single click. The vulnerabilities (CVE-2025-21079 and CVE-2025-58486) stem from design oversights in Samsung’s Bixby virtual assistant, enabling attackers to exploit auto-granted Android permissions for privilege escalation. Meanwhile, SideWinder has adopted a new multi-stage attack chain using ClickOnce application files delivered via phishing PDFs, and an npm supply chain campaign dubbed "Flooding Dropper" has distributed over 800 malicious packages. These developments underscore the growing complexity and accessibility of cyberattacks, particularly those leveraging trusted tools and automation.

Critical vulnerabilities have been identified in baseboard management controllers (BMCs) from top server manufacturers like HPE, Supermicro, Avocent, Huawei, Lenovo, and Dell. These flaws could allow remote attackers to backdoor thousands of servers by exploiting long-standing issues in BMC firmware. Researchers found that many of these problems, including some dating back over a decade, remain unaddressed despite prior warnings. The vulnerabilities span authentication bypasses, predictable session tokens, and weak encryption enforcement, among others. Some require initial access but can be chained together to achieve full control. With over 86,000 Internet-connected BMCs exposed and more than half containing critical flaws, the situation highlights a widespread and under-protected attack surface.

Two security researchers uncovered a series of vulnerabilities in Samsung software, including the virtual assistant Bixby, that could be exploited to remotely take control of Samsung Galaxy smartphones. At the Pwn2Own Ireland competition in October 2025, Dimitrios Valsamaras and Ken Gannon demonstrated how these flaws were chained together to compromise a Galaxy S25 device, earning them $50,000. Their full findings were later presented at the Black Hat conference. The exploit begins with a phishing-style attack through a malicious link sent via ads or messaging apps, leading to remote code execution and system-level access. Affected products include the Galaxy S25, S24, and Flip 7. Samsung issued patches in November and December 2025 to address the issues.