🕵️ RESEARCH & DEEP DIVES
- UAE, Saudi Arabia absorb half of Gulf-region cyberattacks amid surge in complex intrusions
Positive Technologies found the UAE and Saudi Arabia absorbed 50% of Gulf-region cyberattacks in H1 2026, with attackers shifting from visible DDoS to stealthy targeted intrusions.- UAE (35%) and Saudi Arabia (15%) together accounted for 50% of Gulf-region cyberattacks in H1 2026; UAE, Iran, and Saudi Arabia made up 67% of attacks found via open-source intelligence.
- Organizations in the UAE and Saudi Arabia faced nearly 2,700 attacks per week versus a global average of about 2,300, per Check Point data.
- Vulnerability exploitation was the top initial access vector (38% of attacks); information-disclosure exploits hit 62% of affected organizations, with remote code execution and authentication bypass also common.
- Government targets saw 27% of attacks and cross-sector attacks 23%; 58% of attacks caused business disruption.
- Simple attacks like DDoS and defacements have declined, replaced by stealthy intrusions into critical infrastructure, with AI-assisted scanning and malware generation accelerating attacks.
📋 ADVISORIES
Adobe Patches Nine Critical Flaws in Connect and AEM Forms
Adobe has released patches for 36 vulnerabilities, including nine critical flaws in Connect and AEM Forms that could allow arbitrary code execution and privilege escalation.- Applies to users of Adobe Connect and Adobe Experience Manager (AEM) Forms; both updates rated Priority 2 (patch within 30 days).
- Adobe Connect update fixes nine defects, six critical: SQL injection, XSS, and improper input validation flaws (CVE-2026-75682, -75684, -75686, -75689, -75697, -75698) enabling arbitrary code execution and privilege escalation.
- Connect update also addresses high-severity path traversal, improper certificate validation, and XSS issues leading to arbitrary file read, security feature bypass, and code execution.
- AEM Forms update fixes six vulnerabilities, three critical: incorrect authorization, improper input validation, and SSRF (CVE-2026-75745, CVE-2026-81995, CVE-2026-82000) leading to code execution and privilege escalation.
- Adobe also patched high/medium-severity bugs in InDesign, Content Credentials SDK, Bridge, Substance 3D Modeler, and Premiere Pro; no exploitation in the wild reported.
Chrome 154 Update Patches 108 Vulnerabilities, Including 11 Critical Bugs
Google has released Chrome 154 with patches for 108 vulnerabilities, including 11 critical-severity flaws.- Applies to Chrome users on Windows, macOS, and Linux; update rolls out as 154.0.8037.57/.58 for Windows/macOS and 154.0.8037.57 for Linux.
- Critical flaws include buffer overflows in ANGLE and WebGL, out-of-bounds writes in GPU and WebGL, and use-after-free bugs in ServiceWorker, Fullscreen, WindowDialog, and AdFilter.
- 25 high-severity bugs were also fixed, including a dozen use-after-free defects plus type confusion, uninitialized resource, and buffer overflow issues.
- 32 flaws were reported externally; Google paid $18,000 in bug bounties so far, with more payouts pending.
- Google says none of the vulnerabilities are known to be exploited in the wild.
NVIDIA patches 14 flaws in Infrastructure Controller for Linux, including critical hard-coded credentials
NVIDIA has released a security update fixing 14 vulnerabilities in Infrastructure Controller for Linux versions 0 through 1.9.- Affects NVIDIA Infrastructure Controller for Linux versions 0 through 1.9; users should update to version 2.0 or later.
- Most critical is CVE-2026-65113 (CVSS 9.8), hard-coded credentials allowing remote unauthenticated attackers to gain elevated privileges, manipulate data, cause denial of service, or disclose information.
- Other flaws include SQL injection (CVE-2026-65128, CVSS 8.8), missing authentication (CVE-2026-65114, 8.3), improper authentication (CVE-2026-65121, 8.2), OS command injection (CVE-2026-65130, 8.0), and improper certificate validation (CVE-2026-65118, 7.5).
- Medium-severity issues include two uncontrolled resource consumption flaws enabling authenticated denial-of-service, XML injection, external file path control, hard-coded password use, and exposure of sensitive information via uncleared debug data (CVE-2026-65127, CVSS 4.1).
Sources 📄 Source: nvidia.custhelp.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)EasyStore 3.0.1 fixes seven security flaws found in 3.0.0 on release day
JoomShaper's EasyStore 3.0.1 fixes seven vulnerabilities mySites.guru found in 3.0.0, including an unauthenticated customer address lookup.- Affects JoomShaper's EasyStore ecommerce extension for Joomla; all versions below 3.0.1, Free and Pro, including older 2.x like 2.0.1, are exposed
- Worst flaw: guest checkout lookup (task=checkout.searchGuestUser) returned any guest customer's name, address and phone number to any visitor supplying their email — no login needed
- Two SQL injections (media image deletion, coupon bulk update) exploitable via an administrator session
- Admin API lacks CSRF protection, and a configuration update rewrites the site's mail sender with no token check; allowEdit() always returns true
- Reviews CSRF check was commented out, letting hostile pages post reviews in logged-in customers' names; provisional CVSS 4.0 scores range 8.7 High to 5.1 Medium with seven reserved CVE IDs
🔓 CVEs & KEV
CVE-2026-95626 — tauri — CVSS 8.3 — Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes ...
CVE-2026-96454 — tw93 Pake — CVSS 8.2 — Pake grants unrestricted IPC access to every HTTPS origin loaded in generated...
CVE-2026-95627 — Tauri tauri-plugin-dialog — CVSS 7.7 — Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attac...
CVE-2026-31377 — Apache Software Foundation Apache Doris — CVSS 7.5 — Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta S...