Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index879 entries

Vulnerabilities Malware Campaigns Supply Chain Policy Tools

Page 6 of 36

126–150 of 879

highMalwareContained

FBI Dismantles NetNut Residential Proxy Operation Linked to Popa Botnet Infrastructure

US federal law enforcement seized NetNut, an Israeli residential proxy service operated by publicly-traded Alarum Technologies, following security research linking it to the Popa botnet comprising at least two million compromised devices. The action represents significant progress in disrupting a major abuse infrastructure that enabled attackers to mask malicious traffic through residential IP addresses.

3 July 2026Alarum Technologies (NetNut), NetNut proxy platform users

criticalVulnerabilityActive

CitrixBleed exploited in the wild within hours of public PoC release: NetScaler memory disclosure now active threat

A new memory disclosure vulnerability in Citrix NetScaler appliances is being actively exploited using publicly available proof-of-concept code to extract arbitrary data from HTTP responses. The rapid weaponisation following disclosure creates immediate risk for unpatched deployments.

3 July 2026Citrix NetScaler appliances

highCampaignActive

Google Disrupts NetNut Residential Proxy Network: Law Enforcement Success Against Distributed Infrastructure Abuse

Google's Threat Intelligence Group, working with the FBI and Lumen, significantly degraded the NetNut residential proxy network by reducing its device pool by millions. This coordinated action targets infrastructure used for credential stuffing, ad fraud, and anonymised malicious activity across compromised home devices.

3 July 2026NetNut (Popa), Home broadband subscribers, Online services targeted by fraud

highCampaignActive

Pegasus Spyware Deployed Against European Parliament Investigator: Targeting of Oversight Creates Political Vulnerability

Stelios Kouloglou, a European Parliament member investigating commercial spyware abuses, was infected with Pegasus spyware twice during his tenure on the PEGA committee. This represents a direct attack on parliamentary oversight mechanisms and suggests threat actors are targeting those scrutinising spyware exports.

3 July 2026Pegasus (NSO Group), European Parliament

lowPolicyActive

Anthropic's Temporary Claude Fable 5 Subscription Removal: Service Continuity vs User Expectations

Anthropic is removing Claude Fable 5 from subscription tiers on 7 July but clarified this is temporary, not a permanent discontinuation. The move signals potential resource or licensing constraints but maintains model availability through alternative access methods.

3 July 2026Anthropic Claude subscriptions, Claude Fable 5 users

criticalVulnerabilityActive

Rancher Fleet Multi-Tenant Namespace Isolation Bypass via Unvalidated valuesFrom References

Fleet's Helm Deployer fails to validate cross-namespace secret references in `valuesFrom` configurations, allowing authenticated tenants to read arbitrary secrets and deploy unauthorized cluster-wide resources across tenant boundaries in multi-tenant environments.

CVE-2026-44935

2 July 2026Rancher/Fleet

criticalVulnerabilityActive

Rancher RBAC Bypass Enables Privilege Escalation via Pod Security Admission Manipulation

Project Owner role in Rancher Manager can modify Pod Security Admission labels to deploy privileged containers, bypassing namespace isolation and escalating to cluster-level access. This is a critical RBAC enforcement failure with high real-world exploitation likelihood.

CVE-2026-41052

2 July 2026Rancher/rancher-manager

criticalVulnerabilityActive

Cache-Poisoning XSS via x-ghost-preview Header in Ghost CMS

Ghost CMS fails to properly validate the x-ghost-preview header, allowing unauthenticated attackers to inject malicious content into cached responses. When frontend and admin share a domain, this enables account takeover of staff users.

CVE-2026-53943

2 July 2026Ghost/Ghost v4.0 through v6.36.0

informationalPolicyResolved

Cisco Talos personnel profile: limited security intelligence value

Cisco Talos published a biographical profile of Martin Lee, EMEA Lead, discussing his career transition from virology to cybersecurity leadership. This is a human interest piece with no security incident or threat intelligence content.

2 July 2026

mediumPolicyActive

Microsoft Teams Bot Governance: Administrative Control Reduces Unauthorized AI Participant Risk

Microsoft is implementing admin-enforced approval policies for external AI bots joining Teams meetings, reducing the surface for unauthorized automated participants in sensitive discussions. This addresses growing concerns about uncontrolled AI integration in enterprise collaboration platforms.

2 July 2026Microsoft Teams

criticalVulnerabilityEmerging

Unpatched Argo CD Repository Server RCE Exposes Kubernetes Deployments to Unauthenticated Cluster Takeover

An unpatched remote code execution vulnerability in Argo CD's repo-server component allows unauthenticated attackers with network access to the internal port to execute arbitrary code and achieve full Kubernetes cluster compromise. No CVE has been assigned and no patch is currently available.

2 July 2026Argo CD (repo-server component)

highCampaignActive

Scattered Spider operative extradited: teenage member faces US charges for luxury retail breach

A 19-year-old suspect linked to Scattered Spider has been extradited to the US and faces charges for participating in breaches including a luxury jewellery retailer compromise in 2025. This marks a significant law enforcement action against an active criminal collective known for social engineering and supply chain targeting.

2 July 2026Luxury jewellery retailers, Organisations targeted by Scattered Spider

highCampaignActive

Medtronic breach by ShinyHunters exposes healthcare device customers to identity theft risk

Medical device manufacturer Medtronic has notified customers of a data breach attributed to the ShinyHunters threat actor, exposing personal information that puts affected individuals at risk of identity theft and fraud.

2 July 2026Medtronic

criticalVulnerabilityActive

Fission Container Executor PodSpec Injection – Privilege Escalation via Unvalidated Tenant Input

Fission's container executor fails to validate user-supplied PodSpec content, allowing tenants with only function-creation rights to inject host namespace access and privileged containers, escalating to node-level compromise. This is a direct privilege-escalation path from application-level RBAC to infrastructure control.

CVE-2026-50563

1 July 2026fission/fission

criticalVulnerabilityActive

Fission Environment CRD podspec passthrough enables Kubernetes host escape via privileged pod injection

Fission's Environment CRD failed to validate or filter dangerous Kubernetes pod security fields (`hostPID`, `hostNetwork`, `privileged`), allowing namespace users with basic create/update RBAC to spawn host-privileged pods and escape to node compromise. Pod Security Admission bypass due to missing namespace labels amplified the risk.

CVE-2026-50564

1 July 2026fission/fission < v1.24.0

criticalVulnerabilityActive

Fission Environment SecurityContext Bypass: Privileged Container Injection via Admission Webhook Gap

Fission's Environment CRD fails to validate SecurityContext on standalone container fields, allowing attackers to inject privileged containers that bypass admission controls. This is a second-order bypass of prior hardening patches.

CVE-2026-50566

1 July 2026fission/fission

highSupply ChainEmerging

LLM Domain Hallucinations Enable Phantom Squatting Attacks on Software Supply Chains

Attackers are exploiting large language models' tendency to generate non-existent domain names and registering these hallucinated domains to intercept developer traffic and compromise software supply chains. This technique bridges AI model weaknesses with domain squatting to create plausible but fake package repositories and dependencies.

1 July 2026Developers using LLM assistants for code discovery, Package managers relying on domain-based package sourcing, Software development organisations +1

criticalVulnerabilityActive

Microsoft Defender Zero-Day CVE-2026-33825 Actively Exploited in Ransomware Campaigns

CVE-2026-33825, a Microsoft Defender vulnerability, was exploited as a zero-day in ransomware attacks before patches became available. This represents a significant breach in endpoint protection integrity.

CVE-2026-33825

1 July 2026Microsoft Defender

highCampaignActive

Large-scale password spray campaign targets Azure CLI with 81M+ attempts, compromising 78+ Microsoft accounts

A sustained password spray attack originating from an IPv6 range controlled by LSHIY LLC has targeted Azure CLI with over 81 million login attempts between mid-June and late June 2026, successfully compromising at least 78 Microsoft accounts. This represents a significant threat to organisations using Azure command-line tooling without robust account protection measures.

1 July 2026Microsoft Azure CLI, Microsoft Azure accounts

informationalPolicyEmerging

CIA Director frames AI as strategic weapons-class technology, signalling shift in threat perception

CIA Director John Ratcliffe characterised AI capabilities as 'digital nuclear weapons', reflecting US intelligence community reassessment of AI's strategic threat profile and likely signalling policy shifts in how the agency approaches AI security and governance.

1 July 2026

informationalPolicyResolved

US Export Controls Lifted on Anthropic's Advanced Claude Models: Geopolitical Shift in AI Accessibility

The US Department of Commerce has lifted export controls on Anthropic's Claude Fable 5 and Mythos 5 models, enabling international availability. This represents a significant policy reversal with implications for global AI competition and regulatory frameworks.

1 July 2026Anthropic Claude Fable 5, Anthropic Claude Mythos 5

highCampaignActive

Email account compromise as identity system attack vector: why attackers prioritise inbox access

Cybercriminals target email accounts as a primary objective because inbox control grants access to password resets, financial accounts, and identity verification across an individual's digital footprint. This represents a fundamental shift in attack prioritisation from specific services to the authentication hub itself.

30 June 2026Email service users (all providers), Identity verification systems

highVulnerabilityEmerging

Daktronics Controller Vulnerabilities Enable Remote Compromise of Traffic and Advertising Infrastructure

CISA disclosed three vulnerabilities in Daktronics controllers used in highway signs and billboards, allowing remote attackers to compromise critical public infrastructure. This represents a significant gap in the security of operational technology systems that directly affect public safety and commerce.

30 June 2026Daktronics controllers

highMalwareContained

Perplexity Impersonation Attack Exploited Chrome Web Store Trust to Intercept Search Queries

A malicious Chrome extension masquerading as the Perplexity AI search engine intercepted all user searches and address bar input, routing them through an attacker-controlled server before delivering results. Google removed the extension after Microsoft's responsible disclosure, but the attack demonstrates how supply chain compromises in browser extension marketplaces can enable large-scale data harvesting.

30 June 2026Google Chrome, Chrome Web Store, Perplexity (brand/reputation)

informationalPolicyResolved

U.S. Supreme Court mandates warrant requirement for geofence data, reshaping law enforcement digital surveillance

The U.S. Supreme Court ruled that police must obtain a warrant before accessing geofence location data from cellphones, extending Fourth Amendment protections to digital tracking. This represents a significant legal victory for privacy advocates and establishes new constraints on law enforcement digital surveillance practices.

30 June 2026Law enforcement agencies, Technology companies storing location data, Mobile carriers