Saturday, August 8, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Tobit Laboratories AG 21
- HashiCorp 12
- Sonatype 11
- Unknown 8
- WordPress 7
- Cisco 7
- Microsoft 1 critical 6
- SourceCodester 6
- Google 6
- klever-io 6
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.
Also in Palo Alto Unit 42 CCCS Alerts & Advisories Malwarebytes Labs +2
-
ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host and then fetches a macOS malware payload that's compatible with the computer's CPU architecture. "
Also in SecurityWeek SecurityWeek Bleeping Computer +3
-
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload," OpenSourceMalware researcher Paul
Also in Cyber Security News Cyber Security News The Hacker News +3
-
Attacker phished way into US defense supplier's Microsoft 365 account
US defense and aerospace supplier IEH Corporation 'fessed up that a criminal managed to break into its Microsoft 365 mailbox in a filing with regulators. In a Form 8-K filed with the Securities and Exchange Commission on Thursday, IEH said one of its staffers fell for a phishing scam that gave an attacker access to its M365 environment. The attacker "impersonated a prospective business contact" and sent the employee what appeared to be a genuine Microsoft sharing link. The accompanying fake login page duly harvested the victim's M365 credentials. "The threat actor gained access to mailbox…
Also in Tenable Blog Infosecurity Magazine Cisco Security Advisories
-
Flaws in Google APK for Python Unlock Agent-to-Agent Attack
Google has fixed the issues, which exploited a trust boundary between two AI agents with different privilege levels to trigger automation that could compromise the supply chain.
Also in CCCS Alerts & Advisories Infosecurity Magazine
-
Wiz Brings Automated DISA STIG Assessment to Amazon Linux 2023 and Windows Server 2025
Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation.
Also in Malwarebytes Labs The Hacker News Wired Security
-
Malware Abuses Windows Hello for Business Key to Authenticate Microsoft Entra ID
A newly demonstrated technique shows how malware in a compromised Windows user session can abuse Windows Hello for Business (WHFB) cryptographic keys to authenticate to Microsoft Entra ID, enabling attackers to gain cloud access without the victim’s password, PIN, or biometric data. Windows Hello for Business is designed as a passwordless authentication system. It normally stores a user’s private key in the device’s Trusted Platform Module, or TPM, making the key difficult to export or steal. Users unlock access to that key with a PIN, fingerprint, facial recognition, or another local…
Also in The Hacker News The Hacker News Bleeping Computer
-
Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers
Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was
Also in SecurityWeek
-
Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
Overview On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077 , a critical unsafe deserialization vulnerability affecting JetBrains TeamCity . An attacker who can reach a TeamCity server over HTTP or HTTPS can exploit the agent polling protocol without credentials and execute operating system commands with the privileges of the TeamCity server process. JetBrains reported no known active exploitation when it disclosed the vulnerability. However, on August 5, 2026, CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, confirming exploitation in…
Also in The Hacker News
-
Fake PDFs and Chat Apps Let Patchwork Spy on PCs and Android Phones
Patchwork, also known as Dropping Elephant, is using fake documents and chat applications to spy on computer and phone users. The long-running espionage group has built separate attack paths for Windows systems and Android devices, allowing it to collect sensitive information from both environments. On Windows, the operation starts with a shortcut file disguised as a PDF document. Opening it launches a hidden PowerShell downloader, displays a decoy file, and quietly installs malware in the background. The technique resembles other malicious shortcut file campaigns that use familiar documents…
Also in Microsoft Security
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-64637 | PleskWebPros | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isImproper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account. Attack
Exploitation
|
|||||||||
| CVE-2026-71558 | ForyApache | Critical | 9.8 | 0.2% | — | — | — | EPSS 0.2%CVSS 9.8 | |
What it isHeap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deser… Attack
Exploitation
|
|||||||||
| CVE-2022-4995 | E-cology 9.0Weaver Network Co., Ltd. | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isWeaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to … Attack
Exploitation
|
|||||||||
| CVE-2026-19264 | postiz-appgitroomhq | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isPostiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory… Attack
Exploitation
|
|||||||||
| CVE-2026-61808 | LightRAGMicrosoft | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isLightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read i… Attack
Exploitation
|
|||||||||
| CVE-2026-50540 | kata-containerskata-containers | Critical | 9.6 | — | — | — | — | CVSS 9.6 | |
What it isKata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated… Attack
Exploitation
|
|||||||||
| CVE-2026-46409 | openyakopenyak | Critical | 9.6 | — | — | — | — | CVSS 9.6 | |
What it isOpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server… Attack
Exploitation
|
|||||||||
| CVE-2026-71560 | ForyApache | Critical | 9.1 | 0.2% | — | — | — | EPSS 0.2%CVSS 9.1 | |
What it isOut-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an o… Attack
Exploitation
|
|||||||||
| CVE-2026-48039 | meta-ads-mcppipeboard-co | Critical | 9.1 | — | — | — | — | CVSS 9.1 | |
What it isMeta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable… Attack
Exploitation
|
|||||||||
| CVE-2026-48170 | scim-patchthomaspoignant | Critical | 9.1 | — | — | — | — | CVSS 9.1 | |
What it is`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.