Morning Brief

Microsoft has introduced a redesigned File Explorer context menu for Windows 11 Insiders , promising faster right-click performance, less clutter, and new controls over built-in commands and third-party app extensions. The update is part of Microsoft’s wider effort to improve File Explorer’s responsiveness, stability, and day-to-day usability. File Explorer is central to everyday Windows activity, including browsing folders, copying files, renaming documents, and accessing cloud-stored content. Microsoft said it has focused on reducing freezes, loading delays, visual flashes, and other…

Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below - ubnuler ubnlder ri18nr reaker rakier orakw joxn

A critical security flaw in the Forminator Forms WordPress plugin could allow unauthenticated attackers to upload malicious PHP files , potentially enabling them to take full control of vulnerable websites. The issue, tracked as CVE-2026-15748, affects Forminator Forms versions 1.56.1 and earlier and carries a CVSS severity score of 9.8. Forminator Forms is a widely used drag-and-drop plugin for building contact, payment, poll, quiz, and file-upload forms. With more than 600,000 active installations, the vulnerability poses a significant risk to WordPress administrators who have not yet…

A cybercrook claims to have siphoned millions of employee records from the Microsoft Azure environments of major companies including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services. The alleged haul spans nine organizations and is being advertised for sale by a threat actor using the name "TheHatman," according to research published by Hudson Rock. McDonald's accounts for the largest alleged dataset on TheHatman's shopping list, with 1.7 million records purportedly up for grabs. Another 800,000 records supposedly come from Tata Consultancy Services, 425,000 from Vodafone, and…

Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS.

GitLab has released urgent security updates to fix a critical GraphQL vulnerability that could allow unauthenticated attackers to modify or delete public projects and user data remotely. The issue, tracked as CVE-2026-19478, affects GitLab Community Edition and Enterprise Edition installations across several supported release branches. The vulnerability was addressed in GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, released on August 17, 2026. GitLab strongly recommends that administrators of self-managed instances upgrade immediately. GitLab.com and GitLab Dedicated have already…

Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a

Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the

CISA has added a critical Ray-Project Ray vulnerability, tracked as CVE-2025-62593 , to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. The flaw can allow remote code execution on systems where vulnerable Ray development environments are running. Ray is an open-source distributed computing framework widely used by Python developers and AI teams for scaling machine learning, data processing, and application workloads. The issue affects Ray versions before 2.52.0 and is especially dangerous for developers using Firefox or Safari. At the same time, Ray is…