A researcher claims to have alerted SharkNinja as early as March about a vulnerability that allows remote control of Shark robot vacuum cleaners, access to their camera, and the exfiltration of sensitive data. Patches are still awaited.
Jul 27, 2026 4 1
CVE-2026-54121, CVSS 8.8. A domain account with no privileges is sufficient to obtain an AD CS-signed certificate for the identity of a Domain Controller, then authenticate via PKINIT and extract krbtgt via DCSync. Patched on July 14, 2026, public exploit since today.
Jul 24, 2026 3 1
CVE-2026-32194 and CVE-2026-32191, both CVSS 9.8. Two command injections in the Bing image search pipeline: a simple SVG whose image attribute starts with " | " is enough for ImageMagick to launch server-side shell commands from Microsoft. Discovered by the autonomous startup XBOW, patched in March 2026, published today.
Jul 24, 2026 4 2
Researchers demonstrate that a local attacker can intercept and replace a macOS application during its download, before Gatekeeper has finished its job. Apple, informed, downplays it. Details of a "dumb and nasty" attack that highlights a gray area in the macOS trust model.
Jul 24, 2026 5 2
Socket.dev documented a campaign where 583 GitHub Actions workflows slipped into 10 PHP packages scan the Internet for cPanel/WHM instances vulnerable to the CVE-2026-41940 authentication bypass - to steal almost all available credentials. Approximately 6,100 workflows bear the campaign's signature on GitHub.
Jul 23, 2026 18 3
Zenity Labs publicly disclosed on July 23, 2026 a vulnerability in the ChatGPT agent builder that allowed the silent installation of a malicious agent inheriting all of the victim's connectors (Outlook, Slack, Drive...). Fixed on June 9 - but the vulnerability class remains to be monitored.
Jul 23, 2026 7 2
A flaw in the Azure DevOps MCP (Model Context Protocol) integration allows an invisible comment in a pull request to hijack an LLM agent tasked with reviewing it.
Jul 23, 2026 7 2
A flaw in the Adobe Acrobat browser extension allows malicious sites to read the victim's WhatsApp Web data - a classic Same-Origin Policy bypass via a privileged extension.
Jul 23, 2026 18 3
A vulnerability in snap-confine allows a local user to gain root privileges on standard Ubuntu desktop installations where Snap is enabled by default.
Jul 23, 2026 9 3
A simple comment hidden in an Azure DevOps pull request can turn the code reviewer's AI agent against them - and send it siphoning projects that the attacker normally wouldn't have access to. The vulnerability lies in Microsoft's official MCP server.
Jul 22, 2026 8 2
A critical authentication bypass vulnerability in PAN-OS on the GlobalProtect portal (Palo Alto Networks' VPN firewall) is now being exploited in the real world by the Qilin ransomware gang. Arctic Wolf, relayed by BleepingComputer, confirms active intrusions: the patch can no longer wait.
Jul 21, 2026 24 3
On July 20, 2026, Hugging Face revealed a breach in its production infrastructure. The entry was made through a malicious dataset, but the most disturbing aspect is elsewhere: the post-intrusion operations were carried out by an "autonomous agent framework" executing thousands of actions across a swarm of ephemeral sandboxes.
Jul 20, 2026 23 3
