News
Oracle July 2026 CPU: 1,449 fixes and ten 10.0 unauth takeover flaws
SecurityInfrastructure
Oracle's July 2026 Critical Patch Update fixes a record 1,455 issues, including several CVSS 10.0 flaws that take over a server with no login. Affected are widely used middleware like WebLogic Server, Coherence, and Access Manager. Here's which products to prioritize and what to do now.
2026.07.22132 views
News
Four critical flaws in Tenable Security Center: CVE-2026-64878 et al. — post-login takeover, update to 6.8.0
InfrastructureSecurity
Tenable Security Center (formerly Tenable.sc), a vulnerability-management product, has five serious flaws. CVE-2026-64878 and CVE-2026-64879 (9.9) let a logged-in user run commands on the server (takeover); CVE-2026-64877 (8.4) lets a low-privileged user pull sensitive data. Affected: Linux builds before 6.8.0 — update to 6.8.0 or apply patch SC202607.1.
2026.07.2251 views
News
SolarWinds Serv-U: 15 flaws fixed in 2026.3 (CVE-2026-28302 et al.)
SecurityInfrastructure
SolarWinds Serv-U, used for enterprise file transfer, has 14 flaws rated 9.1 disclosed at once (CVE-2026-28302 et al.). An admin-privileged user can read/write files beyond limits and reach privileged code execution (server takeover), with larger impact on Linux/Unix. Affected: 15.5.4 HF1 and earlier; update to the latest hotfix.
2026.07.2258 views
News
Home Assistant: 2026.6.0 is not enough, CVE-2026-64824 needs 2026.7.0
InfrastructureSecurity
Home Assistant, the popular free smart-home platform, has a flaw rated 9.3. CVE-2026-64825 lets a crafted backup — loaded during setup or restore — write an arbitrary file on the device, leading to takeover on root-running installs. No login needed. All versions before 2026.6.0 are affected; here's how to update.
2026.07.2251 views
News
Chiikawa Movie Tickets: Cinema Booking Sites Crash at Once in the Midnight Seat Rush
InfrastructureJapanese Companies
At midnight on July 21, as advance reserved-seat sales for the Chiikawa movie opened, cinema booking sites including TOHO Cinemas, AEON Cinema and United Cinemas went down one after another under a traffic surge. Here is what happened, why hit-title launches crash these sites, and what to do if you can't get through.
2026.07.2148 views
News
Unauthenticated takeover flaw in VMware Avi Load Balancer: CVE-2026-47865 — patch to 32.1.2 now
SecurityInfrastructure
VMware's Avi Load Balancer, which many companies place in front of their servers, has a flaw (CVE-2026-47865, severity 9.8) that lets attackers take over its management console with no login. Seven flaws in total were disclosed, with fixes 32.1.2, 31.2.2-2p3 and 30.2.7 now available. There is no workaround. Here's how to check whether your version is affected and update.
2026.07.1842 views
News
WireGuard Easy (wg-easy) flaw lets attackers steal VPN connection details — dangerous if the admin panel is exposed: CVE-2026-63089, no stable fix released yet
SecurityInfrastructure
A critical flaw, CVE-2026-63089 (CVSS 9.3), was found in WireGuard Easy (wg-easy), a popular tool for standing up a VPN with no fiddly setup. The token on its single-use share link has only 1,000 possibilities and no attempt limit, so if the admin panel is exposed to the internet, attackers can steal VPN connection settings without logging in. No stable fix has been released yet; for now you must keep the admin panel off the internet.
2026.07.1771 views
News
Grafana OnCall (open-source) can be fully taken over without login — and no patch is coming: CVE-2026-63087, stop using it and migrate
SecurityInfrastructure
A critical flaw, CVE-2026-63087 (CVSS 9.8), lets anyone take over Grafana OnCall (the open-source on-call/alerting tool) completely without logging in. The open-source edition is already end-of-life, so no patch is coming. All versions are affected; block the management port now and migrate to the supported successor.
2026.07.1764 views
News
Credit cards went down across Japan on July 16: convenience stores and Suica top-ups hit — the cause was an international card network outage
Japanese CompaniesInfrastructureMobile
On the morning of July 16, 2026, credit card payments briefly failed at convenience stores, drugstores, and station ticket machines across Japan, and Mobile Suica and PASMO top-ups were hit too. The cause was a failure in the international payment network linking card companies; it recovered by midday. Cash and already-charged balances still worked. Here is what happened, in order.
2026.07.16181 views
News
Max-severity flaw CVE-2026-56699 hits the Wazuh security monitor (CVSS 10.0): unauthenticated record tampering, update 5.0 beta now
InfrastructureSecurity
Wazuh, the open-source security monitor, has a max-severity flaw (CVE-2026-56699, CVSS 10.0): unauthenticated agents can delete or tamper with alert logs to erase attack traces. Only 5.0 beta builds are affected; stable 4.x is safe. Update to 5.0.0-beta3.
2026.07.1557 views
News
mcp-grafana Has a Second Flaw (CVE-2026-19516): Update to v1.1.0
SecurityInfrastructureAI
A serious flaw, CVE-2026-15583, has been found in mcp-grafana, the connector that lets AI assistants operate the monitoring tool Grafana. With no login, an attacker can make the server send its stored keys over the network, and even reach internal or cloud secrets. A fix, v0.17.2, is out. We explain what happens and whether your setup is at risk.
2026.07.1571 views
News
SonicWall SMA1000 victims are being cold-called by fake 'helpers' — CVE-2026-15409
SecurityInfrastructure
SonicWall's SMA1000 VPN appliance — the gateway from outside into the internal network — has two flaws confirmed under real-world attack, and the U.S. agency CISA has ordered urgent action. CVE-2026-15409 and CVE-2026-15410 can let attackers gain an unauthenticated foothold and ultimately take over the appliance. Since it sits directly on the internet, check for SonicWall's latest fix right now.
2026.07.15158 views
