Archive snapshot

Thu, Jul 09 · 06:00 PM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Thu, Jul 09 · 06:00 PM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

5

Worth skimming

5

Tracked videos

1

NVD vulnerabilities

25

Top stories

Thu, 09 Jul 2026 23:38:07 +0530

New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware

9.5/10 · Must read/watch

The Hacker Newsmalware

Summary
Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from. Each is a different way to bre

Open article ↗

Thu, Jul 09 · 06:00 PM CDT

Vibe-Coded Malware Caught in Active Directory Attack

8.9/10 · Worth your time

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, 10 Jul 2026 00:08:49 +0530

Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs

8.9/10 · Worth your time

The Hacker Newssupply-chainai

Summary
Datadog Security Labs is warning of "several overlapping campaigns" that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. "Operators rely on automated scraping tooling with custom or le

Open article ↗

Thu, Jul 09 · 06:00 PM CDT

Cybercriminals Plant Malicious AI Agents in Open Source Tool Repositories

8.2/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Thu, Jul 09 · 01:00 PM CDT

Train sim created by just one person is being called the best ever made

8.1/10 · Worth your time

Hacker Newsai

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 5 hours ago.

Open article ↗

Worth skimming

Thu, Jul 09 · 06:00 PM CDT

China-Linked APT Expands Proxy Network With New Malware

8.0/10 · Worth your time

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Thu, Jul 09 · 06:00 PM CDT

New Malicious Campaign Delivers Vidar Infostealer and Monero Crypto Miner

8.0/10 · Worth your time

Infosecurity Magazinemalwareai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Thu, Jul 09 · 06:00 PM CDT

GhostApproval Flaw Hits Six Major AI Coding Assistants

7.8/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Thu, Jul 09 · 06:00 PM CDT

New AI Security Charter Backed by Over 70 Cyber Firms

7.8/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Thu, Jul 09 · 06:00 PM CDT

RedWing Android Spyware Sold as a Service on Telegram

7.8/10 · Worth your time

Infosecurity Magazinegeneral

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Videos worth watching

Thu, Jul 09 · 12:30 PM CDT

See you at Black Hat USA 2026!

8.2/10 · Worth your time

YouTube / John Hammondgeneral

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

NVD vulnerabilities

Fri, Nov 27 · 06:15 PM CST

CVE-2017-15681

9.8/10 · Must read/watch

NVDvuln

Summary
In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.

CVECVE-2017-15681

SeverityCRITICAL

TypeUPDATED

PublishedFri, Nov 27 · 06:15 PM CST

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Wed, Sep 30 · 06:15 PM CDT

CVE-2018-5353

9.8/10 · Must read/watch

NVDvuln

Summary
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redi

CVECVE-2018-5353

SeverityCRITICAL

TypeUPDATED

PublishedWed, Sep 30 · 06:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Thu, Sep 03 · 06:15 PM CDT

CVE-2020-24193

9.8/10 · Must read/watch

NVDvuln

Summary
A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injection via the email parameter.

CVECVE-2020-24193

SeverityCRITICAL

TypeUPDATED

PublishedThu, Sep 03 · 06:15 PM CDT

ModifiedThu, Jul 09 · 12:17 AM CDT

Open article ↗

Tue, Feb 16 · 01:15 PM CST

CVE-2020-24841

9.8/10 · Must read/watch

NVDvuln

Summary
PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CVECVE-2020-24841

SeverityCRITICAL

TypeUPDATED

PublishedTue, Feb 16 · 01:15 PM CST

ModifiedThu, Jul 09 · 12:17 AM CDT

Open article ↗

Thu, Mar 04 · 01:15 PM CST

CVE-2020-24913

9.8/10 · Must read/watch

NVDvuln

Summary
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.

CVECVE-2020-24913

SeverityCRITICAL

TypeUPDATED

PublishedThu, Mar 04 · 01:15 PM CST

ModifiedThu, Jul 09 · 12:17 AM CDT

Open article ↗

Thu, Mar 04 · 01:15 PM CST

CVE-2020-24914

9.8/10 · Must read/watch

NVDvuln

Summary
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.

CVECVE-2020-24914

SeverityCRITICAL

TypeUPDATED

PublishedThu, Mar 04 · 01:15 PM CST

ModifiedThu, Jul 09 · 12:17 AM CDT

Open article ↗

Fri, Oct 23 · 03:15 PM CDT

CVE-2020-25466

9.8/10 · Must read/watch

NVDvuln

Summary
A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.

CVECVE-2020-25466

SeverityCRITICAL

TypeUPDATED

PublishedFri, Oct 23 · 03:15 PM CDT

ModifiedThu, Jul 09 · 12:17 AM CDT

Open article ↗

Mon, Dec 21 · 03:15 PM CST

CVE-2020-35276

9.8/10 · Must read/watch

NVDvuln

Summary
EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user.

CVECVE-2020-35276

SeverityCRITICAL

TypeUPDATED

PublishedMon, Dec 21 · 03:15 PM CST

ModifiedThu, Jul 09 · 01:16 AM CDT

Open article ↗

Sat, Feb 27 · 06:15 AM CST

CVE-2021-27132

9.8/10 · Must read/watch

NVDvuln

Summary
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.

CVECVE-2021-27132

SeverityCRITICAL

TypeUPDATED

PublishedSat, Feb 27 · 06:15 AM CST

ModifiedThu, Jul 09 · 01:16 AM CDT

Open article ↗

Mon, May 03 · 12:15 PM CDT

CVE-2021-28860

9.1/10 · Must read/watch

NVDvuln

Summary
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service

CVECVE-2021-28860

SeverityCRITICAL

TypeUPDATED

PublishedMon, May 03 · 12:15 PM CDT

ModifiedThu, Jul 09 · 01:16 AM CDT

Open article ↗

Wed, Sep 30 · 06:15 PM CDT

CVE-2018-5354

8.8/10 · Worth your time

NVDvuln

Summary
The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of cond

CVECVE-2018-5354

SeverityHIGH

TypeUPDATED

PublishedWed, Sep 30 · 06:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, May 17 · 07:15 PM CDT

CVE-2020-21814

8.8/10 · Worth your time

NVDvuln

Summary
A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlwescape ../../programs/escape.c:97.

CVECVE-2020-21814

SeverityHIGH

TypeUPDATED

PublishedMon, May 17 · 07:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, May 17 · 07:15 PM CDT

CVE-2020-21816

8.8/10 · Worth your time

NVDvuln

Summary
A heab based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:46.

CVECVE-2020-21816

SeverityHIGH

TypeUPDATED

PublishedMon, May 17 · 07:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, May 17 · 07:15 PM CDT

CVE-2020-21818

8.8/10 · Worth your time

NVDvuln

Summary
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:48.

CVECVE-2020-21818

SeverityHIGH

TypeUPDATED

PublishedMon, May 17 · 07:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, May 17 · 07:15 PM CDT

CVE-2020-21819

8.8/10 · Worth your time

NVDvuln

Summary
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641via htmlescape ../../programs/escape.c:51.

CVECVE-2020-21819

SeverityHIGH

TypeUPDATED

PublishedMon, May 17 · 07:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, May 17 · 09:15 PM CDT

CVE-2020-21830

8.8/10 · Worth your time

NVDvuln

Summary
A heap based buffer overflow vulneraibility exists in GNU LibreDWG 0.10 via bit_calc_CRC ../../src/bits.c:2213.

CVECVE-2020-21830

SeverityHIGH

TypeUPDATED

PublishedMon, May 17 · 09:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, May 17 · 09:15 PM CDT

CVE-2020-21832

8.8/10 · Worth your time

NVDvuln

Summary
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2417.

CVECVE-2020-21832

SeverityHIGH

TypeUPDATED

PublishedMon, May 17 · 09:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, May 17 · 09:15 PM CDT

CVE-2020-21833

8.8/10 · Worth your time

NVDvuln

Summary
A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:2440.

CVECVE-2020-21833

SeverityHIGH

TypeUPDATED

PublishedMon, May 17 · 09:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, May 17 · 09:15 PM CDT

CVE-2020-21836

8.8/10 · Worth your time

NVDvuln

Summary
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_preview ../../src/decode.c:3175.

CVECVE-2020-21836

SeverityHIGH

TypeUPDATED

PublishedMon, May 17 · 09:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Fri, Apr 09 · 01:15 PM CDT

CVE-2020-21883

8.8/10 · Worth your time

NVDvuln

Summary
Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover.

CVECVE-2020-21883

SeverityHIGH

TypeUPDATED

PublishedFri, Apr 09 · 01:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Fri, Apr 09 · 01:15 PM CDT

CVE-2020-21884

8.8/10 · Worth your time

NVDvuln

Summary
Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.

CVECVE-2020-21884

SeverityHIGH

TypeUPDATED

PublishedFri, Apr 09 · 01:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Tue, Sep 15 · 02:15 PM CDT

CVE-2020-23451

8.8/10 · Worth your time

NVDvuln

Summary
Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function.

CVECVE-2020-23451

SeverityHIGH

TypeUPDATED

PublishedTue, Sep 15 · 02:15 PM CDT

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Mon, Jan 11 · 03:15 PM CST

CVE-2020-23630

8.8/10 · Worth your time

NVDvuln

Summary
A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).

CVECVE-2020-23630

SeverityHIGH

TypeUPDATED

PublishedMon, Jan 11 · 03:15 PM CST

ModifiedThu, Jul 09 · 12:16 AM CDT

Open article ↗

Thu, Mar 04 · 01:15 PM CST

CVE-2020-24036

8.8/10 · Worth your time

NVDvuln

Summary
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.

CVECVE-2020-24036

SeverityHIGH

TypeUPDATED

PublishedThu, Mar 04 · 01:15 PM CST

ModifiedThu, Jul 09 · 12:17 AM CDT

Open article ↗

Mon, Mar 08 · 09:15 PM CST

CVE-2020-27574

8.8/10 · Worth your time

NVDvuln

Summary
Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page, unintended actions could be performed in the web application as the authenticated user.

CVECVE-2020-27574

SeverityHIGH

TypeUPDATED

PublishedMon, Mar 08 · 09:15 PM CST

ModifiedThu, Jul 09 · 01:16 AM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.