Latest cyber news, threats, security, and guidelines. Stack up.
Wed 22 Jul
Check Point SmartConsole Improper Authentication Vulnerability. Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Tue 21 Jul
DD-WRT Stack-Based Buffer Overflow Vulnerability. DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Tue 21 Jul
Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability. Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Tue 21 Jul
WordPress Core Interpretation Conflict Vulnerability. WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Tue 21 Jul
WordPress Core SQL Injection Vulnerability. WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Thu 16 Jul
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability. Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Wed 15 Jul
CVE-2026-59762
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NF5 CNA advisory K000162231 (NVD published 15 July 2026) says that when an HTTP/2 profile is configured on a virtual server, undisclosed requests can raise TMM memory until the process restarts. That is a data-plane denial of service; F5 says there is no control-plane exposure. F5 scores it 8.7 (CVSS 4.0) and 7.5 (CVSS 3.1). Affected classic BIG-IP: 21.1.0 before 21.1.0.1, 21.0.0 before 21.0.0.3, 17.5.0 before 17.5.1.8, 17.1.0 before 17.1.3.4. Also BIG-IP Next for Kubernetes 2.3 before 2.3.2 and 2.0 before 2.2.3, Next CNF 2.3 before 2.3.2 / 2.0 before 2.2.3 / 1.1 before 1.4.3, and Next SPK 1.7 before 1.7.18 (NVD also lists Next SPK 1.9.0 as affected with no upper bound). Not in CISA KEV at last check. The NVD record does not state in-the-wild exploitation.
Tue 14 Jul
Horizon3 published on 1 September 2026 that Defused Cyber honeypots saw valid in-the-wild exploitation of CVE-2026-9586 on 30 August 2026 (attacker IP 176.65.148.184 in the published honeypot traffic). The flaw is an unauthenticated SQL injection in Sangoma Switchvox SMB Edition: the /pa PhoneAppsHandler.pm endpoint concatenates the PhoneIP field from an XML body into a PostgreSQL query, which Horizon3 says can be turned into remote code execution as the database superuser. Sangoma released Switchvox 8.4.0.2 on 14 July 2026. Horizon3 reported the issues in April; Security Risk Advisors independently reported them in May and published on 17 July. GitHub CVE advisory (17 July) rates it Critical 9.3. The CNA record cites Switchvox SMB Edition 8.3 (build 104997); Horizon3 notes Sangoma 8.4.0.2 release notes also mention 8.2.2.1 — upgrade to 8.4.0.2 rather than assuming an older build is safe. Horizon3 cites about 4,000 internet-exposed Switchvox devices on Shodan, mostly in the United States. CISA added CVE-2026-9586 to the KEV catalog on 2 September 2026. Restrict /pa to trusted phone networks until patched. IoC path if SSH is available: /var/log/switchvox/db-quirks.log.
Thu 9 Jul
OpenAI launched GPT-5.6 for general availability on 9 July 2026: Sol (flagship), Terra (balanced), and Luna (cost-efficient), across ChatGPT, Codex, and the API. The company describes layered safeguards for biology and cybersecurity, with extra defensive capability behind a verified Trusted Access programme. A 21 August 2026 update on the same page cut GPT-5.6 Sol API and credit pricing by over 20 percent for three months.
Wed 8 Jul
CVE-2026-57023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HJuniper's 8 July 2026 security bulletin (JSA110083): an improper validation issue in the TCP proxy plugin of Junos OS on SRX Series and MX Series with SPC3 lets an unauthenticated, network-based attacker cause a complete denial of service. When TCP proxy is in use (ALGs, Advanced Anti-Malware, ICAP or UTM), a TCP packet with a specifically malformed header crashes flowd, causing a full service outage until the process restarts. CVSS 3.1 is 7.5; CVSS 4.0 is 8.7. Affected: 23.4 before 23.4R2-S7, 24.2 before 24.2R2-S4, 24.4 before 24.4R2-S3, 25.2 before 25.2R2. Not before 23.4R1. Juniper SIRT says it is not aware of malicious exploitation; the issue was seen during production usage. No workaround. This was part of Juniper's 8 July 2026 bulletin round (Canadian Centre for Cyber Security AV26-675).
Thu 25 Jun
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVE-2026-62253)CVE records were published on 7 October 2026 for three flaws in Homer, the open-source SIP and VoIP capture and troubleshooting platform from the SIPCAPTURE project, used by carriers and VoIP operators. The project fixed them in Homer 11.0.283 and published GitHub security advisories on 25 June 2026. CVE-2026-62253 (GHSA-rqcc-94gv-wjm9, CVSS 3.1 9.8): both JWT middleware functions let a request through when the JWT secret is empty, and the secret defaults to empty, so on a default install all protected API endpoints under /api/v1, /api/v3 and /api/v4 need no login. CVE-2026-62252 (GHSA-6xp5-7rcx-xfgx, 9.8): fresh deployments using internal authentication create an admin account with the password 'sipcapture' and never force a change, so anyone who reaches the login page gets full admin access. CVE-2026-62251 (GHSA-f46q-3v67-fmm4, 8.1): any authenticated user can send raw SQL to DuckDB through the v4 statistics query endpoint and read or change everything reachable through the FlightSQL service. Homer stores captured call signalling, which includes phone numbers and call metadata. No exploitation has been reported. (sources: SIPCAPTURE GitHub security advisories; CVE records)
Wed 24 Jun
Updated Tue 27 Oct
Aesto Health (Birmingham, Alabama), which provides healthcare data migration and archiving for covered-entity clients, posted a notice dated 24 June 2026: it discovered a network security incident on or about 18 December 2025 affecting a limited portion of its Amazon Web Services infrastructure. On 26 May 2026 the investigation determined that PII and PHI belonging to patients of various clients may have been accessed or acquired between about 2 and 18 December 2025, including names, dates of birth, medical information, driver's licence numbers, financial account numbers, health insurance information, taxpayer identification numbers, other government IDs, and Social Security numbers (elements varied; SSNs for a limited number of people). The company says it has no evidence of identity theft or financial fraud tied to the incident. No Australia link is reported. Updated 1 Sep 2026 (BleepingComputer): BleepingComputer reports that in a report to the US Department of Health and Human Services, Aesto Health said the breach affects 9,540,683 individuals, and that Aesto began notifying affected people on 21 August. (source: BleepingComputer) Correction (27 Oct 2026): the card date has moved from 31 August to 24 June 2026, the date on Aesto's notice; the SecurityWeek link, the HHS listing date and a count of affected provider clients that only SecurityWeek gave have been removed, and the 9,540,683 figure is now credited to BleepingComputer. (source: BleepingComputer)