A flaw nicknamed XRING lets about 260 bytes of ordinary HTTP/3 traffic crash a web server that uses XQUIC, Alibaba's open-source QUIC library. There is no login required, no malformed packet, and as of 10 July no CVE and no fix. The only defence today is a config line you set yourself.
Cloudflare will move its signatures to ML-DSA now rather than wait for NIST's nine new candidates. For owners, the trust layer is the slow half of post-quantum.
CISA added Langflow, a popular tool for building AI agents, to its must-patch list after attackers exploited a flaw to steal companies' AI and cloud keys. It is the first AI agent platform the agency has ever flagged, and the fix is upgrade plus key rotation, now.
The FortiBleed campaign sniffed credentials from FortiGate firewalls using FortiOS own diagnostic tool, feeding INC Ransom and Lynx. A patched firewall is not enough.
A maximum-severity Adobe ColdFusion flaw, CVE-2026-48282, was attacked within minutes of the technical write-up going public. US agencies must patch by 10 July, and the servers most at risk are the forgotten ones still running Remote Development Services.
CVE-2026-53359, named Januscape, is a 16-year-old flaw that lets a rented virtual machine break out and seize the physical host it shares with other tenants. Closing it needs two separate patches, not one, and patched Linux kernels only shipped on 4 July.
CVE-2026-8451 turns a Citrix NetScaler configured as a SAML identity provider into a memory leak that hands attackers live session tokens. Citrix patched it on 30 June 2026 and attacks landed within a day. If your remote access runs on NetScaler, patch and rotate sessions now.
CVE-2026-48558 lets an attacker forge a login token and take over SimpleHelp, the remote tool many IT providers use to run your computers. Around 14,000 servers were exposed, it is on the CISA exploited list, and under NIS2 the reporting duty is yours, not the vendor's.
Sysdig documented JADEPUFFER, what it calls the first ransomware campaign an AI agent ran end to end with no human in the loop. It broke in, adapted past a failed login in 31 seconds, encrypted a production database and threw the key away.
Bad Epoll (CVE-2026-46242) hands any local user root on Linux 6.4 and newer, including Android. The fix has been in mainline since April but many distros have not shipped it.
Squidbleed (CVE-2026-47729) is a one-line flaw that let any user of a shared Squid proxy read other people's cleartext HTTP requests, including passwords and session tokens. It hid in default configs for 29 years, and an AI agent found it, not a human audit.
A new attack kit called Avalon hunts your backup servers and deletes Windows shadow copies before its CrownX ransomware encrypts anything. It sat undetected for four months while evading nine major security tools.
Page 3 / 5
One considered note on infrastructure, governance, and measurement, most mornings. No theory.