🕵️ RESEARCH & DEEP DIVES
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites — BleepingComputer
Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow? — SecurityWeek
“We Think the Security Control Is Working” Is No Longer Good Enough — SecurityWeek
AI Agent Platform Reinvents Spam, Floods Inboxes Worldwide — 404 Media
Microsoft Issues Emergency Fixes After Massive Patch Tuesday — Dark Reading
Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident — Dark Reading
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens — The Hacker News
What’s next for CISA’s CDM program that gives cybersecurity tools to federal agencies — CyberScoop
IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUp... — CVE ThreatInt
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote... — CVE ThreatInt
Netmaker has a boolean‐based SQL InjectionNetmaker makes networks with WireGu... — CVE ThreatInt
libp2p-quic: Remote panic via certificate expiry race during QUIC handshakeli... — CVE ThreatInt
Go-getter vulnerable to a privilege escalation issue in its archive decompres... — CVE ThreatInt
Out-of-bounds read in IMAP response parserA malicious or compromised IMAP ser... — CVE ThreatInt
Buffer overrun in IMAPA maliciously constructed IMAP line could cause an out-... — CVE ThreatInt
Ambiguous parsing of mail headersA maliciously constructed mail header could ... — CVE ThreatInt
OpenCTI: Synchronizer SSRF: stream fetch has no URL validationOpenCTI is an o... — CVE ThreatInt
OpenCTI: User-Controlled ReDoS in JSON Ingestion MapperOpenCTI is an open sou... — CVE ThreatInt
Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTI... — CVE ThreatInt
On affected platforms running Arista EOS with authenticated Bidirectional For... — CVE ThreatInt
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object refe... — CVE ThreatInt
Http4s: DigestAuth allows replay of captured requestsHttp4s is a Scala interf... — CVE ThreatInt
Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Au... — CVE ThreatInt
Http4s Ember HTTP/2: unbounded inbound body bufferingHttp4s is a Scala interf... — CVE ThreatInt
Unauthenticated Information Disclosure in HPE Networking EdgeConnect SD-WAN G... — CVE ThreatInt
Unauthenticated Information Disclosure in EdgeConnect SD-WAN Orchestrator API... — CVE ThreatInt
Authenticated Buffer Overflow Vulnerability in an API Endpoint Leads to Remot... — CVE ThreatInt
Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect ... — CVE ThreatInt
Architecting resilient authentication with Amazon Cognito multi-Region replication — AWS Security Blog
DOJ seeking reporter’s LinkedIn records in secretive First Amendment court fight. — @zackwhittaker@mastodon.social
MitraStar GPT-2742GX4X5v6-SV Authenticated RCE — thehackerwire.com (discovered)
A Backdoor Hides in Joomla's Scheduled Tasks Table — mysites.guru (discovered)
Five New Checks for WordPress Hacks a File Scan Cannot See — mysites.guru (discovered)
Cybersecurity has an AI doomer problem https://www. — @malwaretech@infosec.exchange