In July 2026, phishing campaigns targeted organizations across multiple industries by distributing a masqueraded MSP360 Remote Monitoring and Management installer through meeting invitations, PDF-themed lures, and software update prompts. Once executed, the legitimate MSP360 installer established remote management access on affected devices, providing threat actors with an initial foothold using trusted administrative software. The MSP360 deployment was then used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel for redundant access to compromised systems. Following access establishment, threat actors deployed additional tools and conducted post-compromise activity, including information collection and credential-access operations. The campaigns utilized multiple delivery mechanisms including actor-controlled domains, compromised websites, and legitimate cloud services such as Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.
A stored cross-site scripting (XSS) vulnerability exists in the Refreshed skin of The Wikimedia Foundation's Mediawiki software. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. It affects multiple versions of Mediawiki prior to 1.46.1, including several specific earlier versions. The vulnerability has a medium severity rating with a CVSS score of 6.1.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing vulnerabilities in the hdf5 packages. The update includes multiple hdf5-related RPMs for aarch64 and x86_64 architectures. The advisory addresses three CVEs: CVE-2026-19026, CVE-2026-19027, and CVE-2026-19028. No explicit patch version ranges are provided, but updated package versions are listed. The severity is assessed as medium.
U-Boot versions prior to 2026.10-rc4 contain an integer overflow vulnerability in the sqfs_read_directory_table() function. This flaw occurs when processing a crafted SquashFS image with a malicious superblock metablks_count value, leading to heap buffer under-allocation and out-of-bounds writes. The vulnerability can cause heap memory corruption and bootloader crashes. The CVSS 3.1 base score is 5.2, indicating medium severity. No known exploits are reported in the wild. Affected versions include many specific Ubuntu package versions and all versions before 2026.10-rc4.
U-Boot versions up to 2026.10-rc5 contain an out-of-bounds write vulnerability in the video_display_rle8_bitmap function within drivers/video/video_bmp.c. This flaw allows specially crafted RLE8-compressed BMP images to corrupt memory adjacent to the framebuffer, potentially causing the bootloader to crash. The vulnerability has a medium severity with a CVSS score of 5.9.
U-Boot versions prior to 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contain an out-of-bounds write vulnerability in the __net_defragment() function. This vulnerability allows remote attackers to send crafted IP fragments during netboot, potentially corrupting adjacent memory and causing the bootloader to crash. The vulnerability has a CVSS score of 8.2, indicating a medium severity level. A patch is available to address this issue.
U-Boot versions prior to 2026.10-rc5 contain a buffer overflow vulnerability in the nfs_read_reply() function. This flaw arises from signed integer handling errors that allow a malicious NFS server to bypass length validation and write beyond the intended buffer, potentially causing memory corruption or bootloader crashes. The vulnerability has a CVSS score of 8.2, indicating a medium severity level. A patch is available to address this issue.
U-Boot versions prior to 2026.10-rc5 contain an out-of-bounds memory access vulnerability in the dhcp6_parse_options() function due to improper validation of SERVERID and CLIENTID option lengths in DHCPv6 packets. This vulnerability can be exploited by an attacker on the local network sending crafted DHCPv6 ADVERTISE or REPLY packets during netboot, potentially causing memory corruption and crashing the bootloader. The vulnerability has a CVSS score of 7.1 (medium severity). A patch is available to address this issue.
U-Boot versions prior to 2026.10-rc3 contain an out-of-bounds write vulnerability in the read_slotted_partition() function. This occurs because the image size is not properly validated against partition bounds, allowing crafted boot media with oversized headers to cause memory corruption. The vulnerability affects devices without Android Verified Boot protection and requires physical access to exploit. The CVSS score is 4.8, indicating medium severity.
U-Boot versions prior to 2026.10-rc5 contain a use-after-free vulnerability in the httpc_recv_cb() function of the lwIP wget implementation. This vulnerability arises when HTTP data storage fails, causing the callback to free the connection PCB but return an incorrect error code, leading to access of freed memory and potential bootloader crash. The flaw can cause denial of service by crashing the bootloader but does not impact confidentiality or integrity. A patch is available to address this issue.
U-Boot versions prior to 2026.10-rc5 contain a buffer overflow vulnerability in the nfs_readlink_reply() function when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values, leading to memory corruption and causing the bootloader to crash. This vulnerability has a CVSS score of 8.2, indicating a medium severity impact primarily affecting availability. A patch is available to address this issue.
The npm package @chatunity/baileys versions 3.2.0 and 3.2.1 include a runtime dependency on libsignal from an off-registry GitHub repository without commit SHA or tag pinning. This creates a risk of arbitrary code execution during npm install if the repository content changes or if the repository owner account is compromised, due to the mutable and integrity-unchecked dependency.
CVE-2026-102318 is an out-of-bounds read vulnerability in the WebGL component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to read memory outside the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.7. Google has released an update to address this issue in Chrome version 154.0.8037.92.
CVE-2026-102319 is a vulnerability in Google Chrome prior to version 154.0.8037.92 involving an uninitialized GPU resource. This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a specially crafted HTML page. The vulnerability has a low CVSS score of 3.4 and is rated low severity by the Chromium security team.
Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
An uninitialized resource vulnerability in ANGLE component of Google Chrome on Windows versions prior to 154.0.8037.92 allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. The issue has a medium severity rating with a CVSS score of 4.7. This vulnerability affects Chrome on Windows and is fixed in version 154.0.8037.92.
CVE-2026-102315 is a vulnerability in Google Chrome on Windows prior to version 154.0.8037.92. It involves an uninitialized resource in the Media component that allows a remote attacker, who has already compromised the renderer process, to read memory outside the sandbox via a crafted HTML page. The vulnerability has a low CVSS score of 3.4 and is rated low severity by Chromium. A fix is available in Chrome version 154.0.8037.92.
This update for python-pymongo fixes the following issues:
- CVE-2026-96747: improper handling of key management endpoint values ending in `.sock` allows users with write access
to the encryption key metadata to open connections to local sockets on the application host (bsc#1282844).
- CVE-2026-96748: host injection in connection string leading to database connection redirection due to improper
connection string parsing (bsc#1282827).
- CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside the bounds of
an allocated buffer (bsc#1282845).
Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain against vulnerable iPhones. The fraudulent pages mimic Apple's design and offer a $500 voucher to lure victims, but simply opening the page in Safari triggers an exploitation attempt without requiring user interaction. The attack targets iPhones running unpatched iOS versions, attempting to bypass security protections and deploy a payload designed to steal saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. The exploit leverages vulnerabilities previously disclosed by Google in March 2026 and patched by Apple. If successful, the payload establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.