VulnHub

The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability, identified as CVE-2026-63077, related to JetBrains TeamCity to its Known Exploited Vulnerabilities Catalog. This vulnerability involves the deserialization of untrusted data, which has been a common method for cybercriminals to exploit systems. The risk is particularly significant for federal agencies, as CISA's guidance emphasizes the need for rapid remediation of such vulnerabilities. While this directive primarily targets Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based strategies for managing vulnerabilities. The agency will continue to update the catalog with new vulnerabilities that show evidence of active exploitation, and organizations are invited to report any known exploited vulnerabilities that are not yet listed.

A serious vulnerability has been discovered in Gitea, the self-hosted Git service, that allows unauthenticated attackers to read any file that the service account can access. This flaw affects versions 1.22.1 through 1.27.0, requiring only a public repository and some specially crafted Org-mode markup to exploit. The vulnerability, tracked as CVE-2026-59774, has been rated Critical with a CVSS score of 9.8, indicating a severe risk. Users of affected Gitea versions should update to version 1.27.1 or later to secure their systems against this issue, as the flaw poses a significant risk of data exposure without needing any login credentials.

The Swiss Federal IT Agency, known as FOITT, has reported a security incident where attackers exploited vulnerabilities in SharePoint to compromise around 200 user accounts. The agency has not publicly identified the attackers but is currently investigating the breach. As part of the response, FOITT is in the process of rebuilding its affected servers to restore functionality and secure the environment. This incident raises concerns about the security of on-premises software and the potential for sensitive information to be exposed. The situation underscores the need for organizations to regularly update and secure their software to prevent similar attacks in the future.

The phishing-as-a-service toolkit known as Greatness has added a new feature that allows attackers to use device code phishing to bypass Multi-Factor Authentication (MFA). This technique exploits the OAuth 2.0 Device Authorization Grant, a legitimate protocol, to gain unauthorized access to user accounts. By doing so, attackers can steal authentication tokens and control user accounts without needing to compromise passwords directly. This development is concerning as it poses risks to a wide range of applications and services that rely on MFA for security, making it easier for cybercriminals to execute their plans. Organizations and users must be vigilant and update their security practices to mitigate the risks associated with this evolving threat.

A serious vulnerability in cPanel, tracked as CVE-2026-58048, has been discovered, allowing authenticated users to execute SQL commands with root privileges. This flaw, which has a CVSS score of 9.4, poses a significant risk to shared hosting environments where multiple users have access. Essentially, if you're running a shared hosting box, this bug could enable an ordinary user to gain full database administrator access, potentially compromising sensitive data. cPanel has issued patches to address this issue, and users are strongly advised to update their systems immediately to prevent exploitation. Given the nature of shared hosting, the implications of this vulnerability could be far-reaching, affecting not just individual sites but the entire server.

A serious vulnerability has been identified in several Thermo Fisher Applied Biosystems Genetic Analyzers, which could allow attackers to tamper with DNA data by modifying output files. This flaw affects multiple versions of their software, including the 3500 Series, 3730 Series, SeqStudio, and GeneMapper ID-X, among others. The risk is significant because altered DNA test results could lead to incorrect diagnoses and treatments in healthcare settings. To mitigate the issue, Thermo Fisher has released security updates that implement digital signatures to ensure data integrity. Users are advised to update their software to the latest versions as soon as possible and to follow interim measures to secure their data until the updates can be applied.

Acrisure's KARR BT and DR-100 vehicle security systems have a serious vulnerability that could allow attackers to control vehicles remotely. The issue stems from a hard-coded Bluetooth authentication key shared among affected devices, which could let someone within range unlock doors or disable the engine. This affects all KARR BT firmware versions before July 20, 2026, and DR-100 firmware versions before the same date. While no public exploitation of this vulnerability has been reported yet, users are urged to update their devices to mitigate the risk. A firmware update has been released on July 20, 2026, to address this flaw, and users can find detailed instructions for the update on the KARR Security website.

cPanel has addressed a serious vulnerability that allowed authenticated users to execute SQL commands with root database privileges. This flaw, tracked as CVE-2026-58048 and rated 9.4 on the CVSS scale, breaks the security boundary between individual cPanel accounts and the server's administrative database identity. The issue was fixed in a recent security update, which also addressed two other privilege escalation paths. Hosting customers who use cPanel should be aware of this vulnerability, as it could have allowed unauthorized access to sensitive data or manipulation of critical database functions. It's crucial for users to ensure they are using the latest version of cPanel to mitigate any potential risks associated with this flaw.

N-able reported that attackers exploited an authentication bypass vulnerability in its N-central platform, allowing unauthorized remote administrative access to customer systems. This issue, tracked as CVE-2026-18577, affects all N-central builds prior to version 2026.3.1.7. The initial fix released by N-able was incomplete, leading to successful exploitation of the flaw. The company released the first unaffected version on August 2, 2023, which highlights the critical need for users to ensure they are running the latest version to protect their systems. Organizations using N-central should take immediate action to update to version 2026.3.1.7 or later to mitigate the risk of these attacks.

Ruby on Rails has addressed a serious vulnerability in its Active Storage component, identified as CVE-2026-66066. This issue could allow unauthenticated attackers to read arbitrary files from servers running vulnerable applications, posing a significant risk of remote code execution. The vulnerability has a high severity rating, with a CVSS score of 9.5, meaning that it could be exploited easily if not patched. Applications that generate image variants are particularly at risk, as they may inadvertently expose sensitive files. Developers using Ruby on Rails should ensure they update their applications to mitigate this risk and protect sensitive data.

A serious vulnerability has been discovered in the Active Storage framework used by Ruby on Rails applications. This flaw allows unauthenticated attackers to access arbitrary files from a Rails app, which could lead to remote code execution (RCE). Developers using affected versions of Rails should prioritize applying patches to safeguard their applications. The vulnerability raises significant concerns as it could allow attackers to exploit improperly secured file storage, potentially compromising sensitive data or executing malicious code. It’s crucial for developers to stay vigilant and update their systems promptly to prevent exploitation.

A Chinese-speaking hacker has been using DeepSeek's AI models to carry out cyber-attacks aimed at organizations across Asia. This threat actor is leveraging advanced artificial intelligence to exploit vulnerabilities in various systems, raising concerns about the effectiveness of current cybersecurity measures. The attacks could potentially impact sensitive data and operations within targeted organizations, making it crucial for them to enhance their security protocols. As these AI-driven tactics evolve, companies need to stay vigilant and update their defenses against such sophisticated methods. The use of AI in cybercrime signals a new wave of challenges for cybersecurity professionals.

JetBrains has issued a warning about a serious vulnerability in TeamCity On-Premises that allows attackers to bypass authentication and potentially execute remote code. This flaw poses a significant risk, as it can be exploited without needing valid credentials, making it easier for malicious actors to gain control over affected systems. Users of TeamCity, particularly those running on-premises installations, should take this warning seriously to protect their environments from unauthorized access. The company has urged users to update to the latest version to mitigate the risk associated with this vulnerability. Immediate action is necessary to prevent potential breaches and safeguard sensitive data.