Security news, decoded.

The open source data transfer tool and library curl has shipped a security update addressing 18 vulnerabilities (four medium and 14 low). The most notable issue is CVE-2026-8932, affecting libcurl applications (not the curl command-line tool) and related to mTLS connection reuse that can enable authentication bypass; it traces back to behavior introduced in version 7.7. Other tracked flaws include CVE-2026-8926 (credential confusion), CVE-2026-8925 (double-free), CVE-2026-9080 and CVE-2026-10536 (use-after-free), and CVE-2026-9547 (improper host validation). Because curl is widely used across servers and devices, unpatched flaws in libcurl can be attractive targets for attackers.

Mandiant reports that an unknown actor exploited a Cisco Catalyst SD-WAN zero-day tracked as CVE-2026-20245 (CVSS 7.8) well before public disclosure, achieving elevated execution by feeding a crafted file that bypasses insufficient input validation. The attack targeted Cisco Catalyst SD-WAN controllers and included credential and anti-forensics activity, with unauthorized peering connections also linked to CVE-2026-20127 and CVE-2026-20182 during earlier observed activity. This matters because edge network devices like Cisco Catalyst SD-WAN often lack deep telemetry, making detection and forensic investigation harder after compromise.

Zoho disclosed a critical account takeover weakness, CVE-2026-11374 (CVSS 9.0), in zohocorp manageengineadselfserviceplus when deployed as part of ManageEngine AD360. The flaw allows unauthenticated attackers to predict SSO tickets, letting them obtain user identity/role information and take over targeted accounts. Organizations using affected builds—6528 or earlier, 6320 or earlier, 4816 or earlier, and 8702 or earlier—should upgrade to 6529, 6321, 4817, and 8703 immediately, as exploitation has not been confirmed in the wild.

A critical unauthenticated remote code execution issue in livewire/livewire (composer) has been actively exploited in the wild, tracked as CVE-2025-54068. Systems using versions = 3.0.0-beta.1 and < 3.6.4 are at risk during Livewire property update hydration, which can allow attackers to run arbitrary code and steal secrets from environments, including database credentials and cloud/payment tokens. With CVE-2025-54068 patched in 3.6.4, organizations should upgrade immediately to limit widespread data exposure.

IBM disclosed two critical security issues in IBM Langflow OSS that can be triggered without authentication, including remote code execution in PythonREPLComponent via Builtins Injection (CVE-2026-10561) and an authorization bypass in the MCP transport endpoint (CVE-2026-7664). Both problems allow attackers to reach privileged functionality when instances expose the affected endpoints, making public-facing deployments especially risky. The report notes no confirmed exploitation so far, but it urges upgrading Langflow OSS to version 1.9.4 to remediate.

A pair of critical security issues in Gitea could allow remote attackers to bypass authentication and perform Server-Side Request Forgery (SSRF) attacks, potentially leading to full takeover of administrative accounts. The affected vulnerabilities are tracked as CVE-2026-20896 (critical, impacts Gitea Docker deployments using reverse proxy authentication due to overly trusting proxy headers) and CVE-2026-22874 (high, allows incomplete SSRF filtering in webhook and repository migration paths). Both issues affect Gitea versions 1.26.2 and earlier, so administrators should upgrade to Gitea version 1.26.3 immediately.

A SANS Internet Storm Center assessment based on honeypot observations describes campaigns from TerraBot, r00ts3c, and rondo (aka: RondoDox) that repeatedly scan and attempt exploitation of devices and web services. The activity targets multiple flaws including CVE-2016-20017 (legacy D-Link DSL gateway routers) and CVE-2018-10561 (Dasan GPON routers), plus CVE-2016-20016 on legacy MVPower CCTV DVRs/JAWS Webserver RCE; later phases also include CVE-2025-34037 (Linksys E-series routers), CVE-2021-44228 (Log4Shell WAF Evasion), CVE-2023-48022 (ShadowRay), CVE-2023-26801 (LB-LINK command injection), and CVE-2018-6000 (ASUS AsusWRT NVRAM manipulation). The takeaway is that high-volume automation and quickly evolving payload chains can turn “background noise” into persistent, cross-environment risk—even when individual exploit attempts contain errors.

TP-Link has disclosed CVE-2026-11834, a high-severity command injection flaw that can lead to unauthenticated remote code execution for TP-Link Systems Inc. Archer MR200 v07 devices with affected firmware builds: < 1.3.0 Build 250605, < 1.5.0 Build 260605, < EUV1260330, < EUV5260317, < USV5260419, < V6260608 (+1 more). The issue stems from improper handling of externally provided DHCP options during device initialization, which can let a nearby attacker trigger arbitrary command execution without authentication. TP-Link reports no confirmed public exploitation yet, but the recommended mitigation is to upgrade to fixed releases such as 1.3.0 Build 250605 and 1.5.0 Build 260605 (and the corresponding EU/US builds listed by the vendor).

Mandiant has detailed how attackers exploited Cisco Catalyst SD-WAN command injection vulnerability CVE-2026-20245 to escalate privileges to root during zero-day attacks. The issue affects Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond), enabling authenticated attackers to execute arbitrary commands as root by uploading a crafted file—leading to actions such as creating a rogue root account, altering credentials, and exfiltrating configuration data. This matters because it demonstrates a reliable path from initial access to full device control, with anti-forensic steps that can make detection and incident response harder.

Mandiant reports that threat actors began exploiting a critical Cisco Catalyst SD-WAN flaw as early as March, about two months before Cisco’s early-June disclosure. The issue is tracked as CVE-2026-20245 and can let an attacker with administrator credentials execute commands that result in root-level access via the Cisco Catalyst SD-WAN Controller command-line interface. Because the vulnerability was added to CISA’s known exploited list and abused in attempts that also involved other SD-WAN Controller issues (CVE-2026-20182 and CVE-2026-20127), organizations should prioritize patching and hardening of Internet-facing network management components.

The U.S. CISA has issued an urgent warning that a critical vulnerability in Lantronix EDS5000 Series devices is being actively exploited in the wild. The issue, CVE-2025-67038 (CVSS 9.8), is a code injection weakness that can allow attackers to execute arbitrary commands with elevated/root privileges via the HTTP RPC logging behavior. CISA urged Federal Civilian Executive Branch agencies to apply the available fixes by June 26, 2026, highlighting the risk of full device compromise and potential broader network impact.

CISA says threat actors are taking advantage of high-impact vulnerabilities in Ubiquity UniFi OS and Lantronix serial-to-ethernet servers, putting networks at risk of takeover and data exposure. The Ubiquiti issues listed as Known Exploited Vulnerabilities are CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, which enable unauthorized changes, sensitive file access, and remote command execution, respectively; Bishop Fox also showed they can be chained for full remote code execution. For Lantronix, CVE-2025-67038 is a critical root-level command injection in HTTP RPC affecting EDS5000 firmware 2.1.0.0R3, with mitigation requiring an upgrade to EDS5000 version 2.2.0.0R1.

XM Cyber demonstrated an attack on macOS in which a non-administrative user can silently disable enterprise endpoint security components, including EDR and MDM agents, without kernel exploits or triggering alerts. The technique chained abuse of weakly validated XPC connections with malicious payload injection into Interface Builder (NIB) files, and it was successfully demonstrated against CrowdStrike Falcon Sensor and Kandji MDM; CrowdStrike Falcon Sensor was fully unloaded from a standard account, while Kandji MDM was permanently deactivated. Kandji patched the issue and assigned CVE-2026-39118, underscoring the risk to environments that rely on these agents for detection and device management.

CISA says threat actors are targeting multiple critical vulnerabilities in Ubiquiti UniFi OS devices—tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 (CVSS 10.0)—which were patched by Ubiquiti last month. These issues include an authentication access control bypass (CVE-2026-34908), a path traversal that can enable manipulation of OS files to reach underlying accounts (CVE-2026-34909), and a command injection reachable over the network (CVE-2026-34910). Because UniFi OS is used for centralized infrastructure management, exploitation could enable attackers to gain footholds and move laterally; CISA added the three CVEs to its Known Exploited Vulnerabilities catalog, urging rapid remediation.

Researchers from XM Cyber reported a macOS privilege-escalation technique that lets a non-administrator disable enterprise security tooling by impersonating trusted application components, leveraging how macOS caches and reuses application trust data (CDHash). The reported impact includes CrowdStrike Falcon Endpoint Detection and Response (EDR) and Kandji Mobile Device Management (MDM), both of which can be neutralized without kernel exploits or triggering alerts. Kandji has released an updated Agent to address the issue tracked as CVE-2026-39118, underscoring why organizations should urgently review macOS XPC-based security products for mitigations.

Kaspersky reports a previously undocumented malware family, SharkLoader, linked to a broader activity tracked as StrikeShark, which deploys Cobalt Strike Beacon on compromised systems. Initial access was observed by exploiting internet-facing products such as Microsoft Exchange (CVE-2021-26855) and Openfire (CVE-2023-32315), as well as other targets including CVE-2024-36401; the article also lists additional affected RCE/auth-bypass issues across multiple vendors (e.g., Apache Shiro CVE-2016-4437, Microsoft SharePoint CVE-2021-27076, Fortinet FortiOS CVE-2024-21762, Cisco IOS XE Web UI CVE-2023-20198). This matters because the activity combines public exploit code, webshell-based persistence, and DLL side-loading techniques to move quickly from intrusion to Cobalt Strike deployment across many countries and sectors.

Security researchers report that CVE-2026-20230 in Cisco Unified Communications Manager (Unified CM) is being exploited in the wild shortly after Cisco released patches on June 3. The unauthenticated, remote issue can be leveraged for SSRF, arbitrary file writes to the underlying OS, and privilege escalation to root (with exploitation tied to enabling the WebDialer service, which is disabled by default). This matters because Unified CM is a widely deployed on-premises call control platform, making the flaw attractive for both criminal and state-sponsored actors.

SecurityWeek reports that four security issues in the open source AI platform Dify can be abused in multi-tenant cloud setups to access or exfiltrate data belonging to other customers. The affected vulnerabilities are tracked as CVE-2026-41947, CVE-2026-41948, CVE-2026-41949, and CVE-2026-41950, and they impact components such as Dify tracing, the plugin daemon, and file handling/permissions, enabling actions like reading other tenants’ chats, previewing documents, and invoking cross-tenant APIs. Zafran further notes the preview endpoint relied on a vulnerable Chromium PDFium binary (126.0.6462.0) tied to CVE-2024-5846, and Dify version 1.14.2 is released with patches to address these findings—users should upgrade promptly and consider WAF mitigations for CVE-2026-41948.

A recent report highlights that exploit development is increasingly happening in hours rather than months, putting pressure on traditional remediation timelines and leaving gaps between patching and active attack development. It calls out the risk that even when exploitation details aren’t publicly available or can’t be safely tested, teams still need evidence-based exposure decisions—for example, Windows CLFS issue CVE-2025-29824 (CLFS use-after-free leading to SYSTEM). The takeaway: faster pentests aren’t enough when live firing isn’t possible, so organizations should validate the required attacker TTP chain against their actual controls instead of relying solely on CVSS/EPSS-style scoring.

Researchers uncovered a long-standing high-severity vulnerability in Samsung’s KNOX kernel affecting nearly all Galaxy devices from Galaxy S9 through S25. The issue, tracked as CVE-2026-20971, can be triggered via interactions between PROCA and FIVE and may result in kernel memory corruption through a race-condition use-after-free scenario, even though exploitation is described as requiring local conditions and user interaction. Samsung addressed the problem in its January 2026 update for affected Android releases including Android 13, 14, 15, and 16, and device coverage spans both Exynos- and Qualcomm-based models; timely patching matters because mobile attacks can be leveraged for deeper compromise.

A heap out-of-bounds write in FFmpeg’s libavcodec MagicYUV decoder, tracked as CVE-2026-8461 (CVSS 8.8), can allow attackers to crash applications and potentially execute arbitrary code using specially crafted video files. JFrog describes the PixelSmash flaw as stemming from a mismatch in how the frame allocator and decoder calculate chroma plane heights, and notes that exploitation can be tailored to target FFmpeg’s AVBuffer refcounted buffer handling. Fixed in FFmpeg version 8.1.2, the issue affects a wide range of media players and servers that decode videos with FFmpeg, including Kodi, mpv, ffmpegthumbnailer, Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, and OBS Studio—so updating promptly matters.