Security & Risk
143 analyses
The July cycle marks the largest in the history of the program. CISA added three actively exploited SharePoint vulnerabilities on the same day. Triage has become the real bottleneck of the operation.
CVE-2008-4128 returns to the radar 18 years later: the administrative HTTP interface in legacy Cisco 871 routers continues to produce a large-scale exploitable CSRF chain.
Analysis by Group-IB published on July 12 details a new variant of a banking trojan. Malware activates Debugging via Accessibility and obtains shell access without a cable. Vietnam and Indonesia are the current targets.
Sysdig detected the first production scans of CVE-2026-20896 in Gitea Docker images. There are about 6,200 instances exposed to the internet, many containing CI/CD secrets within the repos.
CVE-2026-59873 allows CPU and disk exhaustion with a small tarball. The library sees 106 million weekly downloads on npm and supports a significant portion of the JavaScript build chain.
The attacker compromised jscrambler's npm account on July 11 and published five malicious versions of the tool used by 43,000 companies including Fortune 500, featuring a Rust info-stealer that captures browser credentials and Bitwarden vaults.
Progress Software cut cloud access to ShareFile's Storage Zone Controllers on July 11, impacting 86,000 customers following the disclosure of CVE-2026-2699 (CVSS 9.8) linked to CVE-2026-2701 (CVSS 9.1) which enables unauthenticated RCE.
The path traversal vulnerability in Adobe ColdFusion was patched on June 30, but attackers began exploiting it within two hours. CISA set July 10 as the federal deadline.
Access control vulnerability allows command execution without authentication on adjacent networks and is part of the SAB-066 package, which addresses 25 vulnerabilities in the UniFi line.
Sysdig detected the first exploitation attempt 13 days after the patch, affecting 6,200 exposed instances. The bug originates from a line in app.ini that trusts any IP.
Path traversal vulnerability received a maximum rating and became the target of active exploitation two hours after the technical bulletin. CISA set a deadline of July 10 for the Federal Civil Executive.
Preliminary report co-chaired by Yoshua Bengio and Maria Ressa dismantles the safety-by-design narrative of major developers and shifts the responsibility to regulators and corporate buyers.