Chrome 149 Patches 28 Flaws, Including 12 Use-After-Free Bugs
June 12, 2026
Google’s Chrome 149 security update patches 28 vulnerabilities, roughly 12 use-after-free bugs, a memory corruption class tied to drive-by code
Application Security
Chrome 149 Patches 28 Flaws, Including 12 Use-After-Free Bugs
Google's Chrome 149 security update patches 28 vulnerabilities, roughly 12 use-after-free bugs, a memory corruption class tied to drive-by code execution.
OpenClaw AI Agent Hijacked via Malicious vCard Injection
Researchers showed OpenClaw AI agents can be hijacked through vCards with embedded instructions, enabling attacker code execution and sensitive data leakage.
Six Proto6 Flaws in protobuf.js Enable Node.js RCE
Six Proto6 vulnerabilities in protobuf.js enable remote code execution and denial-of-service against Node.js apps via malicious schemas or crafted payloads.
npm v12 Disables Auto-Run Scripts to Cut Supply Chain Risk
npm v12 will disable install scripts by default, requiring an explicit allowlist and closing the primary vector used by Miasma and Shai-Hulud attackers.
Three LangGraph Flaws Chain to Remote Code Execution
Three patched LangGraph vulnerabilities chain from SQL injection to remote code execution on self-hosted AI agent framework deployments, researchers disclosed.
Fortinet FortiSandbox CVE-2026-25089 Allows Unauthenticated RCE
Fortinet patched CVE-2026-25089, a CVSS 9.1 OS command injection in FortiSandbox's Web UI exploitable by unauthenticated attackers via crafted HTTP requests.
OpenSSL Patches 16 Flaws Including Heap Use-After-Free RCE Risk
OpenSSL released 16 security fixes, led by CVE-2026-45447, a HIGH severity heap use-after-free in PKCS7_verify() that may enable RCE via crafted S/MIME messages.
Shai-Hulud Hades Wave Poisons 29 Bioinformatics PyPI Packages
The Shai-Hulud Hades variant targeted ~29 bioinformatics and ML PyPI packages in a second wave, introducing a loader-payload split and bringing the campaign past 100 ...
Oracle PeopleSoft CVE-2026-35273: ShinyHunters Breaches 100+ Orgs
Oracle issued emergency mitigations for CVE-2026-35273, an RCE flaw in PeopleSoft, after ShinyHunters breached 300 instances across more than 100 organizations.
Langflow CVE-2026-5027: Path Traversal Becomes Unauthenticated RCE
CVE-2026-5027 in Langflow allows unauthenticated attackers to write arbitrary files via path traversal, achieving RCE on 7,000 publicly exposed AI instances.
OpenClaw AI Agent Hijacked via Malicious vCard Injection
June 12, 2026
Researchers showed OpenClaw AI agents can be hijacked through vCards with embedded instructions, enabling attacker code execution and sensitive data
Six Proto6 Flaws in protobuf.js Enable Node.js RCE
June 12, 2026
Six Proto6 vulnerabilities in protobuf.js enable remote code execution and denial-of-service against Node.js apps via malicious schemas or crafted payloads.
npm v12 Disables Auto-Run Scripts to Cut Supply Chain Risk
June 12, 2026
npm v12 will disable install scripts by default, requiring an explicit allowlist and closing the primary vector used by Miasma
Three LangGraph Flaws Chain to Remote Code Execution
June 12, 2026
Three patched LangGraph vulnerabilities chain from SQL injection to remote code execution on self-hosted AI agent framework deployments, researchers disclosed.
Fortinet FortiSandbox CVE-2026-25089 Allows Unauthenticated RCE
June 12, 2026
Fortinet patched CVE-2026-25089, a CVSS 9.1 OS command injection in FortiSandbox’s Web UI exploitable by unauthenticated attackers via crafted HTTP
OpenSSL Patches 16 Flaws Including Heap Use-After-Free RCE Risk
June 12, 2026
OpenSSL released 16 security fixes, led by CVE-2026-45447, a HIGH severity heap use-after-free in PKCS7_verify() that may enable RCE via
Shai-Hulud Hades Wave Poisons 29 Bioinformatics PyPI Packages
June 12, 2026
The Shai-Hulud Hades variant targeted ~29 bioinformatics and ML PyPI packages in a second wave, introducing a loader-payload split and
Oracle PeopleSoft CVE-2026-35273: ShinyHunters Breaches 100+ Orgs
June 11, 2026
Oracle issued emergency mitigations for CVE-2026-35273, an RCE flaw in PeopleSoft, after ShinyHunters breached 300 instances across more than 100
Langflow CVE-2026-5027: Path Traversal Becomes Unauthenticated RCE
June 11, 2026
CVE-2026-5027 in Langflow allows unauthenticated attackers to write arbitrary files via path traversal, achieving RCE on 7,000 publicly exposed AI
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.