Addressing Windows LegacyHive Zero-Day Flaw with New Patches
Windows LegacyHive local privilege escalation zero-day allows attackers to gain elevated privileges on up-to-date Windows systems.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesSunday, July 26
Critical NGINX Flaw Exposes Servers to Remote Code Execution
CVE-2026-42533 in nginx script engine enables crashing worker processes and potential remote code execution since 2011.
Estée Lauder Faces Data Breach Linked to Oracle EBS Vulnerability
Attackers exploited Oracle E-Business Suite zero-day to exfiltrate personal, financial and health information from Este9e Lauder systems.
ServiceNow Vulnerability Exploited Soon After Patch Release
ServiceNow AI platform CVE-2026-6875 is being exploited for remote code execution days after disclosure.
Exploited SharePoint Vulnerability Poses Persistent Security Threat
SharePoint CVE-2026-50522 exploited to steal machine keys enabling persistent access even after patching.
Exploited WordPress Vulnerabilities Lead to Webshell Installations
Active exploitation of wp2shell (CVE-2026-63030, CVE-2026-60137) enables webshell installation and site takeover on many WordPress hosts.
Friday, July 24
Invisible Comments in Azure DevOps Pose AI Security Threat
PremiumAzure DevOps MCP flaw allows invisible PR comments to prompt-inject AI code review agents, leaking repository content to attackers.
OpenAI Swiftly Addresses Critical ChatGPT Vulnerability
PremiumOpenAI patches AgentForger flaw that allowed creating and remotely controlling invisible AI agents inside organizations.
Claude Cowork Vulnerability Exposes Mac Files to AI Agent Escape
PremiumSandbox escape in Anthropic's Claude Cowork could allow agent VM breakout to read/write Mac files for ~500,000 users.
Zimbra Zero-Click Vulnerability Exploited by Russian Group
PremiumRussia-linked Laundry Bear leveraged a Zimbra zero-click vulnerability to steal emails, prompting international advisories and urgent patching.
Check Point Addresses Critical SmartConsole Vulnerability
PremiumCheck Point patched an actively exploited SmartConsole zero-day used against customer admin panels; immediate patching recommended.
Monday, July 20
Critical OpenSSL Vulnerability Allows Memory Exhaustion via TLS Requests
PremiumHollowByte OpenSSL vulnerability allows an 11-byte TLS request to bloat server memory, causing denial-of-service until restart.
Wave of Cyber Vulnerabilities: From AI to WordPress
PremiumNewsletter aggregates multiple incidents including EY breach, wp2shell exploit, and numerous high-impact patches and breaches.
Windows Zero-Day Exploit Elevates Threat Levels for Admin Access
PremiumLegacyHive Windows zero-day exploit enables privilege escalation to admin on up-to-date Windows systems via registry hive flaws.
New SharePoint Vulnerability Exploited Promptly After Disclosure
PremiumA critical SharePoint vulnerability is being exploited in the wild shortly after disclosure, allowing remote authenticated code execution.
Critical Flaws in Citrix Clients Demand Immediate Patching
PremiumCitrix Secure Access and Endpoint clients for Windows have a privilege-escalation flaw (CVE-2026-53565) enabling SYSTEM access.
Urgent Patch Required for Fortinet FortiSandbox Vulnerabilities
PremiumCISA mandated urgent patching for actively exploited Fortinet FortiSandbox vulnerabilities with near-term federal deadlines.
New Exploits Target SonicWall SMA Devices Granting Root Access
PremiumZero-days in SonicWall SMA 1000 appliances were exploited prior to disclosure, enabling root-level compromise.
Urgent Patch Released for Dangerous WordPress Core Vulnerability
PremiumUnauthenticated wp2shell RCE affects millions of WordPress sites; public exploits available — apply emergency patch now.
Friday, July 17
Get these articles delivered to your inbox.
Subscribe free