Top

Langflow Hit Again by Unauthenticated Takeover Flaws: CVE-2026-9198 & CVE-2026-9202 — Update Now

AISecurity

2026.06.2317 views

Perfect-10 unauthenticated takeover in PrestaShop's search module: CVE-2026-54159 — update ps_facetedsearch to 4.0.4

2026.07.183 views

Two site-takeover flaws in WordPress core: CVE-2026-60137 and CVE-2026-63030 — update now

2026.07.188 views

Just opening a repo in Cursor can hijack a Windows PC: CVE-2026-63093, and there's still no official fix

AISecurityDevelopment

2026.07.182 views

本日の注目記事

Two site-takeover flaws in WordPress core: CVE-2026-60137 and CVE-2026-63030 — update now

WordPress, used by about 40% of all websites, has two database-tampering flaws (SQL injection) in its core. Tracked as CVE-2026-60137 and CVE-2026-63030, when chained they can let attackers take over a site with no login. Fixes 6.8.6, 6.9.5, and 7.0.2 shipped and auto-updates were force-pushed. Here's how to confirm your site is already fixed.

2026.07.188 views

zyxel-gs1900-cve-2026-7273-buffer-overflow-rce-cover-en

SecurityInfrastructureGlobal Companies

Zyxel GS1900 Switch Takeover Flaw CVE-2026-7273: Patch 10 Models Now

Zyxel's GS1900 office network switches — 10 models — have a flaw, CVE-2026-7273, that lets anyone on the same local network take the device over without a password, enabling traffic spying or cut-offs. Here are the affected models, the fixed firmware, and the update steps to run now.

2026.06.1615 views

litellm-cve-2026-42271-mcp-command-injection-unauth-rce-cover-en

LiteLLM Unauthenticated RCE via MCP: CVE-2026-42271 (Now in CISA KEV) — Upgrade to 1.83.7

LiteLLM, the popular gateway fronting 100+ AI services, has a server-takeover flaw (CVE-2026-42271). Chained with a Starlette bug it enables unauthenticated remote code execution, exposing every stored API key. Patch to 1.83.7 now.

AISecurityDevelopment

2026.06.0930 views

Perfect-10 unauthenticated takeover in PrestaShop's search module: CVE-2026-54159 — update ps_facetedsearch to 4.0.4

PrestaShop, the popular free software for building online stores, has a maximum-severity (10.0) flaw in its standard filtered-search feature. Tracked as CVE-2026-54159, a single crafted URL can take over the shop and server with no login. The affected module is Faceted Search 3.0.0-4.0.3; update to 4.0.4.

Roundup Updated 3 days ago

2026.07.183 views

Microsoft Patch Tuesday: What IT Teams Must Apply First (July 2026)

A monthly page that distills Microsoft's Patch Tuesday down to what corporate IT teams must apply first. For July 2026, two unauthenticated takeovers in on-prem SharePoint Server (9.8 each) lead the list, with remote code execution in Exchange, Active Directory, DHCP, and SQL Server also needing attention. Includes a per-product quick-reference table.

2026.07.1512 views

Just opening a repo in Cursor can hijack a Windows PC: CVE-2026-63093, and there's still no official fix

A flaw in the Windows version of Cursor, the AI code editor used by over 7 million developers, can let attackers run code on your PC just by getting you to open a booby-trapped repository. Tracked as CVE-2026-63093 (severity 8.8), it has no published fixed version — Cursor calls it out of scope, so users must protect themselves for now.

AISecurityDevelopment

2026.07.182 views

今週の注目記事

News Updated 3 days ago

SonicWall SMA1000 Under Active Attack — CVE-2026-15409 & 15410 in CISA KEV, Patch Now

SonicWall's SMA1000 VPN appliance — the gateway from outside into the internal network — has two flaws confirmed under real-world attack, and the U.S. agency CISA has ordered urgent action. CVE-2026-15409 and CVE-2026-15410 can let attackers gain an unauthenticated foothold and ultimately take over the appliance. Since it sits directly on the internet, check for SonicWall's latest fix right now.

2026.07.1564 views

uuid-v4-v7-bigint-primary-key-design-cover-en

Lab

UUIDv4 vs v7 vs bigint: The Right Answer for Each Use Case (2026 DB Design)

Is UUIDv7 really a drop-in upgrade from v4? We benchmarked insert performance on PostgreSQL 18 with Python 3.14 and mapped out the best ID strategy by project scale and table purpose.

Development

2026.04.13151 views

localstack-github-archived-account-required-cover-en

SecurityInfrastructureJapanese Companies

Is LocalStack Still Free and Open Source? It Archived Its GitHub Repos and Now Requires an Account (2026)

AWS local emulator LocalStack archived its GitHub repos and now requires account authentication. The free tier remains for non-commercial use, but its OSS nature has fundamentally changed.

2026.03.29148 views

News Updated 2 days ago

KFC Japan: Shortages and Closures Across All Stores — Cause Is Unauthorized Access at Nichirei

In July 2026, KFC Japan announced that stores nationwide may face out-of-stock items, restricted menus, and temporary closures. The cause is a system failure from unauthorized access at Nichirei, the logistics company it uses for ingredient distribution. Online ordering and delivery are suspended too. Here is the timeline of how one company's cyber incident stopped a whole restaurant chain.

2026.07.1525 views

News Updated 7 days ago

IntelliJ IDEA RCE flaw CVE-2026-59792: opening a crafted project runs code

IntelliJ IDEA has a critical flaw (CVE-2026-59792, severity 9.6): opening a crafted project runs attacker code on your machine. All versions before 2026.1.4 and 2026.2 are affected. Update now.

Roundup Updated 2 days ago

2026.07.1125 views

cyberattack-logistics-cold-chain-impact-cover-en

A Cyberattack Stopped the Flow of Frozen Food: Why an IT Failure Stops "Things" From Moving, and How to Prepare

In July 2026, frozen-food giant Nichirei suffered a system failure from unauthorized access, impacting cold-storage in/out operations and frozen-food shipping. Using the case as an entry point, we explain why an IT failure stops a physical thing like frozen food from shipping, and what logistics and manufacturing can do so the business doesn't fully halt — from warehouse management systems (WMS), the cold chain, manual fallback, and OT/IT separation.

2026.07.1418 views

月間注目記事

UniFi hit by 15 flaws at once: cameras, door locks, routers, CVE-2026-50746

On July 2, 2026, networking brand UniFi disclosed 15 new vulnerabilities. Security cameras, door-access control, and routers are all in scope, and 6 can be exploited with no login. Earlier holes are already used in real attacks; we lay out the fixed version per product and the update steps to do first.

2026.05.22119 views

Is LocalStack Still Free and Open Source? It Archived Its GitHub Repos and Now Requires an Account (2026)

AWS local emulator LocalStack archived its GitHub repos and now requires account authentication. The free tier remains for non-commercial use, but its OSS nature has fundamentally changed.

2026.03.29148 views

deerflow-2-review-claude-code-comparison-cover-en

Lab

DeerFlow 2.0 Review: ByteDance's Open-Source Agent vs Claude Code

Hands-on review of ByteDance's DeerFlow 2.0, a GitHub 30k+ star AI agent framework. Setup, real-world testing, and comparison with Claude Code CLI.

2026.03.29191 views

Lab

UUIDv4 vs v7 vs bigint: The Right Answer for Each Use Case (2026 DB Design)

Is UUIDv7 really a drop-in upgrade from v4? We benchmarked insert performance on PostgreSQL 18 with Python 3.14 and mapped out the best ID strategy by project scale and table purpose.

Development

2026.04.13151 views

News Updated 3 days ago

SonicWall SMA1000 Under Active Attack — CVE-2026-15409 & 15410 in CISA KEV, Patch Now

2026.07.1564 views