📰 DAILY THREAT BRIEFING
Thursday, July 9, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of July 9, 2026.

  1. Mexico's New Cyber Plan Faces Its First Real Test
    — Dark Reading

    The Latin American nation's cybersecurity plan — still in the expansion phase — has to survive its own knockout round during the FIFA Wo…
  2. Mount Royal University confirms breach as hackers claim attack
    — Bleeping Computer

    Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university's ne…
  3. Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours
    — Dark Reading

    The attacker exploited AI workflows, chained cloud weaknesses, and stolen credentials to extort a large Amazon customer.
  4. Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials
    — Bleeping Computer

    Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users o…
  5. Hackers exploit Roundcube flaw to spy on academic researchers
    — Bleeping Computer

    A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and de…
  6. AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers
    — The Hacker News

    Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting o…
  7. Vidar Infostealer Hammers SMBs via Malvertising Campaign
    — Dark Reading

    A financially motivated operation uses lures of cracked or pirated software to deliver a malware two-for-one combo for data theft and crypto…
  8. New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware
    — The Hacker News

    AI coding assistants have a habit of making things up. Ask one to fetch a popular tool, and it will sometimes hand back a real-sounding name…
  9. Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS
    — The Hacker News

    Ubiquiti has shipped updates to address multiple critical security flaws impacting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, a…
  10. Felons, Fraudsters Flog Offensive Cybersecurity Startup
    — Krebs on Security

    A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of fa…
  11. My Stack Simulator, (Wed, Jul 8th)
    — SANS ISC

    The stack is a memory region where a program stores temporary data - like local variables and retur…
  12. ISC Stormcast For Wednesday, July 8th, 2026 https://isc.sans.edu/podcastdetail/9998, (Wed, Jul 8th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (7802 in last 30 days).
Critical: 2 · High: 11 · Medium: 6 · Low: 1. View full dashboard →

  1. CVE-2026-47646
    — CVSS 9.3 (CRITICAL)

    Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.
  2. CVE-2026-15137
    — CVSS 7.3 (HIGH)

    A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file incclassesView.php. This manipulation of the argument ID causes sql injection. The a…
  3. CVE-2026-15135
    — CVSS 7.3 (HIGH)

    A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulation of the argument update results in sql injection. It is po…
  4. CVE-2026-15134
    — CVSS 7.3 (HIGH)

    A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the …
  5. CVE-2026-59723
    — CVSS 8.8 (HIGH)

    Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoi…
  6. CVE-2026-54784
    — CVSS 7.4 (HIGH)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when Transp…
  7. CVE-2026-54783
    — CVSS 7.4 (HIGH)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:…
  8. CVE-2026-54782
    — CVSS 10.0 (CRITICAL)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or …
  9. CVE-2026-54781
    — CVSS 7.4 (HIGH)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proo…
  10. CVE-2026-54780
    — CVSS 3.7 (LOW)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the con…
  11. CVE-2026-54779
    — CVSS 5.9 (MEDIUM)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not …
  12. CVE-2026-54778
    — CVSS 6.2 (MEDIUM)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid cal…
  13. CVE-2026-54776
    — CVSS 4.4 (MEDIUM)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept con…
  14. CVE-2026-54775
    — CVSS 6.5 (MEDIUM)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka topic stops processing new records from that topic when Kafka…
  15. CVE-2026-54774
    — CVSS 7.4 (HIGH)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service validates SAML tokens …
  16. CVE-2026-54773
    — CVSS 5.9 (MEDIUM)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an…
  17. CVE-2026-54772
    — CVSS 7.5 (HIGH)

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomai…
  18. CVE-2026-54499
    — CVSS 7.5 (HIGH)

    Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attem…
  19. CVE-2026-15105
    — CVSS 6.3 (MEDIUM)

    A flaw has been found in davenardella snap7 up to 1.4.3. This affects the function TS7Worker::PerformFunctionRead of the file src/core/s7_server.cpp of the component ReadVar Request Handler. This manipulation causes dese…
  20. CVE-2026-55878
    — CVSS 7.8 (HIGH)

    Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and be…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · July 9, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com