📰 DAILY THREAT BRIEFING
Tuesday, July 7, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of July 7, 2026.

  1. 'BusySnake' Infostealer Slithers into Critical Infrastructure Networks
    — Dark Reading

    A threat group researchers call "Armored Likho" has gained access to government agencies and electrical power entities in Russia, Brazil, an…
  2. CitrixBleed-ing Again? NetScaler Vulnerability Under Attack
    — Dark Reading

    Attackers wasted little time targeting the latest memory disclosure flaw in Citrix's NetScaler products, after researchers published a proof…
  3. Phishing poses as big-brand job interview to steal Google accounts
    — Bleeping Computer

    A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interview…
  4. Fake IT support calls on Microsoft Teams push EtherRAT malware
    — Bleeping Computer

    Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support staff to trick employees into installing the Eth…
  5. Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
    — The Hacker News

    An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented mod…
  6. Vietnam arrests suspects behind HiAnime anime piracy service
    — Bleeping Computer

    ​Vietnamese authorities have arrested and are prosecuting seven suspects believed to have run HiAnime, the largest anime piracy streaming …
  7. 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
    — The Hacker News

    A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host ke…
  8. JadePuffer: The First Complete LLM-Driven Ransomware Attack
    — Dark Reading

    An "agentic threat actor" successfully exploited a Langflow flaw to steal data from a production database server and encrypt other systems.
  9. Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure
    — The Hacker News

    Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig…
  10. RCS and DNS: The NAPTR Record, (Mon, Jul 6th)
    — SANS ISC

    Over the last year, with recent updates to iOS and Android, RCS (Rich Communication Services) has become an increasingly used protocol [1]. …
  11. ISC Stormcast For Monday, July 6th, 2026 https://isc.sans.edu/podcastdetail/9994, (Mon, Jul 6th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  12. How We Added WebAuthn to a Browser-Based RDP Client
    — Unit 42

    A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection. The post …

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (7581 in last 30 days).
Critical: 2 · High: 9 · Medium: 7 · Low: 2. View full dashboard →

  1. CVE-2024-56141
    — CVSS 5.0 (MEDIUM)

    Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager  encryption routine ( CryptManager.kt ) initiali…
  2. CVE-2026-59710
    — CVSS 6.1 (MEDIUM)

    showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTM…
  3. CVE-2026-42204
    — CVSS 8.8 (HIGH)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Dock…
  4. CVE-2026-42153
    — CVSS 8.8 (HIGH)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings (postgres_…
  5. CVE-2026-42148
    — CVSS 3.8 (LOW)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build comman…
  6. CVE-2026-41899
    — CVSS 6.5 (MEDIUM)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing a…
  7. CVE-2026-34599
    — CVSS 8.8 (HIGH)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component whi…
  8. CVE-2026-34167
    — CVSS 5.0 (MEDIUM)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's…
  9. CVE-2026-34153
    — CVSS 8.8 (HIGH)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_d…
  10. CVE-2026-34050
    — CVSS 6.5 (MEDIUM)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, all…
  11. CVE-2026-34049
    — CVSS 3.3 (LOW)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate…
  12. CVE-2026-32718
    — CVSS 6.5 (MEDIUM)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens …
  13. CVE-2026-59713
    — CVSS 8.1 (HIGH)

    Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled a…
  14. CVE-2026-59712
    — CVSS 8.1 (HIGH)

    Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Atta…
  15. CVE-2026-59711
    — CVSS 6.1 (MEDIUM)

    showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greate…
  16. CVE-2026-57573
    — CVSS 8.6 (HIGH)

    Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_craw…
  17. CVE-2026-57572
    — CVSS 10.0 (CRITICAL)

    Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could…
  18. CVE-2026-57571
    — CVSS 9.6 (CRITICAL)

    Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads dir…
  19. CVE-2026-55727
    — CVSS 7.5 (HIGH)

    A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.
  20. CVE-2026-54234
    — CVSS 7.5 (HIGH)

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered t…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · July 7, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com