InfoSecBulletin Cybersecurity for mankind
ASUS has put out important security updates for a serious router flaw. This issue could let remote hackers run any commands on the affected devices. The flaw, known as CVE-2026-13385, affects many ASUS router firmware versions, such as the commonly used 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series.
The ASUS Product Security Advisory says there’s a problem because the router management system does not check inputs correctly. This allows someone to run commands from far away without permission under certain conditions.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Exploiting this could let attackers take control of weak routers. This might lead to problems like network breaches, stealing data, or spreading harmful software like botnets and ransomware.
Meta
A flaw in Meta’s shared support systems leaked private user data, like emails, chat messages, and files. Found during security tests of Meta Horizon Managed Solutions, the problem showed a bigger authorization issue in several support services in Meta’s system.
What initially seemed to be a limited product-specific flaw quickly escalated into a cross-platform security risk, affecting Meta.com support systems, customer support chats, and internal case management workflows.
At its core, the vulnerability stemmed from inconsistent enforcement of authorization checks in Meta’s backend infrastructure. Researchers Rony K Roy discovered that some GraphQL operations gave back sensitive support data even if the user did not have the right permissions.
This mistake let unauthorized users see support cases, internal notes, escalation information, and files connected to other users’ support requests. The exposed data had customer support emails with Meta, chat logs with support agents, case details, and files shared during support help.
Apple Releases Fixes for Hide My Email Flaw
Apple has released a security fix addressing a critical flaw in its iCloud+ “Hide My Email” feature that could expose users’ real email addresses, undermining the core privacy promise of the service.
The flaw was found when independent researcher Tyler Murphy, who helped start EasyOptOuts, saw that the feature could be easily ignored in certain situations.
Murphy said that testing found all real email addresses in many samples after he told Apple about the problem in June 2025.
According to 404 Media reports, Apple patched the flaw on July 3, 2026, following increased public scrutiny and confirmed that the fix resolves the vulnerability. However, security researchers caution that some risks may still persist.
Apple has not disclosed whether it will notify affected users directly. Security experts recommend that users who created email aliases before July 2026 consider rotating sensitive accounts and monitoring for suspicious activity.
Ubuntu snap-confine Flaw
Cybersecurity experts have revealed a new local privilege escalation (LPE) flaw in snap-confine. An ordinary user can use this flaw to get root access and take full control of the system.
The flaw problem, called CVE-2026-8933 (CVSS score: 7.8), affects standard installs of Ubuntu Desktop 24.04, 25.10, and 26.04. This news comes after 442 security issues in Linux were revealed in the last three days.
“The issue stems from a security hardening change that inadvertently introduced a race condition during sandbox initialization,” Saeed Abbasi, head of Threat Research Unit (TRU) and director of product at Qualys, said.
“Snapd runs a sub-process called snap-confine, which is responsible for creating the necessary confinement for the snap,” according to Canonical.
Hackers Exploit Windmill Flaw
A security flaw affecting the open-source platform Windmill is being actively used by attackers, according to VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill’s “get_log_file” endpoint (“/api/w/{workspace}/jobs_u/get_log_file/{filename}”).
“The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences,” according to an advisory published by Windmill in March 2026.
VulnCheck says that security expert Valentin Lobstein found and reported a problem. Attackers are trying to misuse Windmill’s “get_log_file” endpoint to get private data from the “/etc/passwd” file.
“We’ve observed exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path,” Caitlin Condon, vice president of security research at VulnCheck, said in a post on LinkedIn.
The cybersecurity company said it identified about 170 vulnerable systems exposed across 24 countries.
The news is that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four security problems to its list of Known Exploited Vulnerabilities (KEV). This includes two WordPress issues called wp2shell (CVE-2026-60137 and CVE-2026-63030), a buffer overflow problem in DD-WRT (CVE-2021-27137), and a remote code execution issue in Langflow that does not need authentication (CVE-2026-0770).
Federal Civilian Executive Branch (FCEB) agencies are advised to remediate the identified flaws by July 24, 2026.
