News
July 8, 2026 Security Vulnerability Roundup: Plesk, ArcGIS, Self-Hosted AI Tools and More — Does It Affect You?
DevelopmentSecurity
A one-day roundup of the July 8, 2026 vulnerabilities we did not cover individually. Eleven items including 9Router and Plesk, organized so you can judge relevance by whether a login is required. Actively exploited and KEV-listed items are flagged, and we explain what ordinary users must act on now.
2026.07.0865 views
News
SP Page Builder for Joomla Hit by 4 New Flaws (CVE-2026-65766 and More): Data-Leak Risk, Update to 6.7.1
SecurityDevelopment
Two popular page-building tools for Joomla let anyone take over a server without a password. Both SP Page Builder (CVE-2026-48908) and Page Builder CK (CVE-2026-56290) are rated the maximum 10.0, are under active attack worldwide, and plant secret admin accounts. Update SP Page Builder to 6.6.2 and Page Builder CK to 3.6.0 now.
2026.07.0856 views
News
Self-hosted Git "Gitea" hit by admin-takeover flaw: CVE-2026-20896 and 8 more, update to 1.26.4
DevelopmentSecurityInfrastructure
Gitea, the self-hosted source-code tool, was patched for nine security flaws in version 1.26.4. The worst lets an attacker impersonate the admin with no password on Docker instances using a specific setting. If you self-host Gitea, update now.
2026.07.04148 views
Lab
Claude Desktop Comes to Linux: Cowork Runs a Real VM Inside Your PC
DevelopmentLinuxAI
Claude's desktop app now runs on Linux (Ubuntu/Debian). Cowork boots a VM inside your own PC, but Linux trips over a 'kvm' permission. Here's why, and the fix.
2026.07.03359 views
News
Fastify middie flaw CVE-2026-14198 lets a crafted URL bypass auth; update to 9.3.3
SecurityDevelopment
middie, a popular plugin for the Node.js web framework Fastify, has a flaw (CVE-2026-14198): a crafted URL bypasses auth and other middleware. No login needed, severity 9.1 — update to 9.3.3.
2026.07.0136 views
News
LatePoint CVE-2026-13228: 5.6.9 is no longer enough, update to 5.6.10
DevelopmentSecurity
A flaw in the WordPress booking plugin LatePoint (CVE-2026-13228) lets a staff-level account take over the whole site. 100,000+ sites are affected — update to version 5.6.4 now.
2026.07.0138 views
News
Snowflake CLI Had a Code-Injection Flaw Before 3.19.0: Building a Malicious Project Can Take Over Your Machine
SecurityDevelopmentInfrastructure
Snowflake CLI, the official tool for the Snowflake cloud data platform, has a code-injection flaw (CVE-2026-13749, CVSS 8.8): building or deploying a malicious project runs attacker code on your machine. Fixed in 3.19.0 — update now.
2026.06.3037 views
News
Command Injection in vscode-java (CVE-2026-12856, CVSS 8.8): A Malicious Java File Can Take Over Your Machine — Update to 1.55.0
SecurityDevelopment
Language Support for Java by Red Hat, a popular VS Code extension, has a flaw (CVE-2026-12856, CVSS 8.8): opening a malicious Java file and clicking a JavaDoc hover link can take over your machine. Update to 1.55.0.
2026.06.3083 views
Lab
Is PostgreSQL 18 Faster? A 20M-Row Benchmark vs 17
DevelopmentInfrastructure
Is PostgreSQL 18 really faster? We loaded the same 20M rows into 17.9 and 18 and measured. The big aggregation, where async I/O should shine, got slower instead. Only skip scan clearly won. One setting can flip the result. What to know before upgrading.
2026.06.29165 views
News
Fluentd Hit by Unauthenticated RCE (CVE-2026-44024, CVSS 9.8) Plus 5 More — Update to v1.19.3 Now
DevelopmentInfrastructureSecurity
Fluentd has a critical flaw (CVE-2026-44024, CVSS 9.8): an unauthenticated attacker can overwrite files via a crafted log tag to run code. Six issues fixed; update to v1.19.3 now.
2026.06.2962 views
News
Kestra Now Has Seven Known Flaws, None Fixed in Any Stable Build
InfrastructureDevelopmentSecurity
Critical Kestra flaws (CVE-2026-53576/49869): an unauthenticated attacker bypasses login and runs commands as root, taking over the host. The orchestration platform is used by 30,000+ orgs. Update to 1.3.24.
2026.06.2750 views
News
mise Security: Entering a Repo Folder Can Run an Attacker's Command — Keep It Updated
DevelopmentSecurity
Critical mise flaws (CVE-2026-33646/55441): entering a malicious repo folder or tab-completing a task runs an attacker's command on your machine. The dev-environment manager's trust check is bypassed. Update to 2026.6.4.
2026.06.2747 views
