Security news, decoded.

Zimbra has issued a security update to resolve a critical vulnerability in the Classic Web Client that could enable arbitrary code execution through specially crafted emails. The flaw, classified as a stored cross-site scripting (XSS) issue, allows attackers to inject and execute malicious scripts within a user’s session upon opening an affected email. Though no exploitation has been reported so far, past XSS vulnerabilities in Zimbra have drawn significant interest from threat actors. Users are strongly advised to upgrade to Zimbra Collaboration Suite version 10.1.19 to mitigate this risk.

Rapid7 has added new exploit modules to the Metasploit Framework targeting two recently discovered vulnerabilities in FlowiseAI and macOS PackageKit. The FlowiseAI CSV Agent flaw (CVE-2026-41264) allows unauthenticated remote code execution via a malicious CSV file, while the macOS PackageKit vulnerability (CVE-2024-27822) enables local privilege escalation through ZSH environment manipulation. These additions expand the attack surface of AI tools and operating systems, highlighting the importance of timely patching.

Progress Software has instructed ShareFile users to stop using the Windows servers hosting their Storage Zone Controllers following reports of a 'credible external security threat.' The company confirmed it is collaborating with security experts and has temporarily restricted access to impacted accounts as part of its precautionary measures. While no evidence of unauthorized account or data access has been found, details about the nature of the threat remain undisclosed. This directive affects only the Storage Zone Controller component, not standard cloud-based ShareFile accounts. Users are advised to keep the controllers offline until further guidance is issued.

Security researchers from Binarly have uncovered six critical vulnerabilities in U-Boot, a widely used bootloader for devices ranging from home routers to server management chips. Two of the flaws could allow an attacker to execute arbitrary code before the device verifies the authenticity of the software, potentially compromising the entire system. The remaining four issues can cause crashes that disrupt device operation. These bugs stem from improper validation of untrusted images during the boot process and affect versions dating back to U-Boot v2013.07. While no CVE identifiers have been assigned yet, Binarly has published proof-of-concept exploits for each flaw. Vendors are urged to apply upstream fixes immediately, as official patches are not included in the latest stable release.

Attackers are actively exploiting a critical authentication bypass flaw in the official Docker image for Gitea, a self-hosted Git service. The vulnerability, tracked as CVE-2026-20896, allows unauthenticated users to impersonate any account—including admin—by manipulating the X-WEBAUTH-USER header. This affects deployments using the default configuration that trusts this header from any IP address. Security researchers confirmed real-world exploitation began just days after the advisory was issued. Gitea has released patched versions 1.26.3 and 1.26.4, urging all users to update immediately.

A critical vulnerability dubbed XRING in Alibaba's XQUIC library enables remote clients to crash HTTP/3 servers using standard traffic. Discovered by FoxIO researcher Sébastien Féry, the flaw affects all versions up to v1.9.4 and impacts products like Tengine. The issue stems from a miscalculation in handling QPACK header compression, leading to memory corruption and server termination. Despite being disclosed on July 8, no patch or CVE has been issued as of July 10. Operators are advised to disable QPACK or HTTP/3 until a fix is available.

Zimbra has issued an urgent update for a critical cross-site scripting (XSS) vulnerability impacting the Classic Web Client of its widely used Zimbra Collaboration Suite. The flaw, which allows attackers to inject malicious scripts via specially crafted emails, remains unassigned a CVE ID but is now patched in version 10.1.19. While there is no evidence of active exploitation at this time, the vulnerability was reported by Google’s Threat Analysis Group, known for uncovering sophisticated cyber threats. Zimbra strongly advises all users of the Classic Web Client to upgrade immediately to prevent potential theft of session data and mailbox information.

A cybercriminal group accidentally left a server exposed online for three weeks, revealing internal operations including tools, logs, and a list of over 1.4 million targeted websites. Researchers identified the campaign as WP-SHELLSTORM, where attackers exploit outdated plugins to plant webshells on vulnerable WordPress and Joomla sites. The most impactful flaws were in the Breeze caching plugin (CVE-2026-3844) and the Joomla JCE editor (CVE-2026-48907). These vulnerabilities allowed attackers to gain unauthorized access and control over compromised systems. Website owners using these platforms should prioritize patching affected components immediately.

A new study analyzed 281 popular free Android VPN apps from the Google Play Store and uncovered significant privacy and security issues. Many failed to protect user data properly, with over 2.4 billion total installations across the problematic apps. Researchers identified leaks of encrypted traffic, unsecured data transmission, and tracking behaviors. Five apps were particularly vulnerable to 'tunnel hijacking,' allowing attackers to redirect connections to malicious servers. The findings highlight poor implementation practices and raise concerns about the reliability of free VPN services. The research team developed MVPNalyzer, a tool designed to systematically audit Android-based virtual private networks.

A critical vulnerability dubbed Ill Bloom has been actively exploited by attackers to steal over $3.1 million from cryptocurrency wallets. The flaw lies in how certain wallet applications generated recovery phrases—key components for accessing funds—with insufficient randomness, allowing malicious actors to predict and access them. Security firm Coinspect reported a coordinated theft on May 27, draining 431 wallets, with additional losses totaling more than $5 million since then. Older or less-known mobile wallets are particularly at risk. Coinspect advises users to use the free tool at illbloom.org to check if their wallet is affected and to move funds immediately if compromised. This issue mirrors past flaws such as CVE-2023-39910 and CVE-2023-31290, where predictable random number generators led to similar attacks.

July 2026's Patch Tuesday is shaping up to be another busy round of security updates across major vendors like Microsoft, Adobe, Apple, Google, Mozilla, and Oracle. With over 200 CVEs addressed in June alone—many affecting Windows 10 and 11, along with critical applications like Office and SharePoint—the pace shows no sign of slowing down. A notable fix includes CVE-2026-50656, a privilege escalation flaw in Microsoft Defender, which was publicly disclosed with proof-of-concept code. Adobe has also doubled its monthly patch schedule due to the rising volume of vulnerabilities, while Google rolled out Chrome 150 with 433 security fixes. As AI accelerates vulnerability discovery, experts warn that traditional CVE tracking methods may become impractical, pushing organizations toward faster, more reactive patching strategies.

Palo Alto Networks' Unit 42 reports that The Gentlemen, a Ransomware-as-a-Service (RaaS) group, has surpassed 580 claimed victims globally since its emergence in late 2025. Operating under the alias Storm-2697, the group uses custom tools and exploits several known vulnerabilities, including CVE-2024-55591 and CVE-2025-32433, to infiltrate networks. With a generous 90% affiliate payout model and partnerships with BreachForums, The Gentlemen has rapidly grown into one of the most active ransomware groups in 2026. Security experts recommend urgent patching and monitoring for signs of compromise.

Microsoft has issued a patch for a critical zero-day vulnerability in its Windows Defender security engine, identified as CVE-2026-50656. The flaw was publicly disclosed in June by an anonymous researcher using the alias NightmareEclipse, who also shared proof-of-concept code for exploitation. This vulnerability enables remote attackers to gain administrative access on Windows 10 and 11 systems, even if real-time protection is turned off. According to the researcher, the latest update introduces changes that could allow malicious actors to fill up hard drives by generating large volumes of data. Microsoft claims the fix will be automatically applied through an update to the Malware Protection Engine.

Microsoft has released an urgent out-of-band patch for a high-severity zero-day vulnerability in Windows Defender, identified as CVE-2026-50656 and named RoguePlanet. The flaw allows attackers to escalate privileges from a regular user to SYSTEM-level access, granting full control over the device. The vulnerability was disclosed by an anonymous researcher known as Nightmare-Eclipse, who has been involved in a public dispute with Microsoft over several months. Despite the availability of a proof-of-concept exploit, there is currently no evidence that the flaw has been exploited in the wild. However, experts warn that the vulnerability poses significant risks, especially if used in conjunction with other initial access methods.

Cisco Talos has identified several critical security flaws across three major vendors: WolfSSL, GeoVision, and VTK-DICOM. These include improper input validation, buffer overflows, command injection, and other high-risk issues affecting a wide range of products. All reported vulnerabilities have been addressed by the respective vendors following responsible disclosure practices. Users are advised to update their software to mitigate potential risks.

A critical security flaw in Esri ArcGIS Server 12.0 and earlier versions has been patched following reports of potential unauthenticated file access. The vulnerability, tracked as CVE-2026-9181 with a CVSS score of 9.8/7.5, allowed attackers to access sensitive files by sending specially crafted path parameters. This flaw resided in the REST Uploads resource due to insufficient validation of inputs, enabling directory traversal attacks. Horizon3.ai highlighted the risk, noting that no authentication was required to exploit it. Users are strongly advised to update to the latest version to mitigate exposure.

Microsoft has issued patches for a vulnerability in Microsoft Defender, known as RoguePlanet, identified as CVE-2026-50656. The flaw allows attackers to escalate privileges due to a race condition. A proof-of-concept exploit was published by researcher Nightmare Eclipse on June 9, though it had limited reliability at the time. Microsoft addressed the issue through an automatic update to the Microsoft Malware Protection Engine, requiring no manual action from users. While there are currently no reports of exploitation, previous vulnerabilities from the same researcher have been used in attacks.

Microsoft has issued a security update for a critical privilege escalation flaw in the Microsoft Malware Protection Engine, known as RoguePlanet (CVE-2026-50656). The vulnerability allows attackers to gain SYSTEM-level privileges through a race condition in 'mpengine.dll'. It affects the core component responsible for malware scanning and detection. The fix is included in version 1.1.26060.3008 of the engine. While no active exploitation has been reported, the flaw could enable arbitrary code execution or unauthorized system access.

Microsoft has issued a security update to resolve the zero-day vulnerability known as 'RoguePlanet' (CVE-2026-50656), affecting Microsoft Defender on fully patched versions of Windows 10 and Windows 11. The flaw allows attackers to gain SYSTEM-level privileges through a race condition in the security software, regardless of real-time protection settings. A proof-of-concept exploit was publicly shared by researcher Nightmare Eclipse, who has previously reported several other high-profile vulnerabilities. The issue was resolved with the release of Microsoft Malware Protection Engine version 1.1.26060.3008.

Researchers have demonstrated a novel method to bypass the safety mechanisms of AI coding assistants, using a technique dubbed 'Friendly Fire.' The attack targets Anthropic's Claude Code and OpenAI's Codex when operating in autonomous modes—specifically versions 2.1.116–2.1.199 of Claude Code and 0.142.4 of Codex. By embedding a malicious script within a seemingly benign README.md file in an open-source project, attackers can trick the AI agent into executing arbitrary code on the host machine. The vulnerability lies in how these tools interpret and act upon instructions found in documentation files, rather than in their core codebase. While no active exploitation has been reported, the flaw highlights a critical design issue that cannot be resolved through model updates alone. Developers are advised to avoid running untrusted code through command-capable agents unless strict manual oversight is applied.

A security researcher uncovered an undocumented backdoor in several versions of Tenda firmware that allows attackers to gain administrative access to the device's web management interface. The flaw, tracked as CVE-2026-11405, resides in the login function of the web server binary and enables authentication bypass. Additionally, CERT/CC reported another vulnerability in HP Deskjet 2800 series printers (CVE-2026-13753), where unauthenticated access to API endpoints exposes sensitive information like Wi-Fi credentials and printer serial numbers. Both issues remain unpatched, and users are advised to disable remote web management and update their configurations to mitigate risks.

Researchers at Wiz discovered a vulnerability dubbed GhostApproval affecting six popular AI-powered coding assistants. By exploiting symbolic links (symlinks), attackers can trick developers into approving edits to seemingly harmless files—while the changes actually target critical system files such as SSH keys or shell configurations. The affected tools include Amazon Q Developer, Anthropic’s Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Three of the vendors have already issued patches, while two remain unpatched and one vendor, Anthropic, disputes the classification as a bug. The flaw allows malicious repositories to execute unauthorized actions by misleading the approval prompts shown to users. Wiz recommends updating to fixed versions and exercising caution when interacting with unfamiliar projects.

A critical vulnerability in the KVM virtualization component of Linux, identified as CVE-2026-53359, enables untrusted guest virtual machines to achieve root-level access on the host system. This flaw, dubbed Januscape, resides within the shadow MMU emulation and could allow attackers to disrupt or take control of cloud environments. Discovered after remaining undetected for 16 years, it impacts both AMD and Intel-based systems using KVM. Researchers have demonstrated a proof-of-concept exploit that crashes the host OS from within a guest VM.

A China-linked threat group has been exploiting vulnerabilities in Roundcube webmail servers at U.S. and Canadian universities to steal login details and install backdoor malware. The attackers, tracked as UNKMassTraction, have focused on institutions conducting research in physics, engineering, and national security. They use a cross-site scripting flaw (CVE-2024-42009) to deliver a credential-stealing payload named IceCube, followed by additional exploits like CVE-2025-49113 to gain deeper access. Security experts recommend applying the latest patches from Roundcube to mitigate these risks.

A large-scale credential exposure campaign dubbed 'FortiBleed' is exploiting reused or previously stolen credentials to attack internet-reachable FortiGate and SSL-VPN gateways. The threat involves brute-force and password-spraying techniques, not a new zero-day vulnerability. Organizations using Fortinet products with exposed interfaces, weak authentication, or legacy hashes are at highest risk. Affected CVEs include CVE-2026-24858, CVE-2025-59718, and others. Immediate steps such as enforcing multi-factor authentication (MFA), rotating credentials, and completing PBKDF2 migration are strongly recommended.

A China-linked APT group, tracked as UAT-7810, has expanded its toolkit with new backdoor variants targeting SOHO routers from Ruckus and Asus. Researchers at Cisco Talos have uncovered updated malware families—LongLeash, DogLeash, and JarLeash—that exploit known vulnerabilities such as CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717. These tools enable attackers to maintain persistent access, manage tunnels, and execute remote commands. The threat actor is also linked to a broader espionage campaign involving thousands of compromised devices.

Ubiquiti has issued security updates to resolve several high-severity vulnerabilities affecting its UniFi product line, including UniFi Connect, Talk, Access, Protect, and OS. These flaws could allow attackers to perform command injections, escalate privileges, or manipulate devices through improper access controls. The affected CVEs include CVE-2026-50746, CVE-2026-50747, CVE-2026-50748, CVE-2026-54400, CVE-2026-55115, CVE-2026-54402, and CVE-2026-55116. While no active exploitation has been reported, the fixes are crucial due to the potential for remote code execution and unauthorized device manipulation.

Attackers are exploiting a recently cataloged vulnerability in Langflow (CVE-2026-55255), an open-source AI workflow framework, to harvest credentials and sensitive data. CISA added this insecure direct object reference (IDOR) flaw to its Known Exploited Vulnerabilities list on July 7, following active exploitation observed by the Sysdig Threat Research Team. The flaw enables authenticated attackers to execute another user’s flow using just the flow ID, potentially leading to cross-tenant data exposure and secret theft. Federal agencies have until July 10 to apply the fix, as mitigation is critical due to ongoing attacks.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about actively exploited vulnerabilities in Adobe ColdFusion, Langflow, and two popular Joomla extensions. These flaws—CVE-2026-48282, CVE-2026-55255, CVE-2026-48908, and CVE-2026-56290—are being used by threat actors to gain unauthorized access and execute malicious code on affected systems. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog and mandated that federal agencies apply patches within three days. Organizations using any of the impacted software should prioritize remediation immediately.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies apply a critical security update by Friday to address an actively exploited vulnerability in Langflow, a widely used AI development framework. The flaw, identified as CVE-2026-55255, is an insecure direct object reference (IDOR) issue that permits authenticated attackers to access other users’ workflows and sensitive data through a malicious request. This vulnerability has already been observed being used in attacks aimed at achieving code execution and deploying implants. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the urgency of remediation under Binding Operational Directive 26-04.

Cisco Talos reports that the China-linked threat actor UAT-7810 is extending its Operational Relay Box (ORB) network by improving its custom malware, including an updated version of ShortLeash dubbed LONGLEASH along with new tools DOGLEASH and LEASHTEST. The campaign targets internet-facing networking gear, leveraging known issues in Ruckus wireless routers tied to CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, and also points at ASUS AiCloud Routers affected by CVE-2025-2492. This matters because ORB expansion can help secondary attackers gain infrastructure for further intrusion and exploitation against high-value targets.

Ubiquiti has released security updates to address seven critical vulnerabilities across UniFi OS, including a maximum-severity command injection issue tracked as CVE-2026-50746. The flaw affects UniFi Connect Application (versions 3.4.16 and earlier) and could allow an attacker with network access to inject commands and compromise the host device. In addition, Ubiquiti patched six other critical-severity issues (CVE-2026-50747, CVE-2026-50748, CVE-2026-54400, CVE-2026-54402, CVE-2026-55115, CVE-2026-55116) affecting UniFi Talk, UniFi Access, UniFi Protect, the UniFi OS Server, and a range of Ubiquiti routers, gateways, NAS, and surveillance systems. With many UniFi OS instances exposed online, timely upgrades matter to reduce the risk of automated compromise.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has directed federal civilian agencies to remediate an actively exploited, maximum-severity vulnerability in Adobe ColdFusion by Friday, June 10. The issue, tracked as CVE-2026-48282, impacts ColdFusion versions 2025.9 and 2023.20 (and earlier) and can allow remote attackers to execute code on unpatched systems without special privileges. Adobe has already released security updates and warned administrators to deploy them immediately, underscoring the fast-moving exploitation risk that prompted CISA to add CVE-2026-48282 to its Known Exploited Vulnerabilities catalog.

Researchers at Nebula Security disclosed GhostLock (CVE-2026-43499), a long-standing Linux kernel flaw (present since 2011) that allows a logged-in user on unpatched systems to gain full root privileges and break out of containers. The issue is triggered via ordinary local threading behavior with no special permissions or network access, making it a serious risk for multi-tenant hosts, cloud instances, CI runners, and shared environments. Nebula published working exploit code, underscoring the urgency of applying the latest kernel updates from affected distributions.

The U.S. CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active in-the-wild abuse affecting Adobe ColdFusion, Joomlack Page Builder, JoomShaper SP Page Builder, and Langflow. The affected CVEs are CVE-2026-48282 and CVE-2026-56290 (both with CVSS 10.0), CVE-2026-55255, and CVE-2026-48908 (CVSS 10.0), spanning issues like path traversal and improper access control that can enable remote code execution and other takeovers. This matters because KEV-listed bugs are prioritized for remediation, with FCEB agencies advised to patch by July 10, 2026.

Researchers at Cisco Talos say a China-aligned actor tracked as 'UAT-7810' is expanding its Operational Relay Box (ORB) infrastructure by compromising internet-exposed networking devices, with a focus on unpatched Ruckus routers. The campaign includes new malware components such as LONGLEASH (an upgraded SHORTLEASH backdoor) and others, and the initial access targets multiple vulnerabilities including CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492 (as well as similar issues in ASUS AiCloud devices). This matters because ORB networks can proxy malicious traffic through seemingly legitimate local infrastructure, making detection and attribution significantly harder.