TECHZONE™

Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs https://thehackernews.com/2026/07/apple-fixes-hide-my-email-bug-that.html Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guarantees. 404 Media reported Tuesday that a fix for the issue was deployed by Apple on July 3, 2026, after more than a year, when it was disclosed to the company by Tyler Murphy, co-founder of EasyOptOuts. Hide My Email

AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code https://thehackernews.com/2026/07/aws-kiro-flaw-let-poisoned-web-page.html Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to summarize a page could end in remote code execution. AWS has patched the issue, and no CVE has been

Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities https://thehackernews.com/2026/07/google-launches-gemini-35-flash-cyber.html Google's DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber, a specialized artificial intelligence (AI) model built atop 3.5 Flash that's designed to discover, validate, and patch vulnerabilities quickly and efficiently. According to the tech giant, the model will be exclusively available to governments and trusted partners via CodeMender as part of a limited-access pilot

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities https://thehackernews.com/2026/07/zimbra-patches-critical-snmp-command.html Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component. As many as nine security vulnerabilities have been patched in Zimbra 10.1.20. Topping the list is a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled. Also patched

Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs https://thehackernews.com/2026/07/open-source-android-ai-agents-could-let.html An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six other attacks, against five open-source mobile agent frameworks: AppAgent, AppAgentX,

N-day is Becoming N-Hour. Patching Faster Won't Save You. https://thehackernews.com/2026/07/n-day-is-becoming-n-hour-patching.html Every patch is a confession. The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn that diff back into a working exploit, and you can hit every system that hasn't updated yet. This is N-day exploitation, and it's always been a race: the vendor patches, the clock starts, and defenders try to deploy

New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit https://thehackernews.com/2026/07/new-bit2watt-attack-could-let-cloud.html A cloud tenant using nothing but ordinary GPU access can push a data center's power draw up and down fast enough to threaten the grid it runs on, with no exploit and no break-in. That is the claim behind Bit2Watt, described by three Zhejiang University researchers in a paper accepted to CHES 2026, the IACR's hardware-security conference, and the evidence splits in two: they measured the power

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites. The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell. "By the early hours of Saturday morning (UTC), successful exploitation was already well

New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry

Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it's observing in-the-wild exploitation of CVE-2026-6875 (CVSS score: 9.5), a sandbox escape vulnerability that could allow an unauthenticated user to run arbitrary code. Patches for the flaw were

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit. "FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP

Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV. What makes it more than a

HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. Group-IB, which named the malware HollowGraph, says the approach moves tasking and stolen data through legitimate Microsoft Graph API traffic, so the activity looks

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More https://thehackernews.com/2026/07/weekly-recap-wordpress-rce-sonicwall-0.html A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch. Here is the full

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) - Published on July 18, 2026 Dendreo (versions 1.1.3, 1.1.4) -

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.0.3.1; anyone on an earlier build should upgrade. Triggering it can crash or restart the worker, causing a denial of

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware. According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia's

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access https://thehackernews.com/2026/07/sonicwall-sma-zero-days-exploited.html A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity under the moniker UTA0533. The discovery was made following an incident response investigation earlier this