Continue reading the full briefing.
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS…
Why it matters: CVE-2026-70615 belongs in an exploit-led queue only after the affected product is matched to a reachable asset and accountable owner.
What to verify: Confirm the affected version and reachable component, preserve useful telemetry, apply the publisher guidance, and record the evidence used to close the item.
Open the original source record
CVE-2026-53977: OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers…
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of…
Why it matters: CVE-2026-53977 concerns a trust decision rather than a cosmetic defect. If the affected path is reachable, an attacker may cross a role, tenant, or login boundary.
What to verify: Reproduce the expected access checks safely, identify exposed roles and tenants, invalidate risky sessions or tokens, patch the decision point, and retest denied cases.
CVE-2026-53985: Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the…
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator…
Why it matters: CVE-2026-53985 participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
CVE-2026-43622: Llama.cpp builds b1886 through b7445 contain a double free vulnerability in the…
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.
Why it matters: CVE-2026-43622 belongs in an exploit-led queue only after the affected product is matched to a reachable asset and accountable owner.
What to verify: Confirm the affected version and reachable component, preserve useful telemetry, apply the publisher guidance, and record the evidence used to close the item.
Coverage by security desk
Exploited and critical vulnerabilities
- CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability – CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability This…
- CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability – CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path…
- CVE-2026-9198: IBM Langflow Code Injection Vulnerability – CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9198 IBM Langflow Code Injection Vulnerability CVE-2026-18556 N-able N-central…
Linux and open-source operations
- USN-8620-4: Linux kernel (Intel IoTG) vulnerabilities – Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read.…
Windows and Microsoft security
- Cisco Advance Notification for Publication of August 5, 2026, Security Advisories – On August 5, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco…
- Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP) – Learn why KuppingerCole named Microsoft a Leader in its Leadership Compass: Cloud Native Application Protection Platforms report. The post Microsoft named a Leader in the KuppingerCole Leadership Compass…
Network, VPN, firewall, and edge security
- CVE-2026-53985: Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the… – Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station…
- SonicOS Improper Neutralization of HTTP Headers Vulnerability – A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to…
Web applications, APIs, and WordPress
- CVE-2026-9198: IBM Langflow Code Injection Vulnerability – CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9198 IBM Langflow Code Injection Vulnerability CVE-2026-18556 N-able N-central…
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability – Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.
- CVE-2026-65600: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware – ## Summary There is a critical authentication-bypass vulnerability in Traefik's `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory…
DevOps and software supply chain
- CVE-2026-65600: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware – ## Summary There is a critical authentication-bypass vulnerability in Traefik's `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory…
- CVE-2026-53985: Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the… – Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station…
- How we took malware advisories beyond npm – GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built the pipeline paranoid. The post…
AI and agent security
- CVE-2026-9198: IBM Langflow Code Injection Vulnerability – CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9198 IBM Langflow Code Injection Vulnerability CVE-2026-18556 N-able N-central…
- CVE-2026-53977: OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers… – OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is…
- Third-party cyber evaluations involving OpenAI models – OpenAI explains recent third-party cybersecurity evaluation incidents and outlines new safeguards to strengthen AI model testing and evaluation.
Cloud and identity controls
- Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP) – Learn why KuppingerCole named Microsoft a Leader in its Leadership Compass: Cloud Native Application Protection Platforms report. The post Microsoft named a Leader in the KuppingerCole Leadership Compass…
Priority actions for today
- Confirm exposure: match CVEs and vendor advisories to exact products, versions, internet reachability, and business-critical roles.
- Move exploited items first: patch, isolate, or disable affected paths for confirmed known-exploited technology before routine CVSS-only work.
- Preserve evidence: review authentication, process, endpoint, network, and management-plane telemetry before rebooting or replacing an affected system.
- Validate remediation: prove that the fixed version is running, required restarts are complete, controls still report healthy, and exceptions have owners and deadlines.
Primary sources and references
- CISA Known Exploited Vulnerabilities: CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
- CISA Cybersecurity Advisories: CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
- CISA Known Exploited Vulnerabilities: CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
- NIST National Vulnerability Database: CVE-2026-18577: An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover…
- CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog
- CISA Known Exploited Vulnerabilities: CVE-2026-9198: IBM Langflow Code Injection Vulnerability
- CISA Cybersecurity Advisories: CVE-2026-9198: IBM Langflow Code Injection Vulnerability
- CISA Known Exploited Vulnerabilities: CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
- NIST National Vulnerability Database: CVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central…
- CISA Known Exploited Vulnerabilities: CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- GitHub Advisory Database: CVE-2026-65600: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
- NIST National Vulnerability Database: CVE-2026-70615: Boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged…
- NIST National Vulnerability Database: CVE-2026-53977: OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers…
- NIST National Vulnerability Database: CVE-2026-53985: Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the…
- NIST National Vulnerability Database: CVE-2026-43622: Llama.cpp builds b1886 through b7445 contain a double free vulnerability in the…
- SonicWall PSIRT: SonicOS Improper Neutralization of HTTP Headers Vulnerability
- Cisco Security Advisories: Cisco Advance Notification for Publication of August 5, 2026, Security Advisories
- Ubuntu Security Notices: USN-8620-4: Linux kernel (Intel IoTG) vulnerabilities
- Ubuntu Security Notices: USN-8620-3: Linux kernel (Intel IoTG) vulnerabilities
- Microsoft Security Blog: Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP)
- GitHub Security Blog: How we took malware advisories beyond npm
- OpenAI News: Third-party cyber evaluations involving OpenAI models
Related briefings
Live Cybersecurity Brief for August 7, 2026: Active Threats, CVEs, and Vendor Advisories
Current cybersecurity intelligence for August 7, 2026, led by CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability and…
Read More
CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active…
Read MoreNeed to add context to this briefing?
Send corrections, security tips, source updates, or collaboration notes through the contact page so the editorial team can review them properly.