https://hackproject.pages.dev/en/Daily Threat Intelligenceenhttps://hackproject.pages.dev/en/a/langflow-validate-rce-en.htmlhttps://hackproject.pages.dev/en/a/langflow-validate-rce-en.htmlWed, 22 Jul 2026 08:00:00 +0100Langflow is a visual tool for building flows and agents on top of language models. The function meant to «validate» user-supplied code, validate_code(), instead passes it to exec() with no sandbox: CVE-2026-0770 lets an unauthenticated attacker run arbitrary commands on the server. CVSS 9.8. Added to the CISA KEV catalog on 21 July 2026, with public proof-of-concept code already available. Patch now and keep instances off the public internet.https://hackproject.pages.dev/en/a/wordpress-wp2shell-en.htmlhttps://hackproject.pages.dev/en/a/wordpress-wp2shell-en.htmlWed, 22 Jul 2026 08:00:00 +0100WordPress runs a huge share of the public web. Two flaws in its core — a SQL injection in WP_Query (CVE-2026-60137) and a REST API batch-route confusion (CVE-2026-63030) — chained into an exploit dubbed "WP2Shell" let an unauthenticated attacker run code remotely on a default install. Disclosed on 17 July, exploited within days, added to the CISA KEV catalog on 21 July. WordPress shipped patches and force-pushed them via auto-update.https://hackproject.pages.dev/en/a/joomla-upload-rce-wave-en.htmlhttps://hackproject.pages.dev/en/a/joomla-upload-rce-wave-en.htmlMon, 20 Jul 2026 08:00:00 +0100In a few weeks four widely installed Joomla extensions — SP Page Builder, iCagenda, PageBuilder CK and Balbooa Forms — landed in CISA's catalog of exploited vulnerabilities, all with the same flaw: an endpoint reachable with no login that accepts a file upload without checking its type. The result is a PHP web shell executed on the server. In at least one case the observed payload plants a hidden Super Administrator with an @secure.local email and scatters "PHP File manager" backdoors across several folders. No named actor: what stands out is the same mistake repeated in different products.https://hackproject.pages.dev/en/a/oracle-ebs-payments-en.htmlhttps://hackproject.pages.dev/en/a/oracle-ebs-payments-en.htmlMon, 20 Jul 2026 08:00:00 +0100Oracle Payments is the payment engine inside Oracle E-Business Suite: the point where the company's finance applications talk to banks and card networks. CVE-2026-46817 (CVSS 9.8) lets an unauthenticated attacker with only HTTP access compromise and take over the module. The exploit hits the ibytransmit endpoint of the File Transmission component, which invokes an internal Java function directly: patched in late May, the flaw was exploited in the wild from 27 June — before any public PoC — and added to the CISA KEV catalog on 15 July.https://hackproject.pages.dev/en/a/simplehelp-oidc-bypass-en.htmlhttps://hackproject.pages.dev/en/a/simplehelp-oidc-bypass-en.htmlMon, 20 Jul 2026 08:00:00 +0100SimpleHelp is remote-support software: whoever controls it controls the computers it manages. CVE-2026-48558 (CVSS 10.0) is an authentication bypass in the OIDC flow: when single sign-on is configured, identity tokens were accepted without verifying their cryptographic signature. A remote, unauthenticated attacker could therefore submit a forged token with arbitrary claims and obtain a full technician session — in some configurations bypassing MFA too. The flaw was exploited in the wild to deliver the TaskWeaver loader and the Djinn stealer, and was added to the CISA KEV catalog on 29 June.https://hackproject.pages.dev/en/a/fortisandbox-oscmd-en.htmlhttps://hackproject.pages.dev/en/a/fortisandbox-oscmd-en.htmlSun, 19 Jul 2026 08:00:00 +0100FortiSandbox is the box where suspicious files are detonated safely. Two unauthenticated OS command injection flaws — one in the WEB UI, one in an API endpoint — let anyone execute commands on the appliance itself. Patched quietly in April and June under a "Known Exploited: No" label, both were added to the CISA KEV catalog on 16 July: a sign someone had started using them, with the patch already months old.https://hackproject.pages.dev/en/a/sonicwall-sma1000-mfa-en.htmlhttps://hackproject.pages.dev/en/a/sonicwall-sma1000-mfa-en.htmlSat, 18 Jul 2026 08:00:00 +0100Two zero-days in SonicWall SMA1000 remote-access appliances, chained and exploited before disclosure. The first is an unauthenticated SSRF with a maximum score; the second reaches root. But the detail that matters is what they took: not just passwords, the TOTP MFA seeds and the active session databases — the one thing a reset does not rotate.https://hackproject.pages.dev/en/a/apt28-router-dns-en.htmlhttps://hackproject.pages.dev/en/a/apt28-router-dns-en.htmlWed, 15 Jul 2026 08:00:00 +0100APT28 turned thousands of home routers into a wiretapping network aimed at foreign ministries and law enforcement, hijacking DNS to steal already-authenticated OAuth tokens. No exotic malware — just the least-defended infrastructure on earth, and a US court order letting the FBI reach into five thousand privately owned devices to clean them up.https://hackproject.pages.dev/en/a/axios-npm-en.htmlhttps://hackproject.pages.dev/en/a/axios-npm-en.htmlWed, 15 Jul 2026 08:00:00 +0100On 31 March 2026 two malicious axios releases added a booby-trapped dependency without touching a single line of source code. npm had rolled out OIDC Trusted Publishing to stop exactly this. The actor walked around it with an old classic token.https://hackproject.pages.dev/en/a/medusa-ummc-en.htmlhttps://hackproject.pages.dev/en/a/medusa-ummc-en.htmlWed, 15 Jul 2026 08:00:00 +0100On 19 February 2026 Mississippi's largest health system went dark: 35 clinical sites shut, the state's only Level I trauma center paralysed. But the instructive story isn't how they got in — nobody has made that public — it's how the oncology unit rebuilt a working clinic with no IT at all.https://hackproject.pages.dev/en/a/qilin-checkpoint-en.htmlhttps://hackproject.pages.dev/en/a/qilin-checkpoint-en.htmlWed, 15 Jul 2026 08:00:00 +0100A logic flaw in certificate validation during the IKEv1 key exchange let attackers open an authenticated Check Point VPN session without knowing any password. Qilin had been using it for a month before the vendor noticed. But the bug isn't the story — the story is that it only bites organisations that never switched off a dead protocol.https://hackproject.pages.dev/en/a/splunk-cve-2026-20253-en.htmlhttps://hackproject.pages.dev/en/a/splunk-cve-2026-20253-en.htmlWed, 15 Jul 2026 08:00:00 +0100CVSS 9.8, pre-auth, RCE. The flaw isn't in Splunk proper but in an internal PostgreSQL component that accepts whatever credential you hand it. A pre-auth hole in the tool companies buy to notice intrusions.https://hackproject.pages.dev/en/a/storm2603-warlock-en.htmlhttps://hackproject.pages.dev/en/a/storm2603-warlock-en.htmlWed, 15 Jul 2026 08:00:00 +0100Storm-2603 abuses an authentication bypass in SmarterMail to install Velociraptor as a C2 and stage Warlock ransomware. But the detail that matters surfaced later: inside one compromised network Microsoft found two unrelated crews working in parallel, each unknowingly covering the other's tracks.https://hackproject.pages.dev/en/a/volt-typhoon-ot-en.htmlhttps://hackproject.pages.dev/en/a/volt-typhoon-ot-en.htmlWed, 15 Jul 2026 08:00:00 +0100For five years Volt Typhoon hid inside US critical infrastructure and touched nothing. In 2026 Dragos catches it manipulating engineering workstations to learn which conditions halt an industrial process. And it no longer sources its own access — a broker inside its own apparatus hands it over.