Briefs

The disclosed exploits include a critical pre-authentication remote code execution vulnerability in libssh2 (CVE-2026-55200) and an authentication bypass vulnerability in self-hosted Gitea Docker deployments (CVE-2026-20896), which allows attackers to impersonate users and take over Git servers.

Cyber threat intelligence provider WhoisXML API identified 212 newly registered domains referencing the Venezuela earthquake between June 24 and June 28, 2026.

Google threat hunters report that Russian influence campaigns are increasingly targeting the EU and NATO, aiming to divide Western coalitions and advance Moscow's political and military objectives.

The new username functionality enables users to set a unique handle and share that instead of their personal phone number when initiating conversations.

A security researcher, operating under the pseudonym "Srikanth L" and affiliated with CashlessConsumer, has alleged that the IDRBT's Domain Registration Portal, the exclusive registrar for India's .bank.in namespace, exposed over 33 unauthenticated API endpoints.

The company's agentic security platform discovers, tests, and monitors AI agents to identify and mitigate vulnerabilities before and after deployment.

ESET reported that Gamaredon conducted 35 distinct spear-phishing campaigns targeting Ukrainian governmental and military institutions in 2025, primarily in the latter half of the year.

Nissan Americas disclosed in a filing to the California Attorney General that a cyber event involving Oracle's personnel records led to the potential theft of payroll information, bank details, and Social Security numbers.

The StegoAd campaign employed steganography to hide malicious JavaScript within image and font files, making the extensions appear legitimate and functional.

In a 6-3 decision, the Supreme Court ruled that the Fourth Amendment's protection against unreasonable searches and seizures applies to location data collected by companies like Google.