TL;DR SonicWall patched a critical SonicWall SMA1000 vulnerability, CVE-2026-15409, on July 14, 2026. Attackers are exploiting it in the wild to reach remote code execution. A public proof-of-conc…

TL;DR Dell has patched a batch of flaws in PowerFlex Manager. The most severe, CVE-2026-56688, enables PowerFlex command execution as root. It carries a CVSS score of 9.1. So far, no public exploi…

This week, Microsoft began pushing the July 2026 monthly security update to all supported devices. Under normal circumstances, Windows 10/11 receives the update automatically and prompts users to …

As previously reported, SpaceXAI has already released Grok Build as open source to repair its collapsed community trust. Now, Elon Musk has revealed that X/Twitter will adopt an open-source model …

Recently, security researcher @RDJGR revealed details of CVE-2026-50663 on social media. This flaw affects the classic strategy game, Age of Empires II: Definitive Edition. Surprisingly, exploitin…

At a Glance Actors Suspected China-nexus (PlugX, ShadowPad, Cobalt Strike) and India-nexus (Remcos; TAG-179) groups Activity type State-nexus cyberespionage; C2 intrusions; malware implanted in a …

At a Glance Malware family Albiriox (Android banking RAT, sold as Malware-as-a-Service), delivered by a UniCredit-branded dropper Threat actor Unattributed operator; Albiriox is sold on Russian-sp…

At a glance Actor / group Helix (suspected ties to BlackFile and ShinyHunters) Activity type Data extortion through identity-based intrusion Targets / victims Enterprises; high-visibility staff an…

At a glance Malware family GigaWiper (Golang backdoor; code ties to Crucio and FlockWiper) Threat actor Not publicly named by Microsoft; suspected single developer Target / victims Windows systems…

TL;DR The CISA KEV catalog gained two entries on July 15, 2026. The agency confirmed active exploitation of CVE-2026-46817 in Oracle E-Business Suite and CVE-2023-4346 in KNX building automation d…

TL;DR Splunk released patches on July 15, 2026 for three Splunk Enterprise vulnerabilities. The most serious, CVE-2026-20296, is a cross-site request forgery (CSRF) flaw that enables SPL execution…

Decentralization did not fail in the Kelp DAO and BonkDAO incidents governance did. When hundreds of millions can be drained either through…

Authentication is one of the most important components of any web application. A single weakness in the authentication flow can lead to…

Free Link…

Hello everyone,

A malformed SamplesPerPixel tag reached GDAL’s GTiff driver, triggered a 16.4 GB allocation request, and led to a codec-aware upstream fix

Bug bounty hunting doesn’t always require fancy tools or complicated payloads. Sometimes, all it takes is paying attention to small…

Challenge Scenario

welcome to my first write-up. I started bug hunting about 3 months ago, and this was one of my first findings, so I would love to share it.

Merely twelve days after the first fully automated data-encryption attack came to light, Ant Group has unveiled a free tool designed to halt dangerous artificial intelligence commands before they …