SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 104
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Hijacked npm Packages Use…
Month: July 2026
React2Shell (CVE-2025-55182): Critical React Vulnerability
TL;DR: CVE-2025-55182 is a critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) “Flight” protocol. Default configurations are vulnerable – a standard Next.js app…
Flipper Zero Firmware Development Continues With New Community Contribution Rules
Flipper Devices has responded to intense community backlash over perceptions that it had abandoned active development of the Flipper Zero firmware. In a statement addressing…
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
Ravie LakshmananJul 01, 2026Artificial Intelligence / Vulnerability Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic. The ColdFusion…
Medtronic Notifies 3.8 Million After ShinyHunters Data Breach
Medtronic Notifies 3.8 Million After ShinyHunters Data Breach Pierluigi Paganini July 05, 2026 Medtronic says a ShinyHunters attack exposed the personal and medical data of…
Top AWS re:Invent Announcements for Security Teams in 2025
AWS’s largest event of the year is re:Invent, which occurred just after Thanksgiving from Dec 2-5 this year. The weeks prior are referred to as…
Flipper Zero firmware development continues with community help
Flipper Devices says development of the Flipper Zero firmware will continue, albeit with a smaller internal team and greater reliance on community contributions. The announcement…
T3MP3ST Security Framework With 35 Tools, Turns AI Coding Agents Into 0-Day Bug Hunters
A newly released open-source security framework called T3MP3ST is turning general-purpose AI coding agents like Claude Code, OpenAI’s Codex, and Hermes into autonomous red-teaming operators…
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer
Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs.…
Code to Cloud Attacks: Github PAT to Cloud Control Plane
Threat actors are targeting GitHub Personal Access Tokens (PAT) as high-value entry points, leveraging compromised PATs to gain initial access to victim cloud environments. Historically,…
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
Ravie LakshmananJul 01, 2026Malware / SEO Poisoning Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT.…
Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited
While investigating a malware infection on a customer workload, Wiz Research discovered an active zero-day vulnerability in Gogs, a popular self-hosted Git service. A symlink…