threat-intel GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents Researchers at Wiz discovered a vulnerability (GhostApproval) in six AI coding assistants – Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf – that allows malicious repositor… The Hacker News · Jul 9, 2026 High CVE-2026-12957symlinkaicode injection
threat-intel ISC Stormcast For Thursday, July 9th, 2026 https://isc.sans.edu/podcastdetail/10000, (Thu, Jul 9th) The ISC Stormcast highlighted a significant increase in malicious email campaigns targeting financial institutions, leveraging a newly discovered phishing technique that bypasses traditional email security filters. The c… SANS Internet Storm Center · Jul 9, 2026 Critical USphishingzero-dayransomware
vulnerability Multiples vulnérabilités dans Traefik (09 juillet 2026) Multiple vulnerabilities have been discovered in Traefik, allowing an attacker to bypass security policies. These vulnerabilities affect older versions of the popular reverse proxy and load balancer, requiring immediate… CERT-FR · Jul 9, 2026 Medium CVE-2026-65601CVE-2026-65602traefikvulnerabilitysecurity
vulnerability Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS Ubiquiti Networks has released security updates to address a series of critical vulnerabilities affecting its UniFi network management products, including UniFi Connect, Talk, Access, Protect, and OS. These flaws could a… The Hacker News · Jul 8, 2026 High CVE-2026-50746CVE-2026-50747CVE-2026-50748UNRUvulnerabilitynetwork securitycommand injection
vulnerability Google Dialogflow CX Bug Allowed Attackers to Hijack AI Conversations A vulnerability in Google Cloud’s Dialogflow CX service allowed attackers to silently control agents, manipulate conversations, and exfiltrate sensitive information. The flaw stemmed from a permissive configuration withi… SecurityWeek · Jul 8, 2026 High aicloudpython
threat-intel GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures A vulnerability has been discovered in GitHub's signature verification process. Attackers can rewrite signed Git commits, creating new commits with the same content but a different hash, while still appearing as "Verifie… The Hacker News · Jul 8, 2026 High gitsignaturevulnerability
threat-intel Cybersecurity and the Gap Between Skill and Ability A joint statement from the Five Eyes intelligence alliance warned of escalating cyber risks due to the increasing capabilities of AI models, particularly their ability to autonomously carry out cyberattacks. The statemen… Schneier on Security · Jul 8, 2026 High UNCAAUaicybersecuritythreat intelligence
threat-intel CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws The CISA has issued an urgent warning to federal agencies and all organizations regarding several actively exploited vulnerabilities in Adobe ColdFusion, Langflow, Joomla extensions, and CitrixBleed. These flaws, includi… SecurityWeek · Jul 8, 2026 Critical CVE-2026-48282CVE-2026-55255CVE-2026-33017vulnerabilityexploitationpatch
threat-intel Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection A critical vulnerability, dubbed GitLost, has been identified in GitHub Agentic Workflows, allowing unauthenticated attackers to potentially leak private repository data by injecting prompts into public GitHub Issues. Th… SecurityWeek · Jul 8, 2026 Critical prompt injectionai securityagentic ai
threat-intel CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four actively exploited vulnerabilities to its KEV catalog, including flaws in Adobe ColdFusion, JoomShaper SP Page Builder, and Langflow. These… The Hacker News · Jul 8, 2026 High CVE-2026-48282CVE-2026-56290CVE-2026-55255INvulnerabilityrceidror
threat-intel ISC Stormcast For Wednesday, July 8th, 2026 https://isc.sans.edu/podcastdetail/9998, (Wed, Jul 8th) The SANS Internet Storm Center’s latest Stormcast highlighted a significant increase in malicious activity targeting industrial control systems (ICS) and operational technology (OT) environments. Specifically, the report… SANS Internet Storm Center · Jul 8, 2026 High icsotvulnerability
threat-intel Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft Google has patched a critical vulnerability in its Dialogflow CX AI chatbot platform, dubbed 'Rogue Agent,' which could have allowed attackers to steal data from AI agents. The flaw stemmed from a permission boundary iss… Dark Reading · Jul 7, 2026 High aichatbotcodeblocks
threat-intel Critical Gitea Flaw Under Active Exploitation, Researchers Warn A critical vulnerability in Gitea’s reverse-proxy authentication mechanism is being actively exploited, allowing attackers to bypass authentication and gain unauthorized access to Gitea instances. The flaw, tracked as CV… SecurityWeek · Jul 7, 2026 Critical CVE-2026-20896vulnerabilityauthenticationgit
vulnerability Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots A critical vulnerability, dubbed ‘Rogue Agent,’ within Google's Dialogflow CX platform allowed a malicious insider or compromised developer account to compromise multiple chatbot agents within the same Google Cloud proje… The Hacker News · Jul 7, 2026 High dialogflowcodeblockscloud run
data-breach Major Japanese telco says cyberattack exposed 12 million emails KDDI, a major Japanese telecommunications company, disclosed that a cyberattack exposed the email addresses and passwords of over 12 million customers due to a vulnerability in third-party software. The breach impacted a… The Record · Jul 7, 2026 Medium JPdata breachpasswordvulnerability
threat-intel Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data Researchers at Noma Security discovered a vulnerability, dubbed ‘GitLost,’ in GitHub Agentic Workflows that allows attackers to trick AI agents into leaking private repository content simply by posting a malicious issue… The Hacker News · Jul 7, 2026 High prompt injectionai agentgithub
threat-intel Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants A critical session isolation vulnerability, dubbed WriteOut, has been discovered in Writer, an AI platform, allowing attackers to steal session tokens and gain control of user accounts across multiple organizations. The… The Hacker News · Jul 7, 2026 Critical session-hijackingtenant-isolationai
threat-intel CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws The US Cybersecurity and Infrastructure Security Agency (CISA) is leveraging Anthropic’s AI model, Mythos, to proactively scan federal government software for security vulnerabilities. This initiative is part of a broade… SecurityWeek · Jul 7, 2026 Medium USaiintelligencevulnerability
vulnerability Critical Adobe ColdFusion Vulnerability Exploited in Attacks A critical vulnerability in Adobe ColdFusion, tracked as CVE-2026-48282, has been actively exploited by threat actors shortly after its public disclosure. Adobe released a patch on June 30th, but attackers were observed… SecurityWeek · Jul 7, 2026 Critical CVE-2026-48282vulnerabilitypath traversalcode execution
threat-intel Labcenter Proteus 9 CISA has issued an advisory regarding critical vulnerabilities in Labcenter Proteus 9, a software used in critical infrastructure sectors such as communications, defense industrial base, and energy. These vulnerabilities… CISA Advisories · Jul 7, 2026 High CVE-2026-42953CVE-2026-49033CVE-2026-42958vulnerabilityremote code executioncritical infrastructure
