Cisco warned that public proof-of-concept code exists for two vulnerabilities in ClamAV, the widely used open-source antivirus engine, that a remote unauthenticated attacker can use to crash the scanning process and disrupt protection. Tracked as CVE-2026-20337 and CVE-2026-20338, the flaws are rated high severity on Windows because ClamAV runs there in a privileged security context, and medium on macOS and Linux where it runs with lower privileges. There are no workarounds, and Cisco is rolling out fixes in August across its Secure Endpoint Connector products, which embed ClamAV. Because ClamAV is bundled into many mail and file-scanning products, exposure extends well beyond Cisco.
Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval function inside vBulletin and run code on an unpatched forum server. The attack needs no account, administrative access, or interaction from another user, making any internet-facing vulnerable forum a direct target. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier and 6.1.6 and earlier as affected, without giving a lower version boundary. Forum software is an attractive target because it is public by design, often runs with limited maintenance, and a single compromised server can host web shells, redirect visitors, or expose community member data. Administrators should confirm their version and patch level.
A researcher at depthfirst published a working exploit on July 24 for a GitLab flaw patched on June 10, running commands as the git user on any self-managed 18.11.3 server that has not updated. Any authenticated user who can push to a project can trigger it: the attacker commits a crafted Jupyter notebook and opens its commit diff to leak a heap pointer, repeats until an automated probe locates libraries in memory, then fires the payload with two more notebooks. No administrator rights, runner access, or victim interaction are needed. The bug sits in the notebook renderer, which passes repository-controlled data to a parser inside a long-lived worker.
TrustStrike Labs