CVE-2026-54121, CVSS 8.8. A domain account with no privileges is sufficient to obtain an AD CS-signed certificate for the identity of a Domain Controller, then authenticate via PKINIT and extract krbtgt via DCSync. Patched on July 14, 2026, public exploit since today.
yesterday 3 1
CVE-2026-32194 and CVE-2026-32191, both CVSS 9.8. Two command injections in the Bing image search pipeline: a simple SVG whose image attribute starts with " | " is enough for ImageMagick to launch server-side shell commands from Microsoft. Discovered by the autonomous startup XBOW, patched in March 2026, published today.
yesterday 4 2
Socket.dev documented a campaign where 583 GitHub Actions workflows slipped into 10 PHP packages scan the Internet for cPanel/WHM instances vulnerable to the CVE-2026-41940 authentication bypass - to steal almost all available credentials. Approximately 6,100 workflows bear the campaign's signature on GitHub.
Jul 23, 2026 18 3
The Linux kernel security team publishes 432 CVEs in 48 hours. A spectacular raw figure, but it needs to be put into perspective: it is the direct consequence of the CNA policy adopted in 2024.
Jul 23, 2026 25 4
