Firefox JIT Flaw CVE-2026-10702 Exposes Tor Browser to Deanonymization
July 29, 2026
Nebula Security published a full browser-to-kernel exploit chain for Firefox CVE-2026-10702, a JIT flaw that exposes Tor Browser users to
Cybersecurity
Firefox JIT Flaw CVE-2026-10702 Exposes Tor Browser to Deanonymization
Nebula Security published a full browser-to-kernel exploit chain for Firefox CVE-2026-10702, a JIT flaw that exposes Tor Browser users to deanonymization.
Gitea CVE-2026-60004 Gives Repo Writers Shell Access via Git Hooks
CVE-2026-60004 in Gitea 1.17–1.27.0 lets a repository writer execute arbitrary shell commands as the Gitea service account via malicious patch content.
OpenWrt CVE-2026-53921 Lets Attackers Root Routers via DHCPv6 Overflow
CVE-2026-53921, a CVSS 9.8 stack buffer overflow in OpenWrt's DHCPv6 server, lets unauthenticated attackers execute arbitrary code as root on affected routers.
Nimbus Manticore Deploys NightLedger Backdoor Across Three Regions
Iran-linked Nimbus Manticore deployed the new NightLedger backdoor and WebSocket tunnelers against targets in the Middle East, Africa, and South Asia.
Tengu Botnet Reboots Devices via Hardware Watchdog to Evade Removal
Tengu, a new Mirai-derived Linux IoT botnet, triggers device reboots via hardware watchdog when defenders kill its process, supporting 25 DDoS methods.
24,650 Internet-Exposed Server BMCs Leak Password Hashes Before Login
Researchers found 24,650 internet-exposed BMCs that disclose IPMI password hashes before login, enabling offline hash cracking and full server takeover.
CyberAv3ngers Suspected in OT Attacks on 30+ Minnesota Water Utilities
More than 30 Minnesota water utilities were disrupted in a coordinated OT attack; Tenable suspects Iran-linked CyberAv3ngers based on targeting patterns.
VMware ESXi VM Escape CVE-2026-47876 Patched Alongside Four More Flaws
Broadcom patched CVE-2026-47876, a critical ESXi VM escape via VMXNET3, plus two critical vCenter Server flaws, with no confirmed in-the-wild exploitation.
CubePilot Drone Controller Developer Hit by DNS Hijacking
Attackers seized CubePilot's domain DNS settings and obtained TLS certificates for all subdomains, potentially capturing credentials during the attack window.
Claude Mythos Cracks HAWK-256 Lattice Problem, Speeds AES-128 Attack
Anthropic's Claude Mythos derived a HAWK-256 key-recovery attack and 200–800x speedup for a seven-round AES-128 attack, with no impact on deployed systems.
Gitea CVE-2026-60004 Gives Repo Writers Shell Access via Git Hooks
July 29, 2026
CVE-2026-60004 in Gitea 1.17–1.27.0 lets a repository writer execute arbitrary shell commands as the Gitea service account via malicious patch
OpenWrt CVE-2026-53921 Lets Attackers Root Routers via DHCPv6 Overflow
July 29, 2026
CVE-2026-53921, a CVSS 9.8 stack buffer overflow in OpenWrt’s DHCPv6 server, lets unauthenticated attackers execute arbitrary code as root on
Nimbus Manticore Deploys NightLedger Backdoor Across Three Regions
July 29, 2026
Iran-linked Nimbus Manticore deployed the new NightLedger backdoor and WebSocket tunnelers against targets in the Middle East, Africa, and South
Tengu Botnet Reboots Devices via Hardware Watchdog to Evade Removal
July 29, 2026
Tengu, a new Mirai-derived Linux IoT botnet, triggers device reboots via hardware watchdog when defenders kill its process, supporting 25
24,650 Internet-Exposed Server BMCs Leak Password Hashes Before Login
July 29, 2026
Researchers found 24,650 internet-exposed BMCs that disclose IPMI password hashes before login, enabling offline hash cracking and full server takeover.
CyberAv3ngers Suspected in OT Attacks on 30+ Minnesota Water Utilities
July 29, 2026
More than 30 Minnesota water utilities were disrupted in a coordinated OT attack; Tenable suspects Iran-linked CyberAv3ngers based on targeting
VMware ESXi VM Escape CVE-2026-47876 Patched Alongside Four More Flaws
July 29, 2026
Broadcom patched CVE-2026-47876, a critical ESXi VM escape via VMXNET3, plus two critical vCenter Server flaws, with no confirmed in-the-wild
CubePilot Drone Controller Developer Hit by DNS Hijacking
July 29, 2026
Attackers seized CubePilot’s domain DNS settings and obtained TLS certificates for all subdomains, potentially capturing credentials during the attack window.
Claude Mythos Cracks HAWK-256 Lattice Problem, Speeds AES-128 Attack
July 29, 2026
Anthropic’s Claude Mythos derived a HAWK-256 key-recovery attack and 200–800x speedup for a seven-round AES-128 attack, with no impact on
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.