Capcom notified customers of unauthorized access to CAPCOM ID accounts but their email security configuration is weak. Their official notification emails failed DMARC alignment checks despite passing SPF and DKIM individually. Capcom's DMARC policy is set to 'p=none', which only monitors failures without requesting rejection or quarantine of unauthenticated emails. This lax configuration increases the risk of phishing and spoofing attacks impersonating Capcom. The company uses an external email delivery service but has not properly aligned authentication to prevent spoofing. The notification warns customers about potential misuse of their information but Capcom has not taken stronger email security measures to prevent secondary damage.
CVE-2026-77157 is a vulnerability in Checkmarx's ast-cli tool where downloaded helper binaries were not verified for integrity before execution. This allowed an attacker who could compromise the download server to substitute malicious binaries that would be executed on developer machines or CI pipelines using affected versions. The issue has been fixed by adding SHA-256 checksum verification of the downloaded archives prior to extraction.
Red Hat has issued a critical security update for the grafana-pcp plugin used in Red Hat Enterprise Linux 9.8 Extended Update Support. The update addresses three vulnerabilities: a denial of service via multiple ECH outer extension references (CVE-2026-97031), a denial of service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669), and man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943). These issues affect components of the golang crypto/tls, net/http, and crypto/x509 packages used by the plugin.
CVE-2026-77156 is a path traversal vulnerability in the tar extraction logic of Checkmarx's ast-cli tool on Linux and macOS. It allows malicious tar archives with absolute or traversal paths to write files outside the intended install directory. Windows versions are not affected due to built-in path validation. Exploitation requires compromising the archive download source. The issue is fixed by validating extraction paths to ensure they remain within the working directory.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
CVE-2026-114611 is a critical vulnerability in schorschii OCO-Server versions prior to 1.2.3 involving improper certificate validation in the Apple MDM enrollment endpoint. The vulnerability allows an attacker to forge enrollment requests using arbitrary self-signed certificates, bypassing proper certificate chain validation. This leads to issuance of a valid MDM identity certificate for a victim device, enabling device-record hijacking and impersonation of the victim device in MDM communications. Version 1.2.3 addresses this issue.
PhpSpreadsheet versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 contain a vulnerability in the Ods::processTableRow function. This vulnerability allows an attacker to specify an unbounded number of repeated rows in an ODS spreadsheet file, causing uncontrolled resource consumption. The issue can lead to substantial CPU and memory usage, potentially terminating the PHP worker process. This vulnerability has been fixed in the stated versions.
CVE-2026-93336 is a missing authorization vulnerability in Canonical Juju versions 4.0 through 4.0.15. It allows a controller-authenticated principal, such as a unit agent or a user with only login permission, to read any application's charm resource across any model. This includes sensitive data like container-registry credentials, accessible via a crafted request specifying an arbitrary unit.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
CVE-2026-108360 is an authorization vulnerability in PHPOffice PhpSpreadsheet affecting versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The issue arises when external image URLs are validated only initially, allowing a permitted image host to redirect the server to internal addresses, causing blind GET requests. Although the response body is not exposed to attackers, internal endpoints and cloud metadata services may be accessed. This vulnerability has a medium severity rating with a CVSS score of 6.4 and has been fixed in the specified versions.
CVE-2026-54238 is a vulnerability in Supabase Realtime prior to version 2.103.1 where expired JWT tokens with the exp claim encoded as a JSON string are incorrectly accepted by REST broadcast endpoints. This allows an unauthenticated attacker to broadcast realtime messages to subscribers. The issue is patched in version 2.103.1.
A resource exhaustion vulnerability exists in the py-pdf fpdf2 library versions 2.5.0 through 2.8.7. The issue arises from nested SVG <use> references that cause exponential growth in memory and CPU usage during PDF generation, potentially leading to MemoryError and job failures. This vulnerability is fixed in version 2.8.8.
fpdf2, a Python PDF creation library, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 2.8.8. The shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through various image input methods, potentially causing outbound requests to attacker-chosen services or local file reads if the content is a valid image or SVG. The issue is fixed in version 2.8.8.
Arista Networks patched a critical zero-day vulnerability (CVE-2026-114625) in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw allows authenticated users with basic privileges to escalate to operator-level privileges via low-complexity SQL injection attacks without user interaction. This enables access to internal functionality not intended for remote access, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Hosted VCO deployments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later have been patched. Until patches are applied, Arista recommends restricting VCO web interface access, monitoring for suspicious activity, and blocking known malicious IP addresses involved in ongoing attacks.
CVE-2026-54532 affects CloudPirates Open Source Helm Charts, where a pull_request_target GitHub Actions workflow was vulnerable to cache poisoning and OIDC token theft. The workflow checked out forked code using untrusted references, allowing attacker-controlled code to access repository secrets and tokens. The shared Actions cache could be poisoned by this workflow, enabling malicious code execution in subsequent release or publish workflows. This vulnerability has been patched in commit 271d415.
Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to insufficient randomness in the certificate generation process. This cryptographic weakness allows attackers to derive private keys from public certificates, enabling unauthorized TLS certificate signing and potential man-in-the-middle (MitM) attacks. Major browser and OS vendors have revoked trust in these intermediates, and eMudhra has revoked the eight compromised certificates. Organizations are advised to audit PKI assets, reissue certificates from trusted CAs, enforce strict revocation checking, and update trust stores to mitigate risk. Palo Alto Networks provides solutions and guidance to assist with managing this incident and preventing exploitation.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
CVE-2026-78667 is a denial of service vulnerability in Golang's FileServer(FS), ServeContent, and ServeFile(FS) functions. It occurs when parsing a Range header containing a large number of small ranges, causing excessive CPU consumption and potentially exhausting server resources. This vulnerability affects availability but does not impact confidentiality or integrity. The CVSS score is 7.5 (medium severity).
This analysis from Unit 42 explores the evolving threat landscape targeting OAuth authorization tokens. Attackers increasingly steal OAuth tokens rather than credentials, enabling them to bypass MFA, survive password resets, and maintain persistent access. Key vulnerabilities include Cross-User OAuth Session Fixation, Cross-Tenant Client ID Confusion, and Cross-Connector OAuth Account Takeover, especially in OAuth-as-a-service environments. These attacks allow account takeover, lateral movement, and data exfiltration without triggering traditional credential alerts. Mitigations include disabling end-user app consent for vague apps, enforcing admin-only approval workflows, monitoring authorization code clipboard events, and auditing redirect URIs. OAuth security depends heavily on the identity provider's protections, which vary widely.