CISA has added a Cisco IOS vulnerability to its Known Exploited Vulnerabilities catalog after confirming it is being used in real attacks, requiring federal agencies to patch it under a binding deadline. Cisco IOS and IOS XE run the routers and switches behind many enterprise and service-provider networks, so a flaw here can give attackers a foothold deep in the network path. The listing lands amid heightened warnings, including a joint US-and-allies advisory this week urging better router hygiene against Russian state-sponsored targeting of network devices. Network gear is attractive because it often sits unmonitored, stays online for years, and rarely runs endpoint security; timely patching is the main defense.
CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, both in popular Joomla extensions and both allowing attackers to upload dangerous files. The iCagenda event calendar flaw (CVE-2026-48939, rated 10.0) lets an attacker upload arbitrary files through its attachment feature, ending in PHP code execution, while the Balbooa Forms flaw (CVE-2026-56291) allows unauthenticated upload of executable files leading to full remote code execution. Federal agencies were ordered to fix them by July 13. The additions line up with a broader campaign, recently flagged by Australia's cyber agency, in which attackers scan the internet and exploit known content-management-system and plugin flaws to plant web shells on vulnerable sites.
Australia's Cyber Security Centre has warned of a large-scale global campaign in which attackers scan websites and exploit known vulnerabilities in content management systems and their plugins to plant web shells. The affected software spans WordPress, Joomla, Craft CMS, and others, with the flaws typically allowing unauthenticated file upload, remote code execution, or server-side request forgery. Once a web shell is installed, attackers can take a site offline, deface it, steal data stored on the server, or pivot deeper into the network. Many small and medium-sized businesses have already been hit, and the agency notes the campaign may be accelerated by AI, which helps attackers scale exploitation of newly disclosed flaws.
Progress Software has told ShareFile customers to immediately shut down the on-premises Windows servers running Storage Zone Controllers, citing a "credible external security threat" against its enterprise file-sharing platform. The company has temporarily disabled access to affected accounts and says it has no sign of unauthorized access yet, but it has not disclosed what the threat is or whether a vulnerability is involved. Ordering a full shutdown rather than a patch strongly suggests there is no fix available. Only self-hosted Storage Zone Controllers, which typically sit internet-facing at the network edge, are affected, not cloud-only ShareFile. Progress also makes MOVEit, whose 2023 zero-day was mass-exploited by the Clop group.
Researchers at Binarly found six flaws in U-Boot, the open-source bootloader inside routers, IoT devices, industrial systems, and the management chips of data-center servers. All six are triggered while U-Boot is still reading an untrusted firmware image, before it verifies the signature, so an attacker who supplies a malicious image can act before the trust check runs. Two of the flaws can lead to arbitrary code execution at boot, undermining the whole chain of trust, while the other four crash the device. The vulnerable code dates back to 2013, affecting many releases and vendor forks. Exploiting them does not always need physical access: a compromised management interface could push a malicious image.
Zimbra is urging customers to update after fixing a critical stored cross-site scripting flaw in the Classic Web Client of its widely used email and collaboration platform. A specially crafted email can run malicious scripts when it is simply opened, potentially exposing mailbox contents, session data, and account settings, and enabling session hijacking or credential theft. The flaw, reported by Google's Threat Analysis Group, has no CVE assigned yet and is not confirmed as exploited, but the group often surfaces bugs used by state-backed actors. Zimbra's web client has been a repeated target: Russian-linked groups have exploited similar cross-site scripting flaws against government and military organizations. Updating to version 10.1.19 fixes it.
Researchers at Wiz disclosed GhostApproval, a technique that abuses symbolic links to make AI coding assistants write to sensitive files outside the project. A malicious repository includes a symlink named like an innocent file, such as project_settings.json, that actually points to the developer's SSH authorized_keys or shell startup file. When the developer asks the agent to set up the workspace, it follows the link and writes attacker content, such as an SSH key granting passwordless access. The deeper problem is that the approval prompt shows only the harmless filename, not the real target, so the human approves a change they cannot see. Wiz tested six assistants including Claude Code and Cursor.
Researchers at Nebula Security disclosed GhostLock, a Linux kernel flaw that lets any logged-in user gain full root on an unpatched machine, and it also escapes containers. Tracked as CVE-2026-43499, the bug has shipped by default in essentially every mainstream distribution since 2011 and needs no special permissions or network access; ordinary threading calls from any local program are enough. Nebula built a working exploit it says is 97 percent reliable and published the code, though no in-the-wild use is known yet. There is no full workaround, patch availability is uneven across distributions, and one earlier fix introduced a separate crash bug, so confirm the fixed package version.
Ubiquiti has released fixes for 25 vulnerabilities across its UniFi ecosystem, including several critical flaws that let a network-based attacker fully compromise devices. The most severe, CVE-2026-50746 rated 10.0, is an improper access-control bug in the UniFi Connect application that allows unauthenticated command injection on the host. Others rated 9.9, spanning UniFi Talk, Access, Protect, and UniFi OS, include SQL injection, command injection, and server-side request forgery that lead to privilege escalation, and some can be chained to bypass authentication requirements. The flaws affect widely deployed gateways and consoles like the UDM family. Ubiquiti lists no interim workarounds, so updating each affected product to its fixed version is the only mitigation.
Microsoft has patched RoguePlanet, a Microsoft Defender flaw that a public proof-of-concept had been exploiting since June to gain SYSTEM privileges on fully updated Windows machines. Tracked as CVE-2026-50656, the bug is a race condition in Defender's scanning engine: a low-privileged attacker who already has code running on a host can win a timing window to spawn a command shell as SYSTEM, and the public exploit worked whether or not real-time protection was enabled. It does not provide initial access, but it turns any foothold into full local control, useful for disabling defenses, stealing credentials, and moving laterally. It is the fourth Defender flaw disclosed by the same researcher this year.
TrustStrike Labs