CVE-2026-62073 is a high-severity vulnerability in the WP Full Stripe Free plugin by Themeisle. It involves missing authorization controls in versions up to 8.5.6, allowing unauthenticated users to perform actions that should require authorization. The vulnerability does not impact confidentiality or availability but can lead to integrity violations. No patch or remediation information is currently provided.
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.
A PwC survey reveals that many enterprises are unprepared for emerging AI and quantum computing threats. Only 22% of leaders are willing to deploy fully autonomous AI for cyber defense, and just 21% are implementing quantum-resistant cryptography. Key AI-related threats include attacks on AI systems such as autonomous botnets, adversarial attacks, and prompt injection, which is recognized as a significant risk. Quantum computing poses a future risk to current encryption methods, with attackers potentially harvesting encrypted data now to decrypt later. Despite available technologies to strengthen cybersecurity, adoption remains low globally, highlighting a gap between technological capability and implementation.
This content is an interview-style article profiling Rob Juncker, chief product and technology officer at Mimecast, discussing his early experiences with hacking, social engineering, and his eventual transition to a cybersecurity career. It recounts his youthful hacking activities, including self-taught programming, social engineering to obtain a phone line, and early software cracking attempts, followed by a legal warning that prompted a change in direction. The article emphasizes his perspective on hacking as a form of curiosity and creativity and his advocacy for ethical use of hacking skills in cybersecurity leadership.
An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. [...]
CVE-2024-58388 is a high-severity path traversal vulnerability affecting multiple Sharp Corporation multifunction printers. It allows unauthenticated remote attackers to read arbitrary files on the device by manipulating the 'path' parameter in the installed_emanual_down.html endpoint. This can lead to exposure of sensitive system files such as /etc/passwd and credential-containing coredump files. The vulnerability was publicly observed in exploitation attempts as of July 30, 2024.
KillSec was a ransomware group active since around 2024, responsible for roughly 1,000 suspected attacks worldwide. The group used software vulnerabilities and weakly protected entry points, especially cloud storage, to steal sensitive data from victims. Police have shut down KillSec's leak site, seized at least 110 terabytes of stolen data, and arrested several alleged members, including a 16-year-old suspected leader. The group's infrastructure, including five core servers, was taken over by law enforcement, and its domains now redirect to seizure notices. The investigation is ongoing with international cooperation and support from cybersecurity firms.
CVE-2026-102505 is a medium severity vulnerability in Imager versions before 1.037 for Perl. It involves an incorrect calculation of buffer size when fetching float samples from a paletted image, leading to a heap buffer overflow. Specifically, requesting more than one channel causes writes past the allocated buffer end, controlled by attacker-supplied image palette data.
CVE-2026-102504 affects Imager for Perl versions before 1.037. The vulnerability arises from improper handling of the raw_datachannels value in the i_readraw_wiol function, which lacks range checking. This can cause the program to request an excessive memory allocation, leading to process termination via an uncatchable exit call when allocation fails.
boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.
Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued. [...]
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.
Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. [...]
CVE-2026-103686 is a cross-site scripting (XSS) vulnerability in the rhukster dom-sanitizer component, specifically in the DOMSanitizer::isDangerousUrl function within src/DOMSanitizer.php. This flaw affects versions up to and including 1.0.15 and allows remote attackers to execute malicious scripts. The vulnerability has a medium severity score of 5.1. An exploit has been published but no known widespread exploitation is reported. Upgrading to version 1.0.16 addresses this issue.
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim.
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers.
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks.
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active session.