Alert

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of a big rise in attacks on internet-connected programmable logic controllers (PLCs) used in water and wastewater systems. The agency’s alert is urgent because hackers affected over 30 local water systems in Minnesota. The attacks began last Sunday and went on until …

NVIDIA has revealed a big flaw with its BlueField DPUs and ConnectX networking systems. This issue could let attackers run code on these systems if they take advantage of it. This security flaw, known as CVE-2026-65094, affects the VIRTIO-Net part and has a CVSS v3.1 score of 9.0, showing it is …

ShinyHunters has publicly claimed responsibility for the Ernst & Young (EY) data breach. The group posted a message on their dark web site. It says they will release all stolen data by July 31, 2026, unless EY talks to them before the mentioned date. EY shared details about the incident …

ASUS has put out important security updates for a serious router flaw. This issue could let remote hackers run any commands on the affected devices. The flaw, known as CVE-2026-13385, affects many ASUS router firmware versions, such as the commonly used 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series. The ASUS Product Security Advisory …

Oracle has fixed over 1,400 security holes in its July 2026 Critical Patch Update (CPU). Most of these flaws were probably found by artificial intelligence. According to Oracle, the latest quarterly CPU includes 1,449 security patches, addressing 1,434 unique CVEs across 334 products. Vulnerabilities have been fixed in products like Database …

Zimbra has launched updates to fix serious security flaws, including a command injection bug in the SNMP monitoring part. As many as nine security flaws have been fixed in Zimbra 10.1.20. The biggest issue is a command injection problem in the SNMP monitoring part when SNMP alerts are turned on. …

The Qilin ransomware group is exploiting a flaw in PAN-OS GlobalProtect to break into victims’ networks, says the cybersecurity firm Arctic Wolf. Palo Alto Networks fixed the flaw (CVE-2026-0257) on May 13 and warned that hackers started using it to break into company networks. Rapid7 reported seeing this attack on many …

The WordPress security team received reports about these flaws: CVE-2026-60137 : A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo CVE-2026-63030 : A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber …

A Windows security flaw called LegacyHive (MSNightmare) misuses the User Profile Service. This allows local users to gain higher privileges, change admin accounts, and run code with admin rights. The public proof‑of‑concept (PoC) from the MSNightmare GitHub account describes the bug as a “Windows user profile service arbitrary hive load …

Zoom has issued updates for a flaw in the Windows desktop client, known as CVE-2026-53412. This issue may allow an unauthenticated user to conduct an account takeover via network access. This flaw arises from improper input validation and may enable unauthenticated attackers to execute account takeover attacks via network access. …