📰 DAILY THREAT BRIEFING
Wednesday, July 1, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of July 1, 2026.

  1. Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts
    — The Hacker News

    Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line inter…
  2. Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery
    — The Hacker News

    ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious comman…
  3. Why Ask Credentials If There Are Secret Codes?, (Wed, Jul 1st)
    — SANS ISC

    This morning, an interesting phishing email hit my mailbox. It targets Metamask[1], a cryptocurrency wallet, available as a browser extensio…
  4. Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service
    — The Hacker News

    Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly…
  5. ISC Stormcast For Wednesday, July 1st, 2026 https://isc.sans.edu/podcastdetail/9990, (Wed, Jul 1st)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  6. Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
    — Unit 42

    Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more. The post…
  7. China-Linked Group Targets Southeast Asia Critical Systems
    — Dark Reading

    The group compromised at least 10 regional organizations, including two state-owned entities, and deployed a new backdoor.
  8. Anthropic to restore Claude Fable access on Wednesday
    — Bleeping Computer

    Anthropic has confirmed that the Department of Commerce has lifted export controls on Claude's two most powerful models, Fable 5 and Mytho…
  9. Anthropic rolls out Sonnet 5 with near-Opus 4.8 performance at a lower price
    — Bleeping Computer

    Anthropic is now rolling out Sonnet 5, and it's almost as good as the Opus range, but it is designed to be cheaper than the company's flagsh…
  10. New BioShocking attack manipulates AI browser into data theft
    — Bleeping Computer

    A new prompt injection attack dubbed "BioShocking" could trick AI-powered browsers into treating real-world risky actions as part of a ficti…
  11. Fake Bug Report Hijacks AI Coding Agents at Scale
    — Dark Reading

    "Agentjacking" is the latest demonstration of how easily attackers can exploit an AI agent's inability to differentiate between content and …
  12. Attackers Hijack Exposed AI Endpoints to Power Offensive Ops
    — Dark Reading

    Attackers don't need any special authentication to reach a target endpoint — they just need to know where it is.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (8019 in last 30 days).
Critical: 3 · High: 8 · Medium: 8 · Low: 1. View full dashboard →

  1. CVE-2026-9107
    — CVSS 6.4 (MEDIUM)

    The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_components]' parameter in all versions up to, and including, 2.4.13 …
  2. CVE-2026-7840
    — CVSS 9.8 (CRITICAL)

    UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP re…
  3. CVE-2026-7839
    — CVSS 9.1 (CRITICAL)

    UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal…
  4. CVE-2026-7838
    — CVSS 8.8 (HIGH)

    UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen f…
  5. CVE-2026-7831
    — CVSS 7.6 (HIGH)

    UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code decl…
  6. CVE-2026-7830
    — CVSS 7.4 (HIGH)

    UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diffie-Hellman key exchange is performed with parameters that fit in an unsign…
  7. CVE-2026-7829
    — CVSS 7.2 (HIGH)

    UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte de…
  8. CVE-2026-7828
    — CVSS 5.3 (MEDIUM)

    UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line…
  9. CVE-2026-7517
    — CVSS 7.2 (HIGH)

    The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in all versions up to, and including, 2.1.0 due to insufficient in…
  10. CVE-2026-6070
    — CVSS 9.1 (CRITICAL)

    The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBus…
  11. CVE-2026-44042
    — CVSS 3.7 (LOW)

    UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length…
  12. CVE-2026-44041
    — CVSS 4.3 (MEDIUM)

    UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHAR pointer to wcslen() before any bounds c…
  13. CVE-2026-44040
    — CVSS 4.8 (MEDIUM)

    UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes() function seeds libc rand() with time(0) …
  14. CVE-2026-2387
    — CVSS 6.4 (MEDIUM)

    The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_events' shortcode accepting attacker-controlled 'no_events' conte…
  15. CVE-2026-13731
    — CVSS 7.2 (HIGH)

    The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due t…
  16. CVE-2026-13468
    — CVSS 7.5 (HIGH)

    The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifyi…
  17. CVE-2026-13443
    — CVSS 6.4 (MEDIUM)

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input …
  18. CVE-2026-13246
    — CVSS 6.4 (MEDIUM)

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in…
  19. CVE-2026-13015
    — CVSS 6.1 (MEDIUM)

    The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and including, 18.1. This is due to insufficient input sanitization and…
  20. CVE-2026-12923
    — CVSS 7.5 (HIGH)

    The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handl…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · July 1, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com