Security news, same-day.
Real incidents and critical patches, verified on two sources and translated into what your business should actually do about it this week — never hype, never stale.
Critical Rails Flaw Lets Attackers Steal Server Secrets Through Ordinary Image Uploads
CVE-2026-66066 lets an unauthenticated attacker read a Ruby on Rails application's secrets through a routine image upload. Patches are out; here's what to check this week.
vBulletin Patches a Critical Pre-Auth RCE Flaw — Exploit Code Is Already Public
CVE-2026-61511 lets an attacker run commands on a vBulletin forum with no login required, and working exploit code is public. What to check this week if you run one.
Ernst & Young Confirms Client Tax Data Breach as ShinyHunters Sets a Leak Deadline
Ernst & Young confirmed attackers stole client tax data through a support-ticket system, and ShinyHunters has set a 31 July deadline to leak it. What the incident means for your own vendor risk.
Coca-Cola's Fairlife Confirms Data Theft After Refusing to Pay Ransomware Gang
Coca-Cola confirmed the Anubis gang stole data from its Fairlife unit and halted US production. What the incident means for your ransomware planning.
A Widely Used Java Library Has an Unpatched RCE Flaw Under Active Attack
CVE-2026-16723, a critical remote code execution flaw in Fastjson, is being actively exploited against Spring Boot applications with no patched version available. Here's what to check this week.
Hotel and Conference Wi-Fi Is Being Used to Steal Microsoft 365 Logins
Researchers found compromised Wi-Fi gateways at hotels, conference centers and airports quietly redirecting guests to fake Microsoft 365 login pages. Here's what travelling staff need to do before their next trip.
A Patched Zimbra Email Flaw Is Still Being Actively Exploited
A state-linked group has been reading Zimbra Collaboration inboxes since mid-2025 by getting victims to simply open an email — and the flaw was patched in November. Here's why that still matters.
A Login Bypass Is Letting Attackers Take Over Check Point Firewall Consoles
CVE-2026-16232 lets an unauthenticated attacker grab an admin login token for Check Point's SmartConsole management server. Here's who is exposed and what to check this week.
A Second SharePoint Flaw Is Being Used to Steal "Master Keys"
CVE-2026-50522 lets attackers pull SharePoint's machine keys with a single request, giving them access that survives a patch. Here's what on-premise SharePoint owners need to do.
A Windows Zero-Day Called LegacyHive Has No Official Patch Yet
LegacyHive lets a standard Windows user hijack an admin's registry hive on every supported version of Windows 10, 11, and Server. Microsoft has no fix yet — here's what's available now.
A 15-Year-Old NGINX Bug Just Became a Critical Code-Execution Risk
A heap overflow hiding in NGINX since 2011 was patched this month. It can crash your server, and researchers say code execution is possible too. Here's what to check.
wp2shell: The WordPress Core Bug That Needs No Login to Take Over Your Site
A chained SQL-injection and REST API bug in WordPress core lets anonymous attackers run code on default installs. Public exploits are already out — here's what to check this week.
HollowByte: How an 11-Byte Message Can Exhaust Your Server's Memory
Okta's Red Team disclosed an OpenSSL flaw where a crafted 11-byte TLS message can fragment server memory until it crashes. No CVE was assigned — here's what to check on your servers.
New SharePoint Zero-Day Was Exploited Before a Patch Existed
Microsoft confirms CVE-2026-58644 was used in attacks before a fix shipped. CISA gives federal agencies until Sunday to patch — here's what to check.
Critical Zoom Flaw Lets Unauthenticated Attackers Take Over Windows Accounts
A CVSS 9.8 bug in Zoom's Windows client, VDI client, and Meeting SDK needs no user action to exploit. What to update this week.
Actively Exploited SharePoint Flaws Put On-Premises Servers at Risk
CISA confirms attackers are chaining three SharePoint Server flaws to gain remote code execution and steal server keys. What to check this week if you run it in-house.
xAI's Grok Build CLI Was Uploading Entire Git Repositories — Opt-Out Didn't Stop It
A wire-level analysis found the coding assistant sending full repos, unread files, and .env secrets to a Google Cloud bucket — and the privacy toggle made no difference. What to check this week.
RedHook Android Malware Grants Itself Shell Access Over Wireless Debugging
A Vietnam-born Android banking trojan now silently enables Wireless Debugging and pairs with itself for shell-level device control — and has spread into Indonesia. What to check this week.
Australia's Cyber Agency Warns of a Global Campaign Exploiting 18 CMS Plugins and Platforms
The ACSC says an ongoing campaign is backdooring websites through 18 known, patchable CMS plugins and platforms, including WordPress and Joomla add-ons. What to check this week.
Progress Orders ShareFile Admins to Shut Down Servers Over a "Credible Threat"
Progress Software told customers running ShareFile Storage Zone Controllers to power those servers down immediately, with no CVE and no confirmed breach disclosed yet. What file-transfer users should do this week.
WP-SHELLSTORM: An Exposed Server Reveals a WordPress Backdoor Operation
An unsecured server exposed the tools behind a campaign that backdoored over 25,000 WordPress and Joomla sites using known, patchable plugin bugs. What to update this week.
Microsoft Patches the "RoguePlanet" Windows Defender Zero-Day— What to Check This Week
A Defender flaw (CVSS 7.8) let attackers grab SYSTEM-level control on fully patched Windows machines. Microsoft's fix ships automatically — here's the five-minute check worth doing anyway.
Ubiquiti Patches Seven Critical UniFi Flaws — What Small Offices Should Do This Week
A maximum-severity flaw (CVSS 10.0) plus six other critical bugs hit UniFi Connect, Talk, Access, Protect, and OS. If your office network runs on UniFi gear, here's the ten-minute check worth doing now.
Accenture Confirms a Breach — What the Confirmation Actually Covers
A hacker advertised stolen source code and access keys; Accenture confirmed an "isolated matter." What the confirmation does and doesn't cover, and the credential-hygiene lesson for smaller businesses.