SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
A rogue extension can still make Claude in Chrome read your Gmail
A rogue browser extension can forge a click that makes Claude for Chrome read your Gmail, Docs, and Calendar, unpatched across eight releases.
Grafana's AI connector can leak its access token to a stranger and reach into your cloud
A high-severity flaw (CVSS 8.6) in Grafana's MCP server lets an unauthenticated attacker steal its Grafana service-account token and relay requests into
Two SonicWall remote-access zero-days are under attack, and patching alone will not clean the box
SonicWall patched two actively exploited SMA 1000 zero-days, CVE-2026-15409 and CVE-2026-15410.
Two Microsoft zero-days were exploited before the fix shipped
Microsoft's July 2026 Patch Tuesday fixes two zero-days already exploited in the wild: an ADFS and a SharePoint Server privilege bug.
SAP's highest-scored July flaw is not the one to patch first
SAP's July 2026 patch day has three criticals. The top-scored 9.9 NetWeaver bug needs a login; the two pre-auth 9.1s in AppRouter and Commerce Cloud go first.
Notarized by Apple, still malware: the CrashStealer Mac stealer
CrashStealer is a macOS info-stealer that Apple notarized, so Gatekeeper cleared it on launch before it drained keychains, browser logins and crypto wallets.
The appliances you install to be safer were the week’s most dangerous bugs
Dell Data Domain, Progress ShareFile and BeyondTrust all failed at authorization this week.
An 18-year-old Cisco router flaw is being exploited, and no patch is coming
CISA flagged an 18-year-old Cisco IOS flaw (CVE-2008-4128) as actively exploited. What it hits, why old routers are the target, and how to shut it down.
How a PNG in a pull request makes AI agents leak secrets
Researchers hid prompt-injection text inside a PNG in a pull request and made AI coding agents read .env and leak the secrets.
Mass CMS campaign turns unpatched plugins into webshells
Australia's cyber agency warns of a global campaign mass-exploiting 16 known CMS and plugin flaws to drop webshells on WordPress, Joomla and Craft sites.
A Helix Ultimate flaw lets an anonymous visitor hijack a Joomla admin, and a working exploit is now public
A public exploit now targets CVE-2026-57829, an unauthenticated stored XSS in the Helix Ultimate Joomla framework below 2.2.7.
A cache-plugin flaw backdoored 17,000 WordPress sites. A max-severity bug got 77.
An exposed server revealed WP-SHELLSTORM, a WordPress and Joomla webshell operation. Its own logs show CVE severity barely predicted which sites got hacked.
A single rigged device name can hijack an OpenWrt router's admin panel
A stored XSS in OpenWrt's LuCI web panel (CVE-2026-61876, CVSS 8.8) lets a device on the LAN plant a script in a DHCPv6 hostname that runs in the admin's
Ghost accounts are mapping your GitHub org. The recon is invisible; the stolen token is not.
Datadog found 50+ dormant GitHub accounts enumerating corporate orgs through the public API, some escalating to private-repo clones with stolen tokens.
Zimbra's Classic Web Client can run code from a crafted email again. Patch to 10.1.19 now.
Zimbra shipped ZCS 10.1.19 to fix a stored XSS in the Classic Web Client that runs code from a crafted email. Google TAG reported it; no public exploit yet.
npm just killed install-script malware by default. This week's other attack walks right past it.
npm 12 disables install scripts by default, which would have stopped this week's jscrambler infostealer.
Progress tells ShareFile users to shut servers down, and no patch means assume breach
Progress told ShareFile customers to shut down on-premises Storage Zone Controllers over a credible threat.
Super Forms flaw lets anyone take over a WordPress site, and a working exploit is now public
A critical flaw (CVSS 9.8) in the Super Forms WordPress plugin lets unauthenticated attackers run code on the server.
GigaWiper fakes a ransomware hit to cover a disk wipe, and the only early warning is on the host
GigaWiper encrypts files to .candy with no key and no ransom note, because the ransomware is a decoy for a disk wipe. Here are the host signals that catch it.
A rigged Jira ticket can trick the mcp-atlassian AI connector into leaking server files
mcp-atlassian before 0.22.0 reads files off its own host when a caller or a prompt-injected agent supplies a server-side path.
Two more Joomla extensions hit the exploited list. It is the same bug, five times now.
CISA added Balbooa Forms (CVE-2026-56291) and iCagenda (CVE-2026-48939) to its exploited list on July 10, the fourth and fifth Joomla extension with the same
Three attacks in one week turned AI coding agents into an unmonitored way onto your network
HalluSquatting and Friendly Fire show AI coding agents running attacker code with a developer's privileges. No CVE, no patch. Here is the detection posture.
Three ransomware responders secretly worked for BlackCat. Trust is the attack surface.
Three incident-response insiders at DigitalMint and Sygnia were sentenced for helping run BlackCat ransomware, one leaking victims' insurance limits.
A fake 7-Zip installer rents your server out as a residential proxy, and file scans miss it
A trojanized 7-Zip and VPN campaign called Lurking Lizard turns servers and PCs into residential proxy nodes.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.