Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files...
Hacking
Category Added in a WPeMatico Campaign
Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI...
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Ravie LakshmananJul 29, 2026Vulnerability / Enterprise Security Broadcom has released security updates to address multiple security flaws impacting VMware ESX,...
Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering...
Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
Cybersecurity researchers have disclosed details of a large-scale fraud campaign that involves creating lookalike websites of major Russian companies with...
Mythos Asks the Right Question. It Doesn’t Answer It.
AI is compressing exploit timelines. The real question isn't whether your vulnerability management playbook needs to change, it's which part...
Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity
Ravie LakshmananJul 29, 2026Cybercrime / Law Enforcement The Federal Security Service of the Russian Federation (FSB) on Wednesday said it...
Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass
Ravie LakshmananJul 29, 2026Vulnerability / Enterprise Security Cybersecurity researchers have shared additional technical details about a recently patched critical security...
OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach
OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging...
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Swati KhandelwalJul 29, 2026Vulnerability / DevOps Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A...
Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates
Swati KhandelwalJul 29, 2026Mobile Security / Threat Intelligence Source code for the Flying Eagle Android remote access trojan (RAT) framework...
Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan...
Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack
Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for...
Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
Swati KhandelwalJul 28, 2026Linux / Endpoint Security A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware...
24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform...
