pwnspectrum | Daily Cybersecurity Intelligence

[CVE] CVE SPOTLIGHT

CVE-2026-48558 CVSS 9.0 Patch Now SimpleHelp SimpleHelp

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.

CISA KEV

CVE-2026-48286 CVSS 10.0 Patch Now Multiple Products

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre...

CVE-2026-56700 CVSS 9.8 Patch Now Multiple Products

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize...

CVE-2026-58449 CVSS 9.8 Patch Now Multiple Products

txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which performs __import__ and getattr on the c...

CVE-2026-58138 CVSS 9.8 Patch Now Multiple Products

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow def...

[0x01] ⚠️ IMMEDIATE VULNERABILITY AND THREAT INTEL

Critical CVE-2026-33017 https://feeds.feedburner.com/TheHackersNews 30 Jun 2026

Langflow RCE Exploitation Enables Monero Mining Activity (CVE-2026-33017)

Threat actors are actively exploiting a critical unauthenticated Remote Code Execution (RCE) vulnerability in Langflow. This flaw was used to deploy Monero cryptocurrency miners on exposed AI application endpoints. Organizations running Langflow should immediately apply patches and restrict public access to AI services.

Critical CVE-2026-8037 https://feeds.feedburner.com/TheHackersNews 30 Jun 2026

Progress Kemp LoadMaster Critical Flaw Allows Root Command Execution (CVE-2026-8037)

A critical vulnerability in Progress Kemp LoadMaster allows an unauthenticated attacker to execute arbitrary commands as root by sending a crafted request to the API. Patching is available, and high priority must be assigned to securing all appliance instances. Verify network access controls around LoadMaster APIs.

Critical CVE-2026-55957 https://www.gbhackers.com/feed/ 01 Jul 2026

Apache Tomcat Vulnerabilities Bypass Authentication and Security Constraints

Two disclosed security flaws in Apache Tomcat enable attackers to bypass authentication mechanisms and improperly enforce security constraints. Impacts range across various enterprise deployments utilizing the framework. Review network traffic for exploitation attempts and apply vendor patches immediately.

Critical https://www.bleepingcomputer.com/feed/ 30 Jun 2026

BlueHammer Privilege Escalation Flaw Exploited by Ransomware Gangs

Ransomware groups are currently confirmed exploiting a Microsoft Defender privilege escalation vulnerability known as BlueHammer. This weakness was previously noted in zero-day research. Apply all available security patches for Microsoft Defender components and monitor for unusual process creation.

Critical CVE-2026-31431 https://news.sophos.com/en-us/category/threat-research/feed/ 01 Jul 2026

Proof-of-Concept Exploit Available for Linux 'Copy Fail' Vulnerability (CVE-2026-31431)

A proof-of-concept exploit has been released targeting a vulnerability in the Linux Copy Fail function. This flaw represents a potential denial of service or memory corruption risk. System administrators should review kernel patching schedules and apply relevant security updates promptly.

[0x02] 🌐 SUPPLY CHAIN AND PLATFORM COMPROMISE

Critical CVE-2026-48027 https://www.cisa.gov/uscert/ncas/current-activity.xml 01 Jul 2026

CI/CD Pipelines Targeted by Multiple Software Supply Chain Intrusions

CISA is advising heightened vigilance regarding emerging supply chain intrusion campaigns targeting developer ecosystems and CI/CD pipelines. Specific incidents include compromises involving malicious Visual Studio Code extensions (e.g., Nx Console). Organizations must vet all third-party dependencies and maintain hardened pipeline security.

Critical https://news.sophos.com/en-us/category/threat-research/feed/ 01 Jul 2026

GitHub Internal Repository Breach via Malicious VS Code Extension

Private GitHub repositories were compromised after a malicious VS Code extension led to the cloning of internal codebases. These stolen assets are reportedly being sold on criminal forums. Teams must enforce strict policies regarding developer tooling and external extension usage.

Critical https://www.darkreading.com/rss.xml 01 Jul 2026

Continued Data Exfiltration from Salesforce via Compromised Klue App Integrations

Klue's integrated applications are being exploited as a vector to steal customer data from the Salesforce platform. This trend demonstrates reliance on third-party apps introduces risk. Implement least privilege access controls and scrutinize all connected app permissions.

Critical https://www.gbhackers.com/feed/ 30 Jun 2026

Bing SEO Poisoning Used in Intrusion Chain to Deploy Akira Ransomware

Threat actors are weaponizing Bing search engine optimization poisoning (SEO) as an initial access vector for a high-impact intrusion chain. This campaign culminates in the deployment of Akira ransomware. Organizations must monitor for unusual inbound traffic originating from highly specific, poisoned web sources.

[0x03] 📡 APT ACTIVITY AND TARGETED COMPROMISE

Critical https://securelist.com/feed/ 30 Jun 2026

ToddyCat APT Group Compromises Corporate Gmail Communications via OAuth Tokens

Analysis shows the ToddyCat APT group utilizing a new tool (Umbrij) to compromise corporate communications within Gmail. The attack targets weak authentication by exploiting improperly secured OAuth authorization tokens. MFA must be strictly enforced for all cloud service integrations.

Critical https://www.cisa.gov/uscert/ncas/alerts.xml 01 Jul 2026

Opportunistic Attacks Against Global Critical Infrastructure by Pro-Russia Hacktivists

Pro-Russian hacktivist groups are conducting opportunistic and broadly scoped attacks against US and global critical infrastructure. Defenders should assume exposure to geopolitical threat actors and heighten monitoring across core operational technology (OT) environments. Review joint CISA advisories for specific sectors.

Critical CVE-2026-12240 NVD 01 Jul 2026

WordPress Plugin Vulnerable to Arbitrary File Deletion (CVE-2026-12240)

The Export User Data plugin for WordPress has a vulnerability allowing authenticated users with subscriber-level access or higher to delete arbitrary files. Users must immediately patch the plugin and restrict user permissions within WP environments.

High https://news.sophos.com/en-us/category/security-operations/feed/ 01 Jul 2026

CISO Playbook for Strengthening Authentication Using Passkeys

This advisory provides guidance on implementing passkey technology to strengthen enterprise authentication workflows. CISOs should adopt a phased rollout approach, testing procedures in limited environments before mass deployment.

[0x04] 🛠️ PATCHING, MISC VULNERABILITIES & INCIDENTS

Critical CVE-2024-36401 https://www.cisa.gov/uscert/ncas/alerts.xml 01 Jul 2026

CISA Shares Lessons Learned from U.S. Federal Agency Incident Response Engagement

This report details CISA's process and lessons learned during an incident response engagement at a federal civilian agency. The focus is on detection maturity and effective coordination between internal teams and government partners. Organizations should review their own IR playbooks against these best practices.

Critical https://blog.malwarebytes.com/feed/ 01 Jul 2026

Chrome Browser Patches Critical Security Flaws, Including WebGL Sandbox Escapes

Google has released an update patching 18 vulnerabilities in Chrome, including four critical flaws. Notably, two WebGL bugs were fixed to prevent attackers from escaping the browser's security sandbox. Users must ensure their browsers are updated immediately.

Critical https://blog.malwarebytes.com/feed/ 01 Jul 2026

Microsoft Removes Over 100 Edge Extensions Found Delivering Malware

Microsoft has proactively removed a significant number of malicious extensions from the Edge browser ecosystem. This highlights ongoing risks associated with third-party software installations and browser security posture. Users must validate extension integrity before installation.

Critical https://news.sophos.com/en-us/category/security-operations/feed/ 01 Jul 2026

Integration of Sophos Threat Intel into Microsoft 365 Copilot

This advisory details the integration of specialized threat intelligence capabilities from Sophos directly into the M365 Copilot ecosystem. This enhances security monitoring by embedding TI at the generation level. Review how third-party security tools can augment generative AI services.

Medium Unknown 01 Jul 2026

Supply Chain Compromises Impact Nx Console and GitHub Repositories

CISA is prioritizing the response to multiple emerging software supply chain intrusion campaigns targeting developer ecosystems. Recent incidents involved malicious tools (e.g., Nx Console) impacting development environments. Developers must secure their local machines and vet all CI/CD dependencies.

[0x05] 💰 RANSOMWARE AND CRIME OPERATIONS

Critical https://www.bleepingcomputer.com/feed/ 30 Jun 2026

Blackfield Ransomware Demands $2 Million From Nidec Corporation

The Blackfield ransomware group reportedly demanded a $2 million ransom payment from Nidec Corporation. This exemplifies the high-value targeting and financial motivation of sophisticated groups against large manufacturers. Focus resilience efforts on detection and recovery, not negotiation.

[0x06] CYBERSECURITY VIDEOS

📚 Tutorial

How to Learn C Language (For Hackers)

CyberFlow ↗

🎯 CTF Solve

PicoCTF: Hidden in Plain Sight | Forensics Challenge | Complete Solution | PicoMini by CMU-Africa

God᭄ỔḞகிங்࿐K ↗

🎯 CTF Solve

Beyond CTF Labs

John Hammond ↗

📰 News

AI Bug Hunting Tool – Automate Recon, Find Bugs, Make Money

Exploit Mastery ↗

📰 News

SCOTUS Limits Geofence Warrants 6-3, $10M Bounty on Russian Signal Hackers, Oracle EBS Exploited

The CyberHub Podcast ↗

📰 News

This New Malware Bypasses Windows Security Like a Pro (SharkLoader) - TeluguHackNews

TeluguHackNews ↗

[0x08] BUG BOUNTY HIGHLIGHTS

Medium Daimler Truck

Report #3642934 — Daimler Truck (Activities::BugResolved)

Medium MercadoLibre

Report #3758001 — MercadoLibre (Activities::BugResolved)

Medium MercadoLibre

Report #3743045 — MercadoLibre (Activities::BugResolved)

Medium MercadoLibre

Report #3725034 — MercadoLibre (Activities::BugResolved)

Medium MercadoLibre

Report #3718011 — MercadoLibre (Activities::BugResolved)

[0x09] EXPLOIT-DB FRESH DROPS

WebApps Multiple

[webapps] OpenEMR 7.0.2 - Arbitrary File Read

WebApps Multiple

[webapps] WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection

WebApps Multiple

[webapps] Drupal Core 10.5.5 - Error-Based SQL Injection

WebApps Multiple

[webapps] WordPress OrderConvo 14 - Path Traversal

Remote Multiple

[remote] Notepad++ 8.9.6 - Arbitrary Code Execution

[0x0a] UPCOMING CTFs

Jeopardy Weight: 0.0

MindBreak 2026 by ESGI

Jul 3, 21:00 UTC 9 hours

CTFTime ↗ Register ↗

Jeopardy Weight: 23.5

No Hack No CTF 2026

Jul 4, 00:00 UTC 2 days

CTFTime ↗ Register ↗

Jeopardy Weight: 36.0

R3CTF 2026

Jul 4, 02:00 UTC 2 days

CTFTime ↗ Register ↗

Jeopardy Weight: 0.0

Fluid Attacks' CTF 2026-2

Jul 4, 13:00 UTC 12 hours

CTFTime ↗ Register ↗

Jeopardy Weight: 0.0

LYKNCTF

Jul 6, 00:00 UTC 2 days

CTFTime ↗ Register ↗

[0x0b] SECURITY PODCASTS

Darknet Diaries

175: Bayrob

01:36:35

Listen ↗

Risky Business

Risky Business #843 -- Fortibleed is kinda awesome, actually

3815

Listen ↗

Security Now

SN 1085: A SOTA State-Sponsored Campaign - AI's New Superpower: Loop Engineering

2:50:15

Listen ↗

SANS Internet Storm Center

SANS Stormcast Wednesday, July 1st, 2026: Apple Patches; SimpleHelp Exploit; Git DNS Tricks;

4:53

Listen ↗

[0xff] ARCHIVE

Keyboard Shortcuts

Focus search/

Next articlej

Previous articlek

Open article linkEnter

Toggle TL;DR modet

Toggle themed

Listen to briefinga

Close overlayEsc

Show shortcuts?