Friday, August 7, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 8 critical 87
- Google 2 critical 45
- Microsoft 13 critical 21
- Apache 7 critical 18
- Unknown 2 critical 17
- WSO2 4 critical 17
- Linux 17
- HashiCorp 2 critical 16
- open-reception 4 critical 15
- itsourcecode 6
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.
Also in Palo Alto Unit 42 CCCS Alerts & Advisories Malwarebytes Labs +3
-
Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address. Introduced with iOS 15, iCloud Private Relay employs a dual-hop architecture to ensure users' privacy by routing their Safari web traffic through two relays so that no single third-party, including Apple, can determine where the request is originating from
Also in SecurityWeek Bleeping Computer Malwarebytes Labs +3
-
Attacker phished way into US defense supplier's Microsoft 365 account
US defense and aerospace supplier IEH Corporation 'fessed up that a criminal managed to break into its Microsoft 365 mailbox in a filing with regulators. In a Form 8-K filed with the Securities and Exchange Commission on Thursday, IEH said one of its staffers fell for a phishing scam that gave an attacker access to its M365 environment. The attacker "impersonated a prospective business contact" and sent the employee what appeared to be a genuine Microsoft sharing link. The accompanying fake login page duly harvested the victim's M365 credentials. "The threat actor gained access to mailbox…
Also in Tenable Blog Infosecurity Magazine Cisco Security Advisories
-
Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails
Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email. "The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic,
Also in Cyber Security News The Hacker News Bleeping Computer +3
-
Flaws in Google APK for Python Unlock Agent-to-Agent Attack
Google has fixed the issues, which exploited a trust boundary between two AI agents with different privilege levels to trigger automation that could compromise the supply chain.
Also in Infosecurity Magazine Bleeping Computer Malwarebytes Labs +1
-
Top 10 Best DNS Security Solutions in 2026
Nearly every attack touches DNS the phishing click, the malware callback, the exfiltration tunnel which makes the DNS layer the cheapest place to break kill chains. Cisco Umbrella is our top pick for 2026 on the strength of Talos-fed intelligence and proven scale, with Infoblox leading DDI-integrated security and Akamai delivering edge-scale protection. DNS security protects and exploits the DNS layer blocking resolution of malicious domains, detecting tunneling and DGA activity, and hardening DNS infrastructure. Below, the ten best DNS security solutions ranked. Quick Verdict • Best overall…
Also in The Hacker News CCCS Alerts & Advisories The Register Security
.webp?ssl=1)
-
Wiz Brings Automated DISA STIG Assessment to Amazon Linux 2023 and Windows Server 2025
Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation.
Also in Malwarebytes Labs The Hacker News Wired Security
-
18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since 2008. The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148, released August 3, close it. Anyone running an older kernel with SCTP reachable should update.
Also in SANS Internet Storm Center Bleeping Computer The Hacker News +1
-
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source control plane for teams of artificial intelligence (AI) agents, and both paths rely on importing a malicious agent and starting it. A third flaw could expose sensitive data and control-plane details through application programming interface (API) routes
Also in Microsoft Security Microsoft Security Microsoft Security +1
-
Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service
A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in 2021. Between 2021 and 2023, Ransom Cartel conspirators attacked at least 18 companies, including firms in California, New York and Nebraska, and others abroad, according to the Justice Department.
Also in CyberScoop Bleeping Computer
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-5430 | WSO2 Universal GatewayHashiCorp | Critical | 10.0 | 0.2% | — | — | — | EPSS 0.2%CVSS 10.0 | |
What it isThe JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading t… Attack
Exploitation
|
|||||||||
| CVE-2026-65553 | Spider Analyser – WordPress搜索引擎蜘蛛分析插件WordPress | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUnauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-66665 | Type HubBrandexponents | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUnauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-11976 | MonsterInsights ProUnknown | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isThe official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-sy… Attack
Exploitation
|
|||||||||
| CVE-2026-14812 | Premium SEOWordPress | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isThe Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end scr… Attack
Exploitation
|
|||||||||
| CVE-2026-56162 | Azure SQL DatabaseMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isImproper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-63508 | Microsoft Planetary Computer Pro (GeoCatalog)Microsoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isMissing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-65667 | Microsoft TeamsMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isMissing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-65548 | BethemeMuffingroup | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isContributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-48086 | appointment-booking-softwareopen-reception | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isOpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to platform-wide GLOBAL_ADMIN through a single PUT request. The role-upda… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.