🚨 ACTIVE EXPLOITS & INCIDENTS
- CISA orders feds to prioritize patching Langflow auth bypass flaw — BleepingComputer CISA has mandated federal agencies to urgently patch an actively exploited authentication bypass vulnerability in Langflow, a visual AI agent framework. Exploitation enables unauthorized access, increasing risk in AI deployment environments.
- CISA orders feds to patch max severity ColdFusion flaw by Friday — BleepingComputer A critical, actively exploited Adobe ColdFusion vulnerability (CVE-2026-48282, CVSS 10.0) allows arbitrary code execution via path traversal. Federal agencies must patch immediately to prevent remote compromise of web app infrastructure.
- China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware — The Hacker News Chinese APT UAT-7810 is actively evolving its ORB network malware, LONGLEASH, targeting internet-facing networking devices to maintain persistence and expand their relay infrastructure. Cisco Talos links this to ongoing espionage campaigns since mid-2025.
🔓 VULNERABILITIES & CVEs
- Ubiquiti warns of new max severity UniFi OS vulnerability — BleepingComputer Ubiquiti released patches for seven critical UniFi OS flaws, including a max severity command injection vulnerability exploitable remotely. Immediate patching is advised to prevent device takeover and lateral movement in network environments.
- 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros — The Hacker News GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel vulnerability allowing any logged-in user to escalate to root and escape containers without special permissions. It affects virtually all mainstream Linux distros since 2011, requiring urgent kernel updates.
- CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV — The Hacker News CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-48282 (Adobe ColdFusion, CVSS 10.0) and others affecting Joomla and Langflow. These require immediate prioritization in patch management.
📋 VENDOR BULLETINS & ADVISORIES
- Risky Bulletin: DHS IG investigates forced CISA reassignments — Risky Business News DHS Inspector General is investigating forced personnel reassignments within CISA, raising concerns about agency stability amid critical vulnerability response efforts. The bulletin also notes new vulnerabilities impacting Hoymiles solar panel systems, which could be disabled remotely.
🕵️ THREAT RESEARCH & DEEP DIVES
- My Stack Simulator, (Wed, Jul 8th) — SANS ISC A technical primer on stack memory management illustrating how function calls and returns are handled via last-in-first-out (LIFO) stacks. Useful for understanding stack-based exploits and mitigations in memory corruption attacks.