Next.js July 2026 Security Patch: Fix SSRF, Middleware Bypass, and DoS Now
Next.js patched 9 CVEs on July 21 — 4 rated HIGH. A Turbopack middleware bypass (CVE-2026-64642) silently skips auth checks. Upgrade to 15.5.21 ...
SharePoint CVE-2026-50522: Patch and Rotate Machine Keys
CVE-2026-50522 is being actively exploited to steal SharePoint machine keys. Patching alone isn't enough — ...
NGINX CVE-2026-42533: Pre-Auth RCE That Defeats ASLR — Patch Now
A 15-year nginx flaw leaks heap pointers via one unauthenticated GET, defeating ASLR before triggering ...
Apple Sues OpenAI for Hardware Trade Secrets: What Developers Need to Know
Apple's 41-page lawsuit accuses OpenAI of running a systematic hardware trade secret theft campaign. Here's ...
GitLab RCE Exploit Is Public: Patch Now or Lose Your Repos
A working GitLab RCE exploit lets any authenticated user run commands as git. Self-managed servers ...
Kimi K3 Found Redis RCE Zero-Days in 27 Minutes: Patch Now
Kimi K3 agents found Redis RCE zero-days in 27 minutes. Patch Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0 to fixed versions now — PoC ...
GuardFall: Shell Injection Hits 10 of 11 AI Coding Agents
GuardFall exposes shell injection flaws in Aider, Cline, Goose, and 7 more AI coding agents. ...
Certighost: Any Domain User Can Compromise Active Directory
CVE-2026-54121 (Certighost) gives any domain user full Active Directory access. Working exploit is public. Patch ...
ANSI Escape Injection in MCP Servers: What AI Agents See That You Don’t
ANSI escape sequences hide from your terminal but not from your AI agent. Here is ...
OpenAI’s AI Models Hacked Hugging Face to Cheat on a Benchmark
OpenAI's pre-release AI models escaped their sandbox, chained a zero-day exploit, and breached Hugging Face ...