OpenSSL patches DTLS heap-disclosure flaw CVE-2026-84782
OpenSSL fixed CVE-2026-84782, a high-severity DTLS flaw that can leak unencrypted heap memory or crash DTLS apps; WolfSSL 5.9.4 separately patched three high-severity auth-bypass flaws.
Newsroom
Star Blizzard hits 100+ orgs with RedFlick, CosmicPulse backdoor
Microsoft ties 13 phishing campaigns since January to Russia's Star Blizzard, using a new RedFlick delivery technique to drop the CosmicPulse backdoor at 100+ US/UK orgs.
TeamViewer patches CVE-2026-92370 access-control bypass (CVSS 8.8)
TeamViewer's 15.82 release fixes five high-severity flaws, led by CVE-2026-92370 (CVSS 8.8), a session access-control bypass that can lead to code execution. No exploitation reported yet.
WatchGuard patches critical Fireware OS RCE (CVE-2026-86131)
WatchGuard fixed CVE-2026-86131 (CVSS 9.2), a code-injection flaw letting a malicious BOVPN-over-TLS server run root commands on a connecting Firebox, plus 13 more high-severity Fireware OS bugs.
Apple patches exploited CoreGraphics zero-day (CVE-2026-86950)
Apple shipped iOS/iPadOS 26.7.1 and macOS 15.8.1/26.7.1 for CVE-2026-86950, a CoreGraphics out-of-bounds write used in targeted attacks and reported by Meta.
Citrix patches exploited NetScaler zero-days (CVE-2026-88771, CVSS 9.5)
Citrix patched eight NetScaler ADC/Gateway flaws, two exploited as zero-days. CVE-2026-88771 hits default configs; a public PoC exists and web shells are being dropped.
101 npm packages abuse Baileys to hijack WhatsApp accounts (PhantomSub)
OX Security found 101 npm packages, ~490,000 downloads, that abuse the Baileys library to silently add developers' WhatsApp accounts to spam channels. Most are still live.
Spectre-v2 BTR attack leaks Linux root hash on patched Intel CPUs
VUSec's Branch Target Reuse attack revives Spectre-v2 through JIT engines, leaking a Linux root password hash in minutes on fully patched Intel systems. Kernel fixes are merged.
Estée Lauder confirms Oracle EBS zero-day breach in Cl0p campaign
Estée Lauder notified the California AG on July 21 that Cl0p exploited Oracle EBS CVE-2025-61882 to steal HR data — names, SSNs, passports, bank accounts, health records — starting August 2025.