Meta AI Chatbot Flaw Lets Attackers Hijack Instagram Accounts
June 2, 2026
A confused deputy flaw in Meta’s AI support chatbot let attackers hijack Instagram accounts including @obamawhitehouse, Sephora, and U.S. Space
Application Security
Meta AI Chatbot Flaw Lets Attackers Hijack Instagram Accounts
A confused deputy flaw in Meta's AI support chatbot let attackers hijack Instagram accounts including @obamawhitehouse, Sephora, and U.S. Space Force.
Red Hat npm Packages Backdoored with Miasma Credential Worm
Attackers backdoored 32 Red Hat npm packages with the Miasma worm, stealing CI/CD secrets, cloud keys, and SSH keys across roughly 80,000 weekly downloads.
Malicious npm Package codexui-android Steals OpenAI Tokens at Scale
A malicious npm package named codexui-android harvested OpenAI Codex authentication tokens from developers at roughly 29,000 weekly downloads before removal.
WP Maps Pro Flaw Exploited to Create Unauthorized Admin Accounts
An unauthenticated privilege escalation flaw in WP Maps Pro, a WordPress plugin with 15,000 paid sites, is actively exploited to create unauthorized administrator accounts.
Public Exploit Raises Flowise CVE-2026-40933 RCE to Immediate Risk
Public exploit code for CVE-2026-40933 now targets Flowise, a self-hosted AI chatflow builder, via a one-click malicious import that executes arbitrary code on the server.
Microsoft: 14 npm Packages Linked to Single Actor Stealing AWS Keys
Microsoft attributed 14 malicious npm packages impersonating OpenSearch and Elasticsearch to a single threat actor who stole AWS credentials and CI/CD secrets from developer environments.
Gogs CVSS 9.4 RCE Zero-Day Has No Patch and a Metasploit Module
A CVSS 9.4 argument injection zero-day in Gogs lets any authenticated user achieve RCE on internet-exposed servers. No patch exists and Rapid7 has released a ...
Public Exploit Raises Flowise CVE-2026-40933 RCE to Immediate Risk
Public exploit code for CVE-2026-40933 now targets Flowise, a self-hosted AI chatflow builder, via a one-click malicious import that executes arbitrary code on the server.
CIFSwitch Linux Kernel Flaw Gets Public PoC, Root Access Possible
CIFSwitch is a 19-year-old Linux kernel privilege escalation flaw with a public PoC that enables root access on Ubuntu, RHEL, Debian, and other distributions.
Gogs CVSS 9.4 RCE Zero-Day Has No Patch and a Metasploit Module
A CVSS 9.4 argument injection zero-day in Gogs lets any authenticated user achieve RCE on internet-exposed servers. No patch exists and Rapid7 has released a ...
Red Hat npm Packages Backdoored with Miasma Credential Worm
June 2, 2026
Attackers backdoored 32 Red Hat npm packages with the Miasma worm, stealing CI/CD secrets, cloud keys, and SSH keys across
Malicious npm Package codexui-android Steals OpenAI Tokens at Scale
June 1, 2026
A malicious npm package named codexui-android harvested OpenAI Codex authentication tokens from developers at roughly 29,000 weekly downloads before removal.
WP Maps Pro Flaw Exploited to Create Unauthorized Admin Accounts
June 1, 2026
An unauthenticated privilege escalation flaw in WP Maps Pro, a WordPress plugin with 15,000 paid sites, is actively exploited to
Public Exploit Raises Flowise CVE-2026-40933 RCE to Immediate Risk
June 1, 2026
Public exploit code for CVE-2026-40933 now targets Flowise, a self-hosted AI chatflow builder, via a one-click malicious import that executes
Microsoft: 14 npm Packages Linked to Single Actor Stealing AWS Keys
June 1, 2026
Microsoft attributed 14 malicious npm packages impersonating OpenSearch and Elasticsearch to a single threat actor who stole AWS credentials and
Gogs CVSS 9.4 RCE Zero-Day Has No Patch and a Metasploit Module
June 1, 2026
A CVSS 9.4 argument injection zero-day in Gogs lets any authenticated user achieve RCE on internet-exposed servers. No patch exists
Public Exploit Raises Flowise CVE-2026-40933 RCE to Immediate Risk
June 1, 2026
Public exploit code for CVE-2026-40933 now targets Flowise, a self-hosted AI chatflow builder, via a one-click malicious import that executes
CIFSwitch Linux Kernel Flaw Gets Public PoC, Root Access Possible
June 1, 2026
CIFSwitch is a 19-year-old Linux kernel privilege escalation flaw with a public PoC that enables root access on Ubuntu, RHEL,
Gogs CVSS 9.4 RCE Zero-Day Has No Patch and a Metasploit Module
June 1, 2026
A CVSS 9.4 argument injection zero-day in Gogs lets any authenticated user achieve RCE on internet-exposed servers. No patch exists
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.