WriteOut Flaw Let Attackers Hijack Any Writer AI Enterprise Account
July 7, 2026
Sand Security found a one-click session isolation flaw in Writer AI letting attackers access any enterprise tenant’s private models, credentials,
Application Security
WriteOut Flaw Let Attackers Hijack Any Writer AI Enterprise Account
Sand Security found a one-click session isolation flaw in Writer AI letting attackers access any enterprise tenant's private models, credentials, and documents.
BeyondTrust CVE-2026-40138 Auth Bypass Left Self-Hosted Users Exposed
BeyondTrust patched a CVSS 9.2 auth bypass in Remote Support and PRA for SaaS users months ago but withheld notice from self-hosted operators until July ...
Adobe ColdFusion CVE-2026-48282 Exploited Within Hours of PoC Release
Adobe ColdFusion CVE-2026-48282 (CVSS 10) moved from PoC release to confirmed in-the-wild exploitation in under two hours, according to KEVIntel honeypot data.
UNK_MassTraction Exploits Roundcube XSS to Hit US Physics Departments
Proofpoint named UNK_MassTraction, a China-aligned group using Roundcube CVE-2024-42009 to steal credentials and 2FA tokens from university physics departments.
North Korea PolinRider Poisons 108 Packages via Compromised Accounts
North Korea's PolinRider campaign used stolen maintainer credentials to push malicious updates to 108 packages across npm, Packagist, Go, and Chrome Web Store.
Opera GX Flaw Let Malicious Sites Silently Install Mods on 25M Users
A zero-click flaw in Opera GX's mod system let malicious websites silently install data-harvesting browser extensions on the gaming browser's 25 million users.
SkillCloak Lets Malicious AI Agent Skills Evade 90% of Static Scanners
SkillCloak obfuscation lets malicious AI coding agent skills bypass over 90 percent of static detection tools, risking source code and credential theft.
Zscaler: Two Active Campaigns Hijack AI Agents for Crypto Theft
Zscaler found two active campaigns that embed hidden instructions in web pages, causing 4 of 26 AI agents tested to complete unauthorized crypto transfers.
Apple Hide My Email Still Leaks Real Addresses After Claimed Fix
Apple's iCloud+ Hide My Email vulnerability still exposes real addresses at 100% success, with multiple claimed fixes from Apple failing to close the flaw.
Unit 42 Confirms 13,000 Malicious Phantom Squatting Sites
Unit 42 documented phantom squatting, with 13,229 malicious URLs active on AI-hallucinated domains and 250,000 more unregistered sites available to attackers.
BeyondTrust CVE-2026-40138 Auth Bypass Left Self-Hosted Users Exposed
July 7, 2026
BeyondTrust patched a CVSS 9.2 auth bypass in Remote Support and PRA for SaaS users months ago but withheld notice
Adobe ColdFusion CVE-2026-48282 Exploited Within Hours of PoC Release
July 7, 2026
Adobe ColdFusion CVE-2026-48282 (CVSS 10) moved from PoC release to confirmed in-the-wild exploitation in under two hours, according to KEVIntel
UNK_MassTraction Exploits Roundcube XSS to Hit US Physics Departments
July 7, 2026
Proofpoint named UNK_MassTraction, a China-aligned group using Roundcube CVE-2024-42009 to steal credentials and 2FA tokens from university physics departments.
North Korea PolinRider Poisons 108 Packages via Compromised Accounts
July 6, 2026
North Korea’s PolinRider campaign used stolen maintainer credentials to push malicious updates to 108 packages across npm, Packagist, Go, and
Opera GX Flaw Let Malicious Sites Silently Install Mods on 25M Users
July 6, 2026
A zero-click flaw in Opera GX’s mod system let malicious websites silently install data-harvesting browser extensions on the gaming browser’s
SkillCloak Lets Malicious AI Agent Skills Evade 90% of Static Scanners
July 6, 2026
SkillCloak obfuscation lets malicious AI coding agent skills bypass over 90 percent of static detection tools, risking source code and
Zscaler: Two Active Campaigns Hijack AI Agents for Crypto Theft
July 6, 2026
Zscaler found two active campaigns that embed hidden instructions in web pages, causing 4 of 26 AI agents tested to
Apple Hide My Email Still Leaks Real Addresses After Claimed Fix
July 3, 2026
Apple’s iCloud+ Hide My Email vulnerability still exposes real addresses at 100% success, with multiple claimed fixes from Apple failing
Unit 42 Confirms 13,000 Malicious Phantom Squatting Sites
July 3, 2026
Unit 42 documented phantom squatting, with 13,229 malicious URLs active on AI-hallucinated domains and 250,000 more unregistered sites available to
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.