cybersecurity

cve | cybersecurity

Cordyceps: A Free GitHub Account Is All It Takes to Hijack CI/CD Pipelines at Microsoft, Google, Apache, and Cloudflare — 300+ Repos Confirmed Exploitable
By

Cordyceps is a systemic class of CI/CD workflow vulnerabilities discovered by Novee Security that allows any unauthenticated user with a free GitHub account to hijack build pipelines at Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation. 300+ repositories confirmed fully exploitable across a scan of 30,000. No CVE — this is a misconfiguration class, not a single bug. AI coding agents are reproducing the insecure patterns at exponential scale. No confirmed exploitation in the wild. All named organizations have applied fixes.

Read More Cordyceps: A Free GitHub Account Is All It Takes to Hijack CI/CD Pipelines at Microsoft, Google, Apache, and Cloudflare — 300+ Repos Confirmed Exploitable
cve | cybersecurity

Squidbleed (CVE-2026-47729): Claude Mythos Found a 29-Year-Old Heartbleed-Style Memory Leak in Every Version of Squid Proxy — And the Patch Isn’t in 7.6
By

Squidbleed (CVE-2026-47729) is a Heartbleed-style heap buffer overread in Squid Proxy’s FTP directory listing parser that has lived in every version of Squid since 1997 — 29 years — in its default configuration. It leaks adjacent heap memory, potentially including other users’ HTTP Authorization headers, cookies, and session tokens. Discovered by Calif.io using Claude Mythos Preview. Critical correction: the patch is in Squid 7.7, NOT 7.6. Immediate mitigation: disable FTP in Squid. PoC is public.

Read More Squidbleed (CVE-2026-47729): Claude Mythos Found a 29-Year-Old Heartbleed-Style Memory Leak in Every Version of Squid Proxy — And the Patch Isn’t in 7.6
cybersecurity | Uncategorized

FortiBleed Update: CISA Issues Formal Advisory — Scope Jumps to 86,644 Devices in 48 Hours, Free Lookup Tool Now Available
By

CISA issued a formal advisory on FortiBleed on June 18, 2026 — and the confirmed compromised device count jumped from 30,791 to 86,644 in 48 hours. CISA mandates five immediate actions: terminate all sessions, reset all credentials, verify PBKDF2 hashing, enable phishing-resistant MFA, and restrict management access. Hudson Rock released a free FortiBleed Lookup Tool. FortiSandbox critical vulnerabilities now also exploited. No specific CVE — this campaign exploits organizational process failure at global scale.

Read More FortiBleed Update: CISA Issues Formal Advisory — Scope Jumps to 86,644 Devices in 48 Hours, Free Lookup Tool Now Available
cve | cybersecurity

FortiBleed: 30,791 Verified Fortinet Credentials Compromised Across 194 Countries — The Self-Feeding Attack Nobody Can Find the Source Of
By

SOCRadar discovered an exposed attacker server revealing FortiBleed — a self-sustaining credential-harvesting campaign that has compiled 30,791+ verified working Fortinet administrator and SSL VPN credentials across 194 countries, with Hudson Rock and Kevin Beaumont estimating up to 75,000 affected devices. Telecoms, governments, hospitals, and a Turkish NATO defense contractor confirmed compromised. The initial access vector remains unconfirmed. Most credentials trace to years-old unrotated passwords from prior Fortinet breaches.

Read More FortiBleed: 30,791 Verified Fortinet Credentials Compromised Across 194 Countries — The Self-Feeding Attack Nobody Can Find the Source Of
cybersecurity

UNC6508: How a Chinese State-Sponsored Group Spent 26 Months Inside US and Canadian Research Labs Using a Misspelled Gmail Rule
By

Google’s Threat Intelligence Group disclosed a 26-month Chinese state-sponsored espionage campaign against US and Canadian research institutions. UNC6508 exploited legacy REDCap versions to deploy modular malware INFINITERED, escalated to domain administrator, then exfiltrated emails by weaponizing a legitimate Google Workspace content compliance rule — silently BCC’ing matching messages on defense intelligence, AI, unmanned vehicles, and medical research to an attacker-controlled Gmail address. Disrupted by Google in November 2025. No victims named publicly.

Read More UNC6508: How a Chinese State-Sponsored Group Spent 26 Months Inside US and Canadian Research Labs Using a Misspelled Gmail Rule
cve | cybersecurity

CVE-2026-20253: Splunk Enterprise CVSS 9.8 — Unauthenticated RCE Through a PostgreSQL Sidecar That Forgot to Lock Its Door
By

CVE-2026-20253 is a CVSS 9.8 Critical in Splunk Enterprise — unauthenticated RCE through the PostgreSQL Sidecar Service. No credentials. No interaction. The backup and restore endpoints lack authentication and are reachable through Splunk’s port 8000 proxy. AWS deployments are vulnerable out of the box. watchTowr published the full exploit chain. Splunk Cloud is NOT affected. Patch to 10.4.0, 10.2.4, 10.0.7, 9.4.12, or 9.3.13 immediately.

Read More CVE-2026-20253: Splunk Enterprise CVSS 9.8 — Unauthenticated RCE Through a PostgreSQL Sidecar That Forgot to Lock Its Door
cybersecurity

CVE-2026-35273: ShinyHunters Spent 14 Days Inside University Networks Using an Oracle PeopleSoft Zero-Day — Before Oracle Said a Word
By

ShinyHunters (UNC6240) exploited a CVSS 9.8 zero-day in Oracle PeopleSoft for 14 days before Oracle published a single word of warning. CVE-2026-35273 requires no credentials and no user interaction — just a crafted HTTP request to the Environment Management Hub. ~300 PeopleSoft installations compromised across 100+ organizations. 68% universities. University of Nottingham confirmed: ~500,000 student records stolen. Mandiant confirmed the gadget chain. Patch now and check your PSEMHUB logs back to May 27.

Read More CVE-2026-35273: ShinyHunters Spent 14 Days Inside University Networks Using an Oracle PeopleSoft Zero-Day — Before Oracle Said a Word
cybersecurity

A $1,000 AI Agent Found 21 Zero-Days in FFmpeg — Some Sitting Undetected for 23 Years
By

Depthfirst’s autonomous security agent scanned 1.5 million lines of FFmpeg C code and returned 21 confirmed zero-days — each with a reproducible PoC — for a total cost of $1,000. The oldest vulnerability dates to 2003. The most severe demonstrates an RCE primitive. FFmpeg is embedded in virtually every video player, browser, streaming platform, and media pipeline on the planet. All 21 are fixed upstream. Every embedded copy needs patching too.

Read More A $1,000 AI Agent Found 21 Zero-Days in FFmpeg — Some Sitting Undetected for 23 Years
cybersecurity

Microsoft June 2026 Patch Tuesday: Record 200 Vulnerabilities, 3 Zero-Days, RoguePlanet Drops Hours Later — The Most Critical Patch Event of 2026
By

Microsoft’s June 2026 Patch Tuesday is the largest in history — 200 CVEs, 33 Critical, 83 RCE flaws, wormable CVSS 9.8 in HTTP.sys, MiniPlasma finally patched. Hours after release, Nightmare Eclipse dropped RoguePlanet — new unpatched Windows Defender zero-day, SYSTEM shell, working public PoC. Secure Boot certificate expires June 26. Patch everything today.

Read More Microsoft June 2026 Patch Tuesday: Record 200 Vulnerabilities, 3 Zero-Days, RoguePlanet Drops Hours Later — The Most Critical Patch Event of 2026
cybersecurity

Claude Code GitHub Action Prompt Injection: How a Hidden HTML Comment Stole CI/CD Secrets and Bypassed Both Claude’s Safety Filters and GitHub’s Secret Scanner
By

Microsoft Threat Intelligence published research on June 5 documenting a patched prompt injection vulnerability in Anthropic’s Claude Code GitHub Action that allowed a malicious GitHub issue to instruct the AI agent to read /proc/self/environ — exposing ANTHROPIC_API_KEY, GITHUB_TOKEN, and all CI/CD runner secrets — while bypassing both Claude’s safety filters and GitHub’s Secret Scanner. Patched in Claude Code v2.1.128 (May 5). The broader attack class — “Comment and Control” — affects AI agents from Anthropic, Google, and Microsoft. Microsoft’s Rule of Two hardening framework and full detection guide inside.

Read More Claude Code GitHub Action Prompt Injection: How a Hidden HTML Comment Stole CI/CD Secrets and Bypassed Both Claude’s Safety Filters and GitHub’s Secret Scanner