GitLab RCE PoC: Any Project Pusher Can Run Commands as Git via Notebook Diff Rendering
Researchers at depthfirst published working exploit code for an unfiled GitLab RCE: a two-bug chain in the Oj JSON parser behind Jupyter notebook diff rendering lets any user who can push to a project run commands as git on unpatched self-managed instances.
7-Zip CVE-2026-14266: Heap Overflow in XZ Decoder Lets Crafted Archives Run Code on Extraction
A heap-based buffer overflow in 7-Zip's XZ chunk decoder (CVE-2026-14266) lets a crafted .xz or .7z archive corrupt memory during extraction. Patched in 26.02; no in-the-wild exploitation reported yet, but the affected code path sits in build agents and CI unpacking steps everywhere.
AI Agents Find Two New Redis RCE Chains in Under 90 Minutes
Kimi K3 agents surfaced a stream shared-NACK double-free and a RedisBloom TDigest heap overflow across Redis 6.2 through 8.8, both yielding authenticated remote code execution. Patches are out; no in-the-wild exploitation reported yet.
Certighost (CVE-2026-54121): A Low-Privileged AD User Can Impersonate Your Domain Controller
A working exploit for CVE-2026-54121 lets any domain user request a certificate for a Domain Controller through an AD CS enrollment fallback, then use it to DCSync the krbtgt hash. No admin rights, no user interaction.
RefluXFS (CVE-2026-64600): A Nine-Year-Old XFS Race Condition Roots 16.4 Million Linux Systems
A race condition in the XFS copy-on-write path lets any local user overwrite protected files and gain root — no SELinux bypass needed, no workaround available. Patch and reboot is the only fix.
CVE-2026-16232: Check Point SmartConsole Auth Bypass Grants Full Admin — Actively Exploited, Added to CISA KEV
An unauthenticated attacker can steal a SmartConsole application login token and log into Check Point's Security Management Server with full admin rights. CVE-2026-16232 (CVSS 9.3) is under active exploitation and now sits in CISA's KEV catalog with a July 25 remediation deadline.
Hidden Web Text Turns AWS Kiro Into an RCE Chain: MCP Config Rewrite via Prompt Injection
Researchers at Intezer and Kodem Security show how hidden text on an ordinary web page could make AWS's Kiro agentic IDE rewrite its own MCP config and execute attacker code — no approval dialog, no CVE, patched in Kiro 0.11.130.
CVE-2026-50522: SharePoint RCE Under Active Exploitation, Attackers Stealing Machine Keys for Post-Patch Persistence
CVE-2026-50522, a critical 9.8 CVSS SharePoint deserialization RCE, is being actively exploited to steal machine keys that let attackers forge auth tokens and keep access even after the box is patched.
ServiceNow AI Platform Sandbox-Escape RCE (CVE-2026-6875) Under Active Exploitation
A pre-authentication sandbox-escape flaw in ServiceNow's AI Platform is being exploited in the wild against unpatched instances, with attackers reaching the same code-execution primitive through a gadget chain that diverges from the published proof-of-concept.
Hugging Face Discloses Breach Driven End-to-End by an Autonomous AI Agent
An unauthorized party used an autonomous AI agent swarm to chain two dataset-processing code-execution flaws into a multi-cluster breach at Hugging Face, harvesting cloud credentials before the company detected and evicted it over a weekend.
Ransomware Halts US Production at Coca-Cola's Fairlife Dairy Unit
A ransomware intrusion at Coca-Cola-owned Fairlife forced a shutdown of US dairy production lines, disclosed via SEC 8-K filing — no gang has claimed the attack and no ransom demand has been confirmed publicly.
SleeperGem: Hijacked Dormant RubyGems Accounts Drop a Persistent Backdoor on Developer Machines
Researchers disclose SleeperGem, a RubyGems supply-chain attack that hijacked long-dormant maintainer accounts to publish trojanized gems whose loader specifically targets developer workstations while evading CI runners.
CVE-2026-50518: Unauthenticated Heap Overflow RCE in Windows DHCP Server, No Exploit Required to Care
CVE-2026-50518 is a CVSS 9.8 heap-based buffer overflow in Windows DHCP Server, exploitable pre-auth over the network with no user interaction. Microsoft rates it Exploitation More Likely.
Six Bulletins, One Bug Class: What Ubiquiti's 2026 UniFi Cadence Reveals About Shared-OS Edge Platforms
Since October 2025, Ubiquiti has shipped six security bulletins covering the UniFi line — five of them containing CVSS 9.9-10.0 flaws, two of them the exact same shell-injection bug class shipped seven months apart. This is what happens when one Nginx gateway and one OS layer sit in front of your network, your cameras, and your door locks.
ViteVenom: Scoped npm Packages Impersonate @vitejs to Deliver a Blockchain-C2 RAT
Checkmarx tracks ViteVenom, a sequel to the ChainVeil campaign, in which seven scoped npm packages impersonating the @vitejs namespace deploy a RAT that fetches its C2 address from Tron and Aptos blockchain transactions.
wp2shell: A Two-CVE Chain Turns WordPress Core Into Pre-Auth RCE
CVE-2026-60137 and CVE-2026-63030 chain a REST API route-confusion bug with a WP_Query SQL injection to give unauthenticated attackers a path to full RCE on default WordPress installs.
VMSA-2026-0005: Seven Flaws in VMware Avi Load Balancer, Topped by a 9.8 Auth Bypass
Broadcom patched seven vulnerabilities in VMware Avi Load Balancer, led by CVE-2026-47865, a CVSS 9.8 authentication bypass that gives a network attacker a foothold on the control plane.
HollowByte: An 11-Byte TLS Handshake Payload That Bloats OpenSSL Server Memory
A memory-allocation flaw in OpenSSL's TLS handshake parsing, dubbed HollowByte, lets an unauthenticated attacker exhaust server memory with an 11-byte payload per connection. No CVE was assigned; patched in 4.0.1 and backported across the 3.x line.
LegacyHive: Unpatched Windows Zero-Day Lets Standard Users Mount Another Account's Registry Hive
Researcher Nightmare Eclipse has dropped LegacyHive, a working PoC against the Windows User Profile Service that lets a standard user load another account's registry hive — no CVE, no patch, works on fully updated July 2026 systems.
AA26-194A: NSA, CISA, FBI Warn Russian FSB Center 16 Is Harvesting Router Configs via Weak SNMP and an 18-Year-Old Cisco CSRF Bug
A 19-agency joint advisory (AA26-194A) details a years-long Russian FSB Center 16 campaign that scans for default SNMP community strings and an 18-year-old Cisco IOS CSRF flaw (CVE-2008-4128, now in CISA KEV) to exfiltrate router configs and pivot into critical infrastructure.