Archive snapshot

Tue, Jul 21 · 06:03 AM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Tue, Jul 21 · 06:00 AM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

5

Worth skimming

5

Tracked videos

2

NVD vulnerabilities

25

Top stories

Tue, 21 Jul 2026 13:04:32 +0530

New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

9.8/10 · Must read/watch

The Hacker Newsmalwareai

Summary
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed t

Open article ↗

Tue, 21 Jul 2026 11:59:26 +0530

Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution

9.8/10 · Must read/watch

The Hacker Newsvulnaiidentity

Summary
Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it's observing in-the-wild exploitation of CVE-2026-6875 (CVSS s

Open article ↗

Tue, 21 Jul 2026 14:29:30 +0530

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

9.3/10 · Must read/watch

The Hacker Newsvulnidentity

Summary
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites. The two security flaws, tracked as CVE-2026-63030 and CVE

Open article ↗

Tue, Jul 21 · 06:00 AM CDT

Researchers Uncover North Korean 'ClickFake' Campaign Targeting Web3 Pros

8.7/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Tue, Jul 21 · 06:00 AM CDT

JadePuffer Returns With Ransomware Designed to Wipe AI Models

8.5/10 · Worth your time

Infosecurity Magazinemalwareai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Worth skimming

Tue, Jul 21 · 06:00 AM CDT

Researchers Build WordPress Exploit Using OpenAI's GPT

8.5/10 · Worth your time

Infosecurity Magazinevulnai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Tue, Jul 21 · 06:00 AM CDT

US Hospital Finance Software Provider Craneware Reports Data Theft

8.2/10 · Worth your time

Infosecurity Magazinegeneral

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Tue, Jul 21 · 04:00 AM CDT

Qwen-Image-3.0: Rich Content, Authentic Details, Deep Knowledge

8.1/10 · Worth your time

Hacker Newsaiidentity

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 2 hours ago.

Open article ↗

Tue, Jul 21 · 06:00 AM CDT

Government Agencies Falling Victim to Ransomware Daily, Warns Study

8.0/10 · Worth your time

Infosecurity Magazinemalwareaipolicy

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Tue, Jul 21 · 06:00 AM CDT

CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities

8.0/10 · Worth your time

Infosecurity Magazinevuln

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Videos worth watching

Mon, Jul 20 · 09:02 AM CDT

Redirect Chain Abuse

8.1/10 · Worth your time

YouTube / John Hammondai

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Summary
Attackers are increasingly abusing legitimate redirect services to make phishing campaigns harder to detect.I walk through how trusted vendor domains, email ...

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

Mon, Jul 20 · 08:45 AM CDT

Microsoft Exchange Hacked, Five Years Later

7.6/10 · Worth your time

YouTube / John Hammondgeneral

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Summary
We've been sitting on this full story for five years. Silk Typhoon, sometimes called HAFNIUM, ran the 2021 Microsoft Exchange campaign that compromised 88,00...

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

NVD vulnerabilities

Mon, Jan 19 · 06:16 PM CST

CVE-2026-22797

9.9/10 · Must read/watch

NVDvuln

Summary
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such

CVECVE-2026-22797

SeverityCRITICAL

TypeUPDATED

PublishedMon, Jan 19 · 06:16 PM CST

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Mon, Jan 29 · 02:15 PM CST

CVE-2024-1015

9.8/10 · Must read/watch

NVDvuln

Summary
Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device.

CVECVE-2024-1015

SeverityCRITICAL

TypeUPDATED

PublishedMon, Jan 29 · 02:15 PM CST

ModifiedMon, Jul 20 · 02:16 PM CDT

Open article ↗

Tue, Jun 11 · 05:15 PM CDT

CVE-2024-30080

9.8/10 · Must read/watch

NVDvuln

Summary
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

CVECVE-2024-30080

SeverityCRITICAL

TypeUPDATED

PublishedTue, Jun 11 · 05:15 PM CDT

ModifiedMon, Jul 20 · 04:16 PM CDT

Open article ↗

Tue, Jan 20 · 07:15 PM CST

CVE-2025-56005

9.8/10 · Must read/watch

NVDvuln

Summary
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code v

CVECVE-2025-56005

SeverityCRITICAL

TypeUPDATED

PublishedTue, Jan 20 · 07:15 PM CST

ModifiedMon, Jul 20 · 12:17 PM CDT

Open article ↗

Wed, Mar 18 · 12:16 AM CDT

CVE-2026-27459

9.8/10 · Must read/watch

NVDvuln

Summary
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values t

CVECVE-2026-27459

SeverityCRITICAL

TypeUPDATED

PublishedWed, Mar 18 · 12:16 AM CDT

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Wed, Feb 25 · 03:16 AM CST

CVE-2026-27606

9.8/10 · Must read/watch

NVDvuln

Summary
Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output file

CVECVE-2026-27606

SeverityCRITICAL

TypeUPDATED

PublishedWed, Feb 25 · 03:16 AM CST

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Fri, Mar 06 · 07:16 AM CST

CVE-2026-28802

9.8/10 · Must read/watch

NVDvuln

Summary
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was e

CVECVE-2026-28802

SeverityCRITICAL

TypeUPDATED

PublishedFri, Mar 06 · 07:16 AM CST

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Fri, Mar 06 · 07:16 PM CST

CVE-2026-29063

9.8/10 · Must read/watch

NVDvuln

Summary
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVECVE-2026-29063

SeverityCRITICAL

TypeUPDATED

PublishedFri, Mar 06 · 07:16 PM CST

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Wed, Mar 18 · 04:17 AM CDT

CVE-2026-31938

9.6/10 · Must read/watch

NVDvuln

Summary
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the

CVECVE-2026-31938

SeverityCRITICAL

TypeUPDATED

PublishedWed, Mar 18 · 04:17 AM CDT

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Tue, Mar 24 · 12:16 AM CDT

CVE-2026-33211

9.6/10 · Must read/watch

NVDvuln

Summary
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `Resolut

CVECVE-2026-33211

SeverityCRITICAL

TypeUPDATED

PublishedTue, Mar 24 · 12:16 AM CDT

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Fri, Feb 20 · 09:19 PM CST

CVE-2026-25896

9.3/10 · Must read/watch

NVDvuln

Summary
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (&

CVECVE-2026-25896

SeverityCRITICAL

TypeUPDATED

PublishedFri, Feb 20 · 09:19 PM CST

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Mon, Mar 16 · 06:16 PM CDT

CVE-2026-27962

9.1/10 · Must read/watch

NVDvuln

Summary
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization fu

CVECVE-2026-27962

SeverityCRITICAL

TypeUPDATED

PublishedMon, Mar 16 · 06:16 PM CDT

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Fri, Mar 20 · 11:16 PM CDT

CVE-2026-33186

9.1/10 · Must read/watch

NVDvuln

Summary
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g.,

CVECVE-2026-33186

SeverityCRITICAL

TypeUPDATED

PublishedFri, Mar 20 · 11:16 PM CDT

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Mon, Mar 23 · 06:16 AM CDT

CVE-2026-4599

9.1/10 · Must read/watch

NVDvuln

Summary
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accep

CVECVE-2026-4599

SeverityCRITICAL

TypeUPDATED

PublishedMon, Mar 23 · 06:16 AM CDT

ModifiedMon, Jul 20 · 12:19 PM CDT

Open article ↗

Tue, Jun 11 · 05:15 PM CDT

CVE-2024-30068

8.8/10 · Worth your time

NVDvuln

Summary
Windows Kernel Elevation of Privilege Vulnerability

CVECVE-2024-30068

SeverityHIGH

TypeUPDATED

PublishedTue, Jun 11 · 05:15 PM CDT

ModifiedMon, Jul 20 · 04:16 PM CDT

Open article ↗

Tue, Jun 11 · 05:15 PM CDT

CVE-2024-30078

8.8/10 · Worth your time

NVDvuln

Summary
Windows Wi-Fi Driver Remote Code Execution Vulnerability

CVECVE-2024-30078

SeverityHIGH

TypeUPDATED

PublishedTue, Jun 11 · 05:15 PM CDT

ModifiedMon, Jul 20 · 04:16 PM CDT

Open article ↗

Tue, Jun 11 · 05:15 PM CDT

CVE-2024-30097

8.8/10 · Worth your time

NVDvuln

Summary
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability

CVECVE-2024-30097

SeverityHIGH

TypeUPDATED

PublishedTue, Jun 11 · 05:15 PM CDT

ModifiedMon, Jul 20 · 04:16 PM CDT

Open article ↗

Tue, Jun 11 · 05:15 PM CDT

CVE-2024-30103

8.8/10 · Worth your time

NVDvuln

Summary
Microsoft Outlook Remote Code Execution Vulnerability

CVECVE-2024-30103

SeverityHIGH

TypeUPDATED

PublishedTue, Jun 11 · 05:15 PM CDT

ModifiedMon, Jul 20 · 04:16 PM CDT

Open article ↗

Tue, Jun 11 · 05:16 PM CDT

CVE-2024-35249

8.8/10 · Worth your time

NVDvuln

Summary
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

CVECVE-2024-35249

SeverityHIGH

TypeUPDATED

PublishedTue, Jun 11 · 05:16 PM CDT

ModifiedMon, Jul 20 · 04:16 PM CDT

Open article ↗

Tue, Jan 27 · 04:16 PM CST

CVE-2025-15467

8.8/10 · Worth your time

NVDvuln

Summary
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structure

CVECVE-2025-15467

SeverityHIGH

TypeUPDATED

PublishedTue, Jan 27 · 04:16 PM CST

ModifiedMon, Jul 20 · 12:16 PM CDT

Open article ↗

Mon, Mar 23 · 06:16 AM CDT

CVE-2026-4601

8.7/10 · Worth your time

NVDvuln

Summary
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then s

CVECVE-2026-4601

SeverityHIGH

TypeUPDATED

PublishedMon, Mar 23 · 06:16 AM CDT

ModifiedMon, Jul 20 · 12:19 PM CDT

Open article ↗

Wed, Jan 31 · 10:15 PM CST

CVE-2024-21626

8.6/10 · Worth your time

NVDvuln

Summary
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a

CVECVE-2024-21626

SeverityHIGH

TypeUPDATED

PublishedWed, Jan 31 · 10:15 PM CST

ModifiedMon, Jul 20 · 12:16 PM CDT

Open article ↗

Thu, Feb 05 · 04:15 AM CST

CVE-2025-61732

8.6/10 · Worth your time

NVDvuln

Summary
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

CVECVE-2025-61732

SeverityHIGH

TypeUPDATED

PublishedThu, Feb 05 · 04:15 AM CST

ModifiedMon, Jul 20 · 12:17 PM CDT

Open article ↗

Wed, Mar 25 · 08:16 PM CDT

CVE-2026-33216

8.6/10 · Worth your time

NVDvuln

Summary
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions

CVECVE-2026-33216

SeverityHIGH

TypeUPDATED

PublishedWed, Mar 25 · 08:16 PM CDT

ModifiedMon, Jul 20 · 12:18 PM CDT

Open article ↗

Tue, Jun 11 · 05:16 PM CDT

CVE-2024-37325

8.1/10 · Worth your time

NVDvuln

Summary
Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability

CVECVE-2024-37325

SeverityHIGH

TypeUPDATED

PublishedTue, Jun 11 · 05:16 PM CDT

ModifiedMon, Jul 20 · 04:16 PM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.