Threat Library

Zimbra has issued an advisory for a critical stored cross-site scripting vulnerability in its Classic Web Client that can be triggered by specially crafted emails, allowing attackers to execute malicious scripts within a victim's active session. No CVE identifier has been assigned yet, but customers are urged to apply updates immediately.

Suspected China- and India-aligned APT groups conducted a sustained, multi-year cyber espionage campaign (February 2024 to April 2026) against Pakistani law enforcement organizations, including the Balochistan Police. Attackers compromised servers hosting public-facing web applications used to manage sensitive police and citizen data, including criminal records.

The popular jscrambler npm package was compromised, with a malicious 8.14.0 release published on July 11, 2026 that executes a Rust-based infostealer via a preinstall hook during npm install. The attack drops platform-specific native binaries for Windows, macOS, and Linux, meaning any developer or CI/CD system installing this version is automatically compromised. Socket detected the malicious release within six minutes of publication, but organizations that auto-updated or pulled the package before detection remain at risk.

Progress Software has issued an urgent advisory urging ShareFile customers running on-premises Storage Zone Controllers to immediately shut down their servers due to a credible, unspecified external security threat. No CVE or technical details have been publicly disclosed yet, but the severity of the recommendation (full shutdown) suggests a serious, potentially actively exploited vulnerability. Organizations using ShareFile Storage Zone Controllers should treat this as an active incident and act on vendor guidance without delay.

Researchers demonstrated 'Ghostcommit,' a technique that hides prompt injection instructions inside a PNG image committed to a repository. AI code review tools like CodeRabbit and Bugbot don't inspect image contents, but a downstream coding agent that does process the image can be tricked into reading a repo's .env file and exfiltrating secrets by encoding them as numeric data in code. This shows a real, demonstrated cross-modal injection vector with tangible secret-theft impact, not a theoretical concern.

The Australian Cyber Security Centre has warned of an ongoing global campaign in which threat actors are exploiting vulnerabilities in content management systems (CMS) and their plugins to gain unauthorized access to web servers. The campaign appears opportunistic, scanning for and exploiting unpatched or misconfigured CMS installations at scale. Organizations running public-facing CMS platforms are urged to patch immediately and audit for signs of compromise.

Siemens Mendix Studio Pro contains a code injection vulnerability (CVE-2026-48192) in its build pipeline file parsing logic, allowing arbitrary code execution when a user opens a specially crafted malicious project. Exploitation requires user interaction and local access, limiting the attack surface but posing risk to developers and organizations using Mendix for low-code application development.

Hydro-Québec's Le Circuit Electrique EV charging station backend contains three vulnerabilities—an unauthenticated websocket endpoint, lack of authentication attempt throttling, and insufficient session/connection controls—that could allow privilege escalation or denial-of-service attacks. The most severe flaw (CVSS 9.8) permits unauthenticated connections to the charging station's OCPP websocket, enabling attackers to potentially impersonate charging stations or escalate privileges. Hydro-Québec has mitigated most affected stations by disabling OCPP or adding authentication.

PraisonAI, an AI agent framework, contains a critical vulnerability in its AICoder component that allows attackers to abuse LLM tool-calling functionality to write files anywhere on the filesystem and execute arbitrary commands with root privileges. Exploitation can occur via malicious prompt injection through the chat interface, requiring no prior authentication or system access in many deployments. Given the CVSS score of 9.9, this represents a full system compromise vector for any organization running affected PraisonAI versions.

PraisonAI versions prior to 4.6.78 contain an unvalidated dimension parameter in the PGVector and Cassandra knowledge-store create_collection() functions, allowing attackers to inject arbitrary SQL/CQL into the generated DDL statement. Any caller able to influence collection creation—including downstream API consumers or agent orchestration logic—can execute destructive or data-exfiltrating database commands, resulting in a critical 9.8 CVSS-rated vulnerability.

The miniOrange Social Login and Register plugin for WordPress (versions up to 7.7.0) contains a critical authentication bypass allowing unauthenticated attackers to take over any account, including administrators. The flaw stems from unvalidated email input during OAuth profile completion combined with a weak, offline-crackable OTP scheme, enabling full site compromise. Given the 9.8 CVSS score and low attack complexity, mass exploitation against internet-facing WordPress sites is likely once a working exploit circulates.

A critical path traversal vulnerability in JetBrains IntelliJ IDEA allows remote code execution through manipulation of project workspace ID handling. With a CVSS score of 9.6, this flaw could allow attackers to execute arbitrary code on developer workstations, potentially via malicious project files or shared workspace configurations.

A critical SSRF vulnerability in the guardrails-detectors component allows remote attackers to submit malicious XSD schemas that trigger out-of-band requests to internal services. Exploitation can expose cloud metadata credentials, Kubernetes API tokens, MinIO endpoints, and local files such as service account tokens, enabling further lateral movement and privilege escalation.

PraisonAI's CodeAgent executes LLM-generated Python code with no AST validation, import restrictions, or sandboxing, allowing an attacker who can influence the LLM's output via prompt injection to achieve full remote code execution on the host. This gives attackers a direct path to exfiltrate all environment secrets and compromise the underlying system, making it a maximum-severity flaw.

PraisonAI versions before 4.6.78 ship with a prompt injection defense that only blocks CRITICAL-severity threats by default, letting HIGH-severity attacks such as instruction overrides pass through with only logging. This allows attackers to extract system prompts and trigger unauthorized tool calls via single-vector injection attempts that the framework detects but fails to stop.

Security researchers at Binarly disclosed six new vulnerabilities in U-Boot, the widely used open-source bootloader found in routers, IoT devices, and data-center server management chips (BMCs). Four flaws can cause denial-of-service crashes, while two allow arbitrary code execution if an attacker can present a malicious boot image to the device before the OS loads. Exploitation requires local or supply-chain-level access to the boot process, but successful attacks grant persistence below the operating system, making detection and remediation difficult.

Threat actors compromised the Injective Labs SDK GitHub repository and published a malicious version of the @injectivelabs/sdk-ts npm package embedded with fake telemetry code designed to steal cryptocurrency wallet private keys and mnemonic seed phrases. Developers and automated systems that installed the compromised version (1.20.21) are at risk of credential and asset theft.

Progress Software has urgently instructed ShareFile customers to shut down Windows servers hosting Storage Zone Controllers in response to a credible external security threat. The company has proactively disabled access to affected accounts while investigating with internal and external security teams, though no CVE or technical exploit details have been publicly disclosed yet. This mirrors past Progress Software incidents (e.g., MOVEit) where file-transfer products were mass-exploited via zero-days.

Dutch police report strong indications that Dutch hackers were behind a February breach at telecommunications provider Odido. Details on the attack vector, data exfiltrated, and threat actor identity remain limited at this stage of the investigation.

An Armenian national has pleaded guilty in U.S. federal court to participating in Ryuk ransomware attacks against American companies, facing up to 15 years in prison. This is a legal/law enforcement development rather than a new active threat campaign, though it underscores the continued prosecution of Ryuk-affiliated actors.