Google announced Gemini 4 Carbon, an advanced AI model designed to find, exploit, and fix software vulnerabilities more effectively than previous models. It scored highly on multiple cybersecurity benchmarks and is initially available to vetted cyber defenders through Google's Fairwind Program. The model aims to assist defenders in prioritizing vulnerability remediation by assessing exploitability. It outperforms earlier models in secure code generation and patch quality, with improved safety against prompt injection attacks. The model is not yet broadly available and is undergoing further guardrail development before wider release.
The security of US elections is challenged by unpatched voting machines, unverifiable QR-coded ballots, and AI-driven influence campaigns. Voting machines certified by the Election Assistance Commission (EAC) may remain unpatched for years, increasing the risk of compromise. The air-gapped nature of these machines offers some protection but can be bypassed with physical access. Ballots include human-readable and QR code elements, but voters cannot verify the QR code data scanned for counting, raising trust issues. Influence campaigns aim to undermine public confidence in election outcomes. Experts recommend treating voting machines as part of a broader hostile system and improving transparency and verification methods.
The black-spindle-2 npm package contains malicious code in its postinstall script. This script executes automatically upon installation and makes an HTTP request to an anonymous ngrok-free.app URL, embedding shell command substitution. This behavior can confirm installation on the host and potentially exfiltrate environment or host data. The package's main code is an empty stub, indicating the postinstall script is the primary malicious component.
The poc-revshell package version 0.1.0 on PyPI contains a reverse-shell backdoor that activates both during installation and import. It opens a TCP connection to localhost on port 4444, providing an interactive shell to any local listener. This backdoor runs with the installing user's privileges and is confined to local attackers on the same host.
A malicious npm package named spectral-core impersonates a legitimate project and executes code during installation to steal sensitive environment variables and AWS EC2 metadata. It collects CI/CD secrets, cloud credentials, network reconnaissance data, and sends this information to a hardcoded external server. The package contains no functional library code and uses a binding.gyp file solely to run the malicious script at install time.
The npm package @dmangal/curse-dependent-ecto contains malicious code embedded in its binding.gyp file. During installation, it executes a node script that searches for files containing the marker 'HTB{' and reads sensitive files and environment variables. It then exfiltrates this data, including CI secrets and API tokens, to an attacker-controlled endpoint. The package uses an implausibly high version number consistent with a dependency confusion attack. Installing this package in developer or CI environments risks leaking confidential information to attackers.
CVE-2026-42691 is an authorization bypass vulnerability in EventPrime Event Calendar Management versions up to 4.3.6.0. It allows privilege abuse through a user-controlled key, potentially enabling unauthorized actions. The issue is fixed in version 4.3.6.1.
CVE-2026-54852 is a missing authorization vulnerability in the miniOrange Page Restriction WordPress plugin affecting versions prior to 1.6.2. The flaw allows bypassing access control restrictions due to incorrectly configured security levels. This could enable unauthorized users to access restricted pages or posts. The issue has a medium severity with a CVSS score of 5.3 and impacts confidentiality but not integrity or availability. A fix is available in version 1.6.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.
CVE-2026-27062 is a Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels versions prior to 3.13.6. This flaw allows an attacker to trick an authenticated user into performing unwanted actions on the WPFunnels application. The vulnerability has a medium severity score of 4.3 and was fixed in version 3.13.6.
CVE-2026-114706 is a stored cross-site scripting (XSS) vulnerability in the WP Chill Strong Testimonials plugin affecting versions from initial release up to 3.3.15. The flaw allows improper neutralization of input during web page generation, which could enable an attacker with low privileges to execute malicious scripts in the context of other users. This vulnerability has been fixed in version 3.3.16.
CVE-2026-27063 is a missing authorization vulnerability in Kit (formerly ConvertKit) versions prior to 3.4.8. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating limited impact on confidentiality and no impact on integrity or availability. A fix is available in version 3.4.8.
CVE-2026-115601 is a missing authorization vulnerability in the WP Desk Custom Price for WooCommerce plugin versions prior to 1.1.30. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized modification of pricing data. The issue is fixed in version 1.1.30.
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.