SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
Windmill's unauthenticated file-read flaw (CVE-2026-29059) is under active attack
Windmill's unauthenticated file-read flaw CVE-2026-29059 is being exploited in the wild. Patch self-hosted instances to 1.603.3 and rotate any exposed secrets.
WPForms Pro flaw lets a stranger upload a file and run code on your WordPress site. Patch now.
A flaw in WPForms Pro (CVE-2026-10818) lets unauthenticated attackers upload executable files to WordPress sites on versions up to 1.10.1.1 and run code.
A single ChatGPT link could plant a rogue AI agent in your org
Zenity Labs' AgentForger let one crafted ChatGPT link forge a self-running AI agent wired to your connected apps. OpenAI fixed it. Here's what to watch.
Attackers ran an AI agent unattended to do the hands-on hacking inside Thailand's finance ministry
An attacker ran an unattended AI agent to hack Thailand's finance ministry. It used no new exploit, and defenders catch it by watching host actions.
A Keycloak flaw lets a view-only admin read live client secrets from the vault (CVE-2026-17048)
CVE-2026-17048 lets a view-only Keycloak admin read resolved client secrets from the vault instead of the placeholder.
Fake Notepad++ plugin drops a Windows loader that slips past sandboxes and app allowlists
CERT-UA ties UAC-0099 to a campaign hiding a Windows loader in a genuine Notepad++ via DLL sideloading.
ESET patched a Mac flaw that let any local user gain root control (CVE-2026-7483)
ESET patched CVE-2026-7483, a local privilege escalation in its Mac security software that let any logged-in user write files as root.
Zimbra webmail zero-day (CVE-2025-66376) let Russian spies steal mail and mint MFA-bypass passwords
Russian group Void Blizzard exploited Zimbra webmail flaw CVE-2025-66376 as a zero-day to steal 90 days of mail and mint app passwords that survive resets.
RefluXFS: a Linux XFS flaw gives any local user root access
RefluXFS (CVE-2026-64600) lets any local user get root on default RHEL, Rocky, Alma and Amazon Linux via an XFS race. No workaround: patch and reboot.
PhpSpreadsheet flaw: a tiny malformed file can crash PHP apps that accept spreadsheet uploads (CVE-2026-59933)
CVE-2026-59933: a 1 KB malformed spreadsheet can exhaust memory and crash PHP apps using PhpSpreadsheet, even during automatic file-type detection. Patch now.
Adobe's Acrobat Chrome extension let any website read WhatsApp Web chats (CVE-2026-48294). Update now.
A cross-origin flaw in Adobe's Acrobat Chrome extension (CVE-2026-48294) let any website read WhatsApp Web chats. Update to 26.5.2.3 and govern extensions.
A rigged printer advertisement can trap Linux print systems in a CPU-burning loop (CVE-2026-64611)
CVE-2026-64611 lets a crafted printer advertisement drive libcupsfilters into an infinite loop, burning a CPU core on Linux print systems. Patch and harden now.
A critical fastjson flaw lets attackers run code on the server with no special configuration (CVE-2026-16723)
CVE-2026-16723 lets attackers run code on Java apps using fastjson 1.2.68 to 1.2.83 in default configuration. Turn on SafeMode or move to fastjson2.
Check Point's SmartConsole flaw lets an unauthenticated attacker become full admin, and it is being exploited
Check Point SmartConsole flaw CVE-2026-16232 is exploited and in CISA KEV, letting an unauthenticated attacker log in as full admin.
You patched SharePoint three times this month. The key attackers want is still in the lock.
CVE-2026-50522, a CVSS 9.8 SharePoint RCE, went from public PoC to active exploitation in hours.
Langflow's code-validation endpoint just produced its second unauthenticated RCE
CVE-2026-0770 (CVSS 9.8) is an unauthenticated root RCE in Langflow's validate endpoint, actively exploited and added to CISA's KEV catalog.
Oracle WebLogic and Coherence: Unauthenticated 10.0 RCE, Patch Now
Oracle's July 2026 update ships 1,449 fixes, including unauthenticated CVSS 10.0 remote code execution in WebLogic, Oracle HTTP Server, and Coherence.
A Jackson library flaw lets low-privilege users write fields meant only for admins
CVE-2026-59889 lets a low-privilege user bypass jackson-databind's @JsonView write guard and set admin-only fields. Patched in 2.18.9, 2.21.5, 3.1.5.
A Palo Alto VPN auth bypass is now a Qilin ransomware front door
CVE-2026-0257 lets attackers open a Palo Alto GlobalProtect VPN session with no login, and the Qilin ransomware crew is using it for initial access.
HollowGraph turns Microsoft 365 into a C2 channel with no patch
HollowGraph runs its command channel through a hijacked Microsoft 365 calendar over the Graph API. No CVE, no patch: here is how to detect it.
nginx CVE-2026-42533: Heap Overflow in a Common map Regex Config
CVE-2026-42533 is a CVSS 9.2 heap overflow in nginx's string engine, patched July 15. Unlike June's flaws it fires on a common regex map config.
The week's scariest ‘AI’ bugs weren't about AI. They were the confused deputy.
This week's headline ‘AI’ vulnerabilities in Grafana and Apache Camel are the 1988 confused-deputy flaw, the same one that hit Fastify, Directus and OpenShift
Directus caching flaw can serve one visitor's private data to the next
Directus before 12.0.0 caches responses under a key that omits authorization, so with caching on it can serve one visitor's share-scoped data to another.
ServiceNow is under active attack through a route the public exploit does not show. Patch, don't block.
ServiceNow's pre-auth sandbox-escape flaw CVE-2026-6875 (CVSS 9.5) is under active exploitation.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.