Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical

🚨 ACTIVE EXPLOITS & INCIDENTS

Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws — The latest Mozilla Firefox update addresses two critical vulnerabilities (CVE-2026-15718, CVE-2026-15719) with publicly available exploit code targeting the JavaScript WebAssembly and DOM navigation components. Immediate patching is advised to mitigate active exploitation risks.
Hack Reveals Suno AI Music Generator Scraped YouTube, Deezer, and Genius — Source code leak exposes how Suno AI illegally scraped decades of music and podcasts from major platforms to train its AI, raising significant intellectual property and data privacy concerns. This may prompt regulatory scrutiny and potential takedown requests.

Tracking Peter Stokes (Scattered Spider) and The Com: Insights from Allison Nixon — Detailed analysis reveals Stokes was identified via Windows GDID in 2023, but arrested only in 2026. The report explores cybercriminal overconfidence and operational security failures that led to his exposure. Valuable for threat intel teams tracking similar threat actors.
Smash and Grab at Scale: Agentic AI Is Reshaping the Threat to Commerce — SOTI Security report highlights how agentic AI is automating large-scale API abuse and fraud in commerce, significantly increasing attack surface and infrastructure costs. Security teams should anticipate AI-driven threat evolution in e-commerce environments.

CVE-2026-46459: Missing Authorization in ICU Scandinavia Boomerang — Critical auth bypass allows unauthenticated remote attackers to read full facility configurations. Immediate mitigation recommended for affected device endpoints.
CVE-2026-46458: Credential Exposure in ICU Scandinavia Boomerang — Sensitive credential files exposed via static HTTP, enabling unauthenticated remote retrieval. Urgent patching or network controls required to prevent credential compromise.
CVE-2026-15779: Samba pam_winbind mkhomedir Chown Critical System Paths — Vulnerability allows privilege escalation by changing ownership of critical system directories due to lack of path validation. High risk for Linux environments using pam_winbind with mkhomedir enabled.
CVE-2026-15809: CRI-O /etc/passwd Injection Bypass — Fix for CVE-2022-4318 was bypassable, allowing attackers with container environment control to inject into /etc/passwd, risking container breakout. Patch CRI-O installations immediately.
Multiple permission control and out-of-bounds read vulnerabilities (CVE-2026-58549 through CVE-2026-58559) affecting vibration services, Bluetooth, file system, settings, card modules, and image codec components have been disclosed. These impact confidentiality and availability and require review of vendor patches and mitigations.

Metacurity Highlights: US Indicts Russians Linked to Bulletproof Hosting + $10M Reward, Microsoft Patches 570 Flaws — Key updates include US DOJ actions against sanctioned bulletproof hosters, record Microsoft patch batch including two exploited zero-days, White House AI vulnerability-sharing hub launch, and multiple international cybercrime takedowns. Essential situational awareness for global threat landscape.
A New Definition of Hyperscale — While not directly a vulnerability, this blog outlines evolving cloud infrastructure trends that may influence future security architectures and scaling strategies.