News Archives • Page 6 of 604 • Daily CyberSecurity

GitLab Patch Release Fixes Eight Flaws, Including a High-Severity XSS Bug (CVE-2026-6896) GitLab patch release fixing cross-site scripting vulnerability CVE-2026-6896 in version 19.1.2

GitLab patch release fixing cross-site scripting vulnerability CVE-2026-6896 in version 19.1.2

GitLab Patch Release Fixes Eight Flaws, Including a High-Severity XSS Bug (CVE-2026-6896)

Do Son July 9, 2026

TL;DR This GitLab patch release, shipped on July 8, 2026, covers versions 19.1.2, 19.0.4, and 18.11.7. The...

CVE-2026-0288: PAN-OS Buffer Overflow Can Execute Arbitrary Code PAN-OS buffer overflow CVE-2026-0288 enabling arbitrary code execution on Palo Alto firewall

PAN-OS buffer overflow CVE-2026-0288 enabling arbitrary code execution on Palo Alto firewall

CVE-2026-0288: PAN-OS Buffer Overflow Can Execute Arbitrary Code

Do Son July 9, 2026

TL;DR Palo Alto Networks disclosed a PAN-OS buffer overflow tracked as CVE-2026-0288. It sits in the User-ID...

Chrome Security Update Patches 27 Flaws, Including Two Critical Use-After-Free Bugs Chrome security update patching critical use-after-free vulnerabilities in version 150.0.7871.114

Chrome security update patching critical use-after-free vulnerabilities in version 150.0.7871.114

Chrome Security Update Patches 27 Flaws, Including Two Critical Use-After-Free Bugs

Do Son July 9, 2026

TL;DR Google shipped a Chrome security update that fixes 27 flaws across the desktop browser. Two are...

Foxit PDF Reader Flaws Enable Arbitrary Code Execution Foxit PDF Reader arbitrary code execution vulnerability patched in version 2026.1.2

Foxit PDF Reader Flaws Enable Arbitrary Code Execution

Do Son July 8, 2026

TL;DR Foxit shipped Foxit PDF Reader 2026.1.2 and PDF Editor 2026.1.2 for Windows. The release fixes 28...

OpenSSH 10.4 Ships Eight Security Fixes for SSH Clients and Servers OpenSSH 10.4 security fixes including a client use-after-free and SFTP SCP path flaws

OpenSSH 10.4 security fixes including a client use-after-free and SFTP SCP path flaws

OpenSSH 10.4 Ships Eight Security Fixes for SSH Clients and Servers

Do Son July 8, 2026

TL;DR OpenSSH 10.4 landed on July 6 with eight security fixes. The most serious is a client-side...

Ghost Cache Poisoning Flaw Lets Attackers Hijack Staff Accounts Ghost cache poisoning XSS via x-ghost-preview header advisory graphic

Ghost Cache Poisoning Flaw Lets Attackers Hijack Staff Accounts

Do Son July 8, 2026

Ghost released version 6.37.0 to fix a critical cache poisoning bug. The Ghost cache poisoning flaw, tracked...

Network UPS Tools RCE Flaw Affects upsmon, With No Patch Yet Network UPS Tools RCE advisory showing upsmon command injection via ups.alarm

Network UPS Tools RCE Flaw Affects upsmon, With No Patch Yet

Do Son July 8, 2026

A remote code execution flaw affects Network UPS Tools, the widely used NUT monitoring suite. The bug,...

pretix Patches Two Critical Session Takeover and SSRF Flaws pretix vulnerabilities advisory showing the session takeover and SSRF fix

pretix Patches Two Critical Session Takeover and SSRF Flaws

Do Son July 8, 2026

The pretix team shipped version 2026.5.3 to fix two critical flaws. The update also covers 2026.4.5 and...

Apache APISIX JWT Authentication Bypass, CVE-2026-39999 APISIX authentication bypass via JWT algorithm confusion, CVE-2026-39999

Apache APISIX JWT Authentication Bypass, CVE-2026-39999

Do Son July 8, 2026

TL;DR Apache APISIX 3.16.0 shipped a JWT algorithm confusion bug in its jwt-auth plugin. The flaw, tracked...

Claude Fable 5 Extension: Free Access Extended Claude Fable 5 extension announcement and API pricing details

Claude Fable 5 Extension: Free Access Extended

Do Son July 8, 2026

Recently, Anthropic reintroduced the Claude Fable 5 model. However, this iteration offers a brief complimentary window for...

Google Voice Introduces Premium Paid Plans Google Voice paid plans subscription tiers and AI transcription features

Google Voice Introduces Premium Paid Plans

Do Son July 8, 2026

Google’s virtual network operator service recently introduced two premium Google Voice personal paid plans tailored for United...

Android remote root exploit chain PoC by Nebula

Android Remote Root Exploit Chain Unveiled by Nebula

Do Son July 8, 2026

Cybersecurity firm Nebula recently unveiled a demonstration video exposing a critical kernel-level vulnerability and remote privilege escalation...

SpaceXAI Grok 4.5 Launch: Global Public Release Set SpaceXAI Grok 4.5 launch and V9 foundation model metrics

SpaceXAI Grok 4.5 Launch: Global Public Release Set

Do Son July 8, 2026

Elon Musk confirmed the upcoming arrival of the flagship Grok 4.5 model. Previously, this artificial intelligence system...

OpenAI GPT-5.6 Rollout: Global Access Approved OpenAI GPT-5.6 rollout featuring Sol, Terra, and Luna models

OpenAI GPT-5.6 Rollout: Global Access Approved

Do Son July 8, 2026

Consequently, OpenAI has officially unveiled the exquisite GPT-5.6 series. This new cohort includes models code-named Sol, Terra,...

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns

Do Son July 8, 2026

At a glance Details Activity type Phantom squatting: registering AI hallucinated domains for phishing and malware Actors...

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat

Do Son July 8, 2026

At a Glance Malware type Native Messaging backdoor with a malicious Chrome extension Threat actor Unattributed Targets...

The FCC’s Rollback of Broadband Transparency Rules Broadband Consumer Labels transparency rule

The FCC’s Rollback of Broadband Transparency Rules

Do Son July 8, 2026

The Biden administration originally instituted the Broadband Consumer Labels directive. They designed this framework to help citizens...

Veil#Drop Malware Uses Blogspot to Deliver PureLog Stealer China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

Veil#Drop Malware Uses Blogspot to Deliver PureLog Stealer

Do Son July 8, 2026

Malware family PureLog Stealer (delivered by the Veil#Drop framework) Threat actor Not attributed by Securonix Targets Windows...

WordPress Sites at Risk: Outdated PHP, Plugins, and Default Configs WordPress outdated PHP end-of-life security risk chart showing plugin and PHP version gaps

WordPress outdated PHP end-of-life security risk chart showing plugin and PHP version gaps

WordPress Sites at Risk: Outdated PHP, Plugins, and Default Configs

Do Son July 8, 2026

Hundreds of WordPress sites remain easy targets year after year. The cause is rarely a rare zero-day...

Public Exploit for GhostLock (CVE-2026-43499) Enables Linux Privilege Escalation and Container Escape GhostLock CVE-2026-43499 Linux kernel privilege escalation and container escape exploit chain

GhostLock CVE-2026-43499 Linux kernel privilege escalation and container escape exploit chain

Public Exploit for GhostLock (CVE-2026-43499) Enables Linux Privilege Escalation and Container Escape

Do Son July 8, 2026

TL;DR Researchers have published full details and proof-of-concept code for GhostLock. This Linux kernel bug, tracked as...

CISA Adds Four Actively Exploited Flaws to Its KEV Catalog CISA KEV Catalog update listing four actively exploited Joomla Langflow and Adobe ColdFusion vulnerabilities

CISA KEV Catalog update listing four actively exploited Joomla Langflow and Adobe ColdFusion vulnerabilities

CISA Adds Four Actively Exploited Flaws to Its KEV Catalog

Do Son July 8, 2026

TL;DR The CISA KEV Catalog just gained four actively exploited flaws. Three of them carry a top...

Control-M CVE-2026-10539: Unauthenticated Remote Command Injection (CVSS 9.5) Control-M command injection vulnerability CVE-2026-10539 enabling unauthenticated remote command injection on the server

Control-M command injection vulnerability CVE-2026-10539 enabling unauthenticated remote command injection on the server

Control-M CVE-2026-10539: Unauthenticated Remote Command Injection (CVSS 9.5)

Do Son July 7, 2026

TL;DR BMC disclosed a critical flaw in Control-M/Server tracked as CVE-2026-10539. The Control-M command injection bug scores...

Critical Alert 2 Active Exploits Detected Today