Curated intelligence at the intersection of offensive security and AI — the latest items, newest first. See Top Picks for the highest-impact stories.

Friday, August 7, 2026

HIGHClamAV Patches ZIP Catalogue Capacity Tracking Vulnerability (CVE-2026-20337)cve · vulnerability · clamav · patchMEDIUMNorth Carolina Ports Confirms Cyberattack Disrupting Operationscritical-infrastructure · cyberattack · port-security · disruptionHIGHNew WordPress Pre-Auth XSS Leads to PHP Code Execution (CVE-2026-64638)cve · wordpress · xss · rceCRITICAL18-Year-Old Linux SCTP Flaw Allows Root and Container Escapelinux · container-escape · privilege-escalation · vulnerabilityHIGHNew NatJack Attacks Hijack TCP Sessions and Spoof DNS via NAT Manipulationnat · tcp-hijacking · dns-spoofing · network-attackHIGHMicrosoft 365 AitM Phishing Hijacks Accounts for Payroll and Finance Emailsphishing · aitm · microsoft-365 · credential-theftHIGHMalware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Accessentra-id · windows-hello · persistence · malwareHIGHClaude Code and Gemini CLI Flaws Allow GitHub Issue to Reach CI Workflow Secretsai-security · cicd · github · prompt-injectionHIGHTeamPCP Linked to Redis Attacks and Supply Chain Campaigns Since 2020threat-actor · supply-chain · redis · cybercrime

Thursday, August 6, 2026

HIGHAWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Model Executionai-security · cloud-security · prompt-injection · agent-orchestration

Wednesday, August 5, 2026

HIGHTrojanized npm Packages Use NullReceiver Tactic to Decode C2 IP from Blockchainnpm · supply-chain · c2 · blockchain

Saturday, August 1, 2026

CRITICALColdcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Thefthardware-wallet · bitcoin · vulnerability · theftCRITICALRails Patches Critical Active Storage RCE Vulnerabilityrails · rce · vulnerability · web-applicationHIGHAdform Script Compromised to Swap Crypto Wallet Addressessupply-chain · cryptocurrency · malware · adformCRITICALAdobe Campaign Classic RCE Flaw (CVE-2026-48449) Patchedadobe · rce · vulnerability · enterprise-softwareHIGHHijacked Hotel Wi-Fi Delivers CornFlake RAT via Fake Updatesmalware · rat · wi-fi · state-sponsoredHIGHSplitVPN Data Breach Exposes 865,336 Accountsdata-breach · vpn · privacy · exposed-data

Friday, July 31, 2026

HIGHAmgen Discloses Cloud Data Breach Affecting Patient Health Informationdata-breach · cloud-security · healthcare · third-partyHIGHArch Linux Disables AUR Package Adoption Due to Malware Floodlinux · supply-chain · malware · open-sourceHIGHChinese Threat Actors Target Central Asian Governments with OctLurk and SilkLurkapt · cyber-espionage · malware · central-asiaMEDIUMownCloud Server 11.0.0 Released with 11 Security Fixesowncloud · security-update · vulnerability · file-sharingCRITICALHacker Uses DeepSeek AI for Autonomous Server Attacksai · autonomous-attack · threat-actor · deepseekCRITICALCISA Warns of Cyberattacks Disrupting U.S. Water Utilitiescritical-infrastructure · ics · ot-security · cisaHIGHHollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attacksmalware · spear-phishing · backdoor · threat-actorHIGHAndroid TV Boxes Act as Phones and Proxy Networksmalware · ad-fraud · iot-security · privacy