Your Security Digest · 29 jul

Today, 71 things to read.

71 critical · 0 to skim · nothing on fire

Data source: supabase

tracked71

critical71

active exploit0

71 incidents · criticalupdated live

Jul 281d ago

…

criticalransomware

Over 24,000 exposed server BMCs leak password hash via decades-old flaw

More than 24,000 internet-exposed servers are leaking authentication password hashes due to a 20-year-old vulnerability in their Baseboard Management Controller (BMC) interface.

aeo—social0 · flat

Jul 272d ago

…

criticalzero-dayexploited in the wild

Hackers target US firms in FastJson RCE zero-day attacks

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. The security issue affects FastJson versions 1.2.

aeo—social0 · flat

Today, 71 things to read.

Over 24,000 exposed server BMCs leak password hash via decades-old flaw

Hackers target US firms in FastJson RCE zero-day attacks

Arista patches VeloCloud Orchestrator zero-day exploited in attacks

New Certighost PoC exploit lets attackers hijack Windows domains

Clop ransomware targets Windchill, FlexPLM in data theft attacks

Russian hackers exploit Zimbra zero-click flaw for email theft

Hackers abuse Notepad++ plugins to stealthily install malware

EU fines Google $1 billion for search, app store antitrust violations

New RefluXFS Linux flaw lets attackers gain root privileges

Check Point warns of SmartConsole zero-day exploited in attacks

South Korea discloses data breach impacting diplomats worldwide

New InfraTrust report reveals infrastructure flaws admins should patch first

CISA orders urgent action on actively exploited Langflow RCE flaw

Microsoft to stop Exchange 2016 / 2019 security updates in October

OpenAI says its AI models hacked Hugging Face during testing

Critical SharePoint RCE flaw exploited to steal machine keys

Critical Palo Alto VPN bug now exploited by Qilin ransomware gang

Windows LegacyHive zero-day flaw gets free, unofficial patches

Estée Lauder discloses data breach via Oracle E-Business flaw

SonicWall SMA1000 flaws exploited as zero-days to push custom malware

Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes

Update now: 7-Zip fixes RCE flaw exploitable with malicious archives

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

Microsoft warns of surge in ACR Stealer attacks on customers

New Windows LegacyHive zero-day gives hackers admin privileges

Windows Server 2022 reach end of mainstream support in 90 days

CISA urges immediate action on actively exploited Fortinet flaws

CISA orders feds to patch actively exploited Oracle flaw by Saturday

New Spirals ransomware encrypts victim network in under 24 hours

Dutch police bust investment fraud ring stealing over €100 million

Zoom warns of critical account takeover vulnerability

CISA warns admins to patch actively exploited SharePoint flaws

US charges alleged operators of Russian bulletproof hosting service

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

Microsoft Patches a Record 570 Security Flaws

Microsoft releases Windows 10 KB5099539 extended security update

Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days

Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown

SAP warns of critical flaws in NetWeaver and Commerce Cloud

US sanctions VPN, malware providers for enabling ransomware attacks

CISA warns of actively exploited RCE flaws in Joomla extensions

US and allies warn of Russian critical infrastructure attacks

Australia warns of global campaign targeting vulnerable CMS platforms

Progress urges ShareFile admins to shut down servers over “credible” threat

Money launderer accused of stealing seized crypto while in prison

Zimbra urges customers to patch critical web client XSS flaw

Microsoft expects more Windows security updates from AI-discovered flaws

Microsoft to retire the OWA Light client in Exchange Server

Police arrests 5,800 suspects in global anti-fraud crackdown

Microsoft patches RoguePlanet Defender zero-day vulnerability

Hackers exploit Roundcube flaw to spy on academic researchers

DuckDuckGo browser now blocks YouTube video ads

Telco giant KDDI says data breach affects over 12 million people

Ubiquiti warns of new max severity UniFi OS vulnerability

CISA orders feds to patch max severity ColdFusion flaw by Friday

Accenture confirms breach after hacker offers stolen data for sale

Hidden backdoor in Tenda router firmware grants admin access

Spain arrests suspected member of pro-Russian hacktivist groups

BeyondTrust warns of critical flaws in remote access software

Max severity Adobe ColdFusion flaw now exploited in attacks

NetNut proxy network disrupted, 2 million infected devices cut off

Google loses final appeal to overturn €4.1 billion EU fine

Cisco finally confirms attackers exploiting Unified CM flaw

CISA: Microsoft SharePoint RCE flaw now actively exploited

FortiBleed credential-theft campaign linked to Lynx ransomware

Kubota says hackers had month-long access to network systems

New ChocoPoC malware targets researchers via trojanized PoC exploits

DHS confirms hackers breached HSIN info-sharing platform

Over 900 Oracle E-Business instances exposed to ongoing attacks

Adobe patches seven max severity ColdFusion, Campaign flaws

CISA: Windows BlueHammer flaw now exploited by ransomware gangs