JetBrains patched a critical flaw in TeamCity, its continuous integration and delivery server, that lets an unauthenticated attacker run operating-system commands. Tracked as CVE-2026-63077 and scored 9.8, the deserialization bug affects all on-premises versions and is reached through the agent polling protocol, letting an attacker with HTTP access bypass authentication and execute commands with the privileges of the server process. JetBrains warns that exploitation exposes stored credentials and can compromise the integrity of the build pipeline. It is fixed in versions 2025.11.7 and 2026.1.3, with a patch plugin for older releases, and TeamCity Cloud is already updated. No exploitation has been reported.
Security firms ThreatBook and Imperva report attackers targeting a critical flaw in Fastjson, Alibaba's widely used JSON library for Java. On affected Spring Boot applications, a malicious JSON request can execute code without authentication, running with the privileges of the Java process. Tracked as CVE-2026-16723 with an Alibaba-assigned score of 9.0, the confirmed chain needs Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that feeds attacker-controlled JSON to the parser, and SafeMode left at its disabled default. Notably, the AutoType feature can stay off and no classpath gadget is required. As of July 25, Alibaba had not shipped a fixed 1.x version.
Attackers began exploiting a critical Microsoft SharePoint flaw within days of a working proof-of-concept appearing publicly. CVE-2026-50522 is a deserialization of untrusted data issue rated 9.8 that lets a remote attacker run code on on-premises SharePoint without authentication, and Microsoft patched it in the July updates while marking exploitation as more likely rather than confirmed. Offensive security firm watchTowr reports active attacks against on-premises deployments, with attackers pulling SharePoint machine keys in a single request. Those keys let an attacker forge authentication tokens and impersonate users, so access survives patching. It is the third SharePoint flaw to see exploitation this month.
CISA has added a SharePoint remote code execution flaw to its Known Exploited Vulnerabilities catalog after confirming active exploitation, months after Microsoft rated it less likely to be attacked. The bug (CVE-2026-45659, CVSS 8.8) comes from unsafe deserialization of untrusted data and lets an authenticated attacker with only Site Member permissions run code on a SharePoint server over the network, with low complexity and no user interaction. Microsoft patched it in May for SharePoint Server Subscription Edition, 2019, and Enterprise 2016. On-premises SharePoint is a repeated target because it holds sensitive data and is often internet-facing, and it has a long history of weaponized code execution flaws.
Attackers are actively exploiting a critical flaw in PTC Windchill and FlexPLM, product lifecycle management software widely used across automotive, aerospace, defense, and manufacturing to store designs, engineering data, and intellectual property. The bug (CVE-2026-12569) is an unsafe deserialization issue that lets an unauthenticated attacker run code remotely by sending a crafted request. PTC patched it in mid-June, but has since reported heightened activity, with attackers deploying JSP web shells for command execution and data theft. CISA added it to its Known Exploited Vulnerabilities catalog, the first-ever PTC product to be listed, with a federal deadline of June 28. PTC has published indicators of compromise.
Check Point has disclosed three now-patched flaws in LangGraph, the popular LangChain framework for building AI agents, that can be chained for remote code execution on self-hosted servers. The chain combines an SQL injection (CVE-2025-67644) with an unsafe msgpack deserialization bug (CVE-2026-28277): an attacker who can reach the agent's stored-state endpoint plants a malicious checkpoint that runs code when loaded. A compromised LangGraph server exposes everything the agent can touch, including model API keys, customer data, and internal network access. It is only exploitable in self-hosted deployments using the SQLite or Redis checkpointer; LangChain's managed LangSmith platform is not affected.
TrustStrike Labs