Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
ServiceNow AI Platform RCE: How CVE-2026-6875 Went From Disclosure to Active Exploitation in Weeks
A critical pre-authentication sandbox-escape vulnerability in the ServiceNow AI Platform is being actively exploited in the wild just one week after patches for self-hosted instances were released, putting Fortune 500 enterprise workflows at risk.
Clop Exploited Oracle Flaw to Steal Estée Lauder’s HR Data — And It’s Been Happening Since August
Estée Lauder’s year-long data breach was enabled by a zero-day in Oracle E-Business Suite, exploited by the Clop ransomware gang since August 2025 — a failure that mirrors systemic neglect across enterprise IT.
CISA Mandates Federal Patch for Actively Exploited Adobe ColdFusion Zero-Day
The U.S. Cybersecurity and Infrastructure Security Agency has ordered federal agencies to patch a critical Adobe ColdFusion vulnerability by Friday after threat actors began exploiting it within hours of disclosure.
Public Exploits Released for Critical wp2shell RCE Vulnerabilities in WordPress Core — Patch Now
Critical unauthenticated remote code execution vulnerabilities in WordPress Core (CVE-2026-63030 and CVE-2026-60137) have been weaponized in the wild, requiring immediate patching to 7.0.2 or 6.9.5.
HollowByte: An 11-Byte Kill Switch for OpenSSL Servers
A newly disclosed vulnerability in OpenSSL allows unauthenticated attackers to exhaust server memory via a minimal 11-byte TLS handshake payload, leading to permanent heap fragmentation and service disruption.
Attackers Are Now Exploiting a Maximum-Severity Adobe ColdFusion Vulnerability
Attackers are actively exploiting a maximum-severity vulnerability in Adobe ColdFusion, tracked as CVE-2026-48282, enabling unauthenticated remote code execution. Adobe issued emergency patches on July 1, 2026, but exploitation began within two hours of public disclosure.
CISA Orders Emergency Patch for Actively Exploited FortiSandbox Flaws by Sunday
The U.S. Cybersecurity and Infrastructure Security Agency has added two critical Fortinet FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities catalog and issued a Binding Operational Directive requiring federal agencies to patch the flaws by Sunday, July 19.
LegacyHive Zero-Day: How Nightmare Eclipse's Windows Exploit Exposes AI Cybersecurity Threats in Patch Management
A security researcher known as Nightmare Eclipse has published a proof-of-concept for LegacyHive, a Windows zero-day that escalates privileges through the User Profile Service on patched systems. The exploit, which has no CVE and no available patch, lets standard users load an administrator's registry hive—enabling code execution when the admin next logs in.
BeyondTrust Warned Customers to Patch Two Critical Security Flaws in Its Remote Support (RS) and Privileged Remote Access
BeyondTrust issued emergency patches for two critical authentication bypass flaws in Remote Support and Privileged Remote Access, with two high-severity DoS flaws. Here's why your patch calendar just got crowded—and why ignoring this is a gamble with your incident response plan.
AI Cybersecurity in Action: How a Vulnerability Vending Machine Turns Code Slices Into Zero-Days
Intruder’s AI pipeline automates zero-day discovery in WordPress plugins using code slicing and LLMs — not theory, but a working system that found a critical SQL injection with no human input.
Microsoft Links Upcoming Patch Tuesday Surge to AI-Powered Discovery
As Microsoft adopts AI-based vulnerability scanning tools like MDASH, the company warns that customers should prepare for more frequent and voluminous security update releases.
AI Cybersecurity Threats: CISA Warns of Actively Exploited SharePoint Flaws Enabling RCE and Persistence
CISA has issued an urgent alert: attackers are weaponizing three SharePoint Server vulnerabilities to bypass authentication, execute remote code, and steal IIS machine keys for persistent access. Federal agencies have just days to patch.