frameworks · browsers · authentication flows
Vercel published the July 2026 Next.js security release with fixes across supported branches. Update your Next.js version in lockstep across marketing sites and app-router applications; details on affected versions are in the linked advisory.
Bump Next.js in your Astro-adjacent marketing surfaces and any client portals; run npm audit after upgrade to catch transitive middleware dependencies.
packages · build systems · dependency attacks
brace-expansion caps the number of results returned but not their length. Chained brace groups such as '{a,b}'.repeat(1500) produce results long enough to exhaust memory and terminate the Node process with an uncatchable OOM error. try/catch around expand() does not help. The library is a transitive dependency of minimatch, glob, and much of the Node build toolchain.
Bump minimatch/glob transitively via npm update, then dedupe. If you accept user-supplied glob patterns anywhere (search, file APIs), reject inputs above a small length cap until the fix is in production.
sm-crypto 0.4.0 (latest) seeds its RNG through jsbn's SecureRandom, which checks window.crypto rather than globalThis.crypto. Under Node — the primary runtime — the CSPRNG branch is skipped and seeds fall back to Math.random() plus wall clock, making SM2 private keys and signing nonces recoverable. Any keys or signatures generated by sm-crypto on Node must be treated as compromised.
grep npm lockfiles for sm-crypto — if it's a transitive dep in a portal handling Chinese-market signing, rotate every key it emitted and pin to a crypto library that uses Node's built-in randomBytes.
Budibase's fetchWithBlacklist pins requests to a validated IP using a Node http(s).Agent, but the REST datasource integration performs the actual request with undici's fetch, which ignores the agent option and re-resolves DNS at connect time. The DNS-rebinding protection is silently bypassed on the REST path, restoring the SSRF that CVE-2026-54353's initial fix was meant to close.
If Budibase powers internal admin tooling, upgrade immediately; if you cannot, restrict the app's egress to an explicit allowlist at the network layer rather than trusting library-level SSRF guards.
kubernetes · cloud · network · ingress
etcd's tlsListener.acceptLoop spawns a goroutine per TCP connection and blocks indefinitely inside tls.Conn.Handshake() when a peer never sends a ClientHello. A network-reachable attacker can exhaust memory in the etcd process and take down the Kubernetes control plane. Fixed in etcd 3.7.1, 3.6.14, and 3.5.33.
Check the etcd version on every managed K8s control plane you own; patch on the next maintenance window and confirm the etcd client endpoint is not exposed beyond the control-plane network.
wordpress · drupal · plugins · php frameworks
Wordfence details wp2shell, the first critical unauthenticated RCE in WordPress core in nearly a decade. The chain combines a SQL injection reachable when plugins/themes pass untrusted input (CVE-2026-60137) with an interpretation-conflict flaw (CVE-2026-63030) to achieve code execution on default installs. Patched July 17, 2026; both CVEs added to CISA KEV on July 21. Cloudflare has deployed WAF rules for managed customers.
Confirm every WordPress site is on the July 17 release before Monday and hunt logs for anomalous POSTs to admin-ajax and REST endpoints since July 15 — public PoCs are circulating and mass scanning is expected.
oauth · saml · iam · session attacks
Microsoft addressed a chain in Azure Automation where a public-by-default setting combined with code flaws let an attacker seize another tenant's managed identity and pivot to that tenant's credentials, data, and cloud workloads. The fix changes the default and closes the code paths that made the takeover possible.
Audit every Azure Automation account for public webhook exposure and rotate any managed-identity credentials used from runbooks in the last 90 days.
Researchers presenting at Black Hat USA disclosed exploitable flaws in how Microsoft handles passkeys that let attackers impersonate privileged users. The findings show that FIDO2 phishing resistance can be undone by implementation choices in the RP, not the protocol itself. Details will be published during the conference.
Passkeys don't remove the need for RP-side hardening. If you're rolling passkeys onto client portals via Auth0, review your webauthn ceremony for origin binding and attestation validation now rather than after the Black Hat talk drops.
active exploitation · breaches · ransomware
Unit 42 and a joint international advisory attribute an ongoing campaign against Zimbra Collaboration webmail servers to Russia-linked Laundry Bear. The group uses zero-click phishing that fires when a victim previews an email, injecting JavaScript to steal session tokens and mailbox contents. Targets span US and Ukrainian government, defense, and adjacent sectors.
If a client still runs on-prem Zimbra, patch to the vendor's latest release this week and enforce Content Security Policy on the webmail domain; audit for unfamiliar OAuth grants and forwarding rules created since June.
CISA added CVE-2026-16232 to KEV: an improper authentication flaw in Check Point SmartConsole that lets an unauthenticated remote attacker obtain an application login token and authenticate with full administrative privileges. Vendor mitigations are available.
If your network team uses SmartConsole, restrict management-plane access to jump hosts and rotate admin credentials after patching — token issuance during the exposure window cannot be trusted.
CISA added CVE-2026-50522, a deserialization of untrusted data flaw in Microsoft SharePoint that permits unauthenticated remote code execution over the network, to the Known Exploited Vulnerabilities catalog. Federal agencies must comply with BOD 26-04 patching timelines; the entry indicates observed in-the-wild exploitation.
Inventory on-prem SharePoint farms behind client portals — if any are internet-reachable, patch this week or firewall management endpoints off the internet.
CISA added CVE-2026-0770 to KEV: an inclusion-of-functionality-from-untrusted-control-sphere flaw in Langflow that allows remote attackers to execute arbitrary code on affected installations. Langflow is widely deployed as an internal LLM prototyping tool and often exposed to the corporate LAN or public internet.
If any team runs Langflow for LLM experimentation, take the instance off any internet-reachable interface today and patch before returning it to service; check outbound egress logs from the host for unexpected callbacks.