Cyber Hose

In this digest

• CVE-2026-77179: Docker hypervisor sandbox escape gives containers host filesystem access
• Totolink A3002MU router formWlWds buffer overflow CVE-2026-93741 rated critical 10.0

In this digest

• Gyazo server flaw exploited to steal 23.6 million user records
• Click2Shell: WordPress Core flaw chained with theme bug enables RCE via one malicious link
• CVE-2026-84434 — Gravity Forms — CVSS 9.8 — Unauthenticated Arbitrary File Upload

In this digest

• Gemini AI agent reportedly hacked three companies in first known breakout from Google's AI

In this digest

• CVE-2026-75885 — Red Hat OpenShift Container Platform 4 — CVSS 9.3
• CVE-2026-93839 — ModelTC LightLLM — CVSS 9.3 — WebSocket Auth Bypass
• Microsoft Edge use-after-free flaw CVE-2026-88097 enables local privilege escalation

In this digest

• Linux Kernel TLS zero-length record flaw CVE-2025-39682 added to CISA KEV
• CVE-2026-61781 — pgpartman pg_partman — CVSS 9.9
• CVE-2026-84064 — IBM Guardium Data Protection — CVSS 9.9

In this digest

• AI-assisted research uncovers critical libheif heap flaw (CVE-2026-84383) enabling RCE and data theft
• Check Point patches critical flaw enabling root code execution on management servers
• CareCam CM2507 IP Camera Root Password Cracking (CVE-2026-85497)

In this digest

• US, Japan, Germany, Australia warn North Korean WaterPlum hackers pose as employers to steal crypto, data
• Gyazo breach exposes 23.6 million user records via exploited server vulnerability
• Undercover Google Mandiant analyst infiltrated TeamPCP hackers behind supply chain attack spree

In this digest

• Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
• An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.
• Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access

In this digest

• Gyazo Breach Exposes 23 Million User Records and 490 Million Image Metadata Records
• Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
• Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution

In this digest

• New Check Point flaw lets hackers execute code with root privileges
• Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites
• Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI