Archive snapshot

Fri, Aug 07 · 06:00 AM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Fri, Aug 07 · 06:00 AM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

5

Worth skimming

5

Tracked videos

0

NVD vulnerabilities

25

Top stories

Fri, 07 Aug 2026 16:08:27 +0530

Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

9.8/10 · Must read/watch

The Hacker Newsai

Summary
Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financia

Open article ↗

Fri, 07 Aug 2026 15:39:54 +0530

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

9.8/10 · Must read/watch

The Hacker Newsvulnai

Summary
PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors. PortSwigger said a separate human-guid

Open article ↗

Fri, 07 Aug 2026 12:20:05 +0530

TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

9.8/10 · Must read/watch

The Hacker Newssupply-chainai

Summary
A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has been compromising internet-facing infrastructure for years before training their sights on the software

Open article ↗

Fri, Aug 07 · 06:00 AM CDT

Ransomware Surges in July After Q2 Lull

9.6/10 · Must read/watch

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, 07 Aug 2026 13:48:35 +0530

Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

9.6/10 · Must read/watch

The Hacker Newssupply-chainai

Summary
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack

Open article ↗

Worth skimming

Fri, 07 Aug 2026 14:22:11 +0530

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

9.2/10 · Must read/watch

The Hacker Newsmalwareidentity

Summary
Entra ID researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The attacker can then establish longer-term cloud

Open article ↗

Fri, 07 Aug 2026 09:00:00 GMT

How HSP GRUPPE builds AI capabilities for tax advisory

8.6/10 · Worth your time

OpenAIai

Summary
Discover how HSP GRUPPE uses ChatGPT Enterprise to boost productivity, improve work quality, and create more capacity for tax advisory and client service.

Open article ↗

Fri, Aug 07 · 06:00 AM CDT

Meta Joins OpenAI and Anthropic in Reporting AI Exploit Incident

8.5/10 · Worth your time

Infosecurity Magazinevulnai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, Aug 07 · 06:00 AM CDT

Healthcare and Victim Support Charities Affected by Beacon Cyber Incident

8.2/10 · Worth your time

Infosecurity Magazinegeneral

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, Aug 07 · 06:00 AM CDT

Google Links Redact Extortion Group to BlackFile Rebrand

8.2/10 · Worth your time

Infosecurity Magazinegeneral

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Videos worth watching

Nothing surfaced yet.

NVD vulnerabilities

Wed, May 13 · 06:16 PM CDT

CVE-2026-43997

10.0/10 · Must read/watch

NVDvuln

Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.

CVECVE-2026-43997

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 13 · 06:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Wed, May 13 · 06:16 PM CDT

CVE-2026-44005

10.0/10 · Must read/watch

NVDvuln

Summary
vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running i

CVECVE-2026-44005

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 13 · 06:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Wed, May 13 · 06:16 PM CDT

CVE-2026-44006

10.0/10 · Must read/watch

NVDvuln

Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

CVECVE-2026-44006

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 13 · 06:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Fri, May 22 · 04:16 AM CDT

CVE-2026-46595

10.0/10 · Must read/watch

NVDvuln

Summary
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

CVECVE-2026-46595

SeverityCRITICAL

TypeUPDATED

PublishedFri, May 22 · 04:16 AM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Tue, Jun 09 · 09:17 PM CDT

CVE-2026-47938

10.0/10 · Must read/watch

NVDvuln

Summary
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVECVE-2026-47938

SeverityCRITICAL

TypeUPDATED

PublishedTue, Jun 09 · 09:17 PM CDT

ModifiedThu, Aug 06 · 02:41 PM CDT

Open article ↗

Mon, Apr 14 · 07:15 PM CDT

CVE-2025-1782

9.9/10 · Must read/watch

NVDvuln

Summary
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user accoun

CVECVE-2025-1782

SeverityCRITICAL

TypeUPDATED

PublishedMon, Apr 14 · 07:15 PM CDT

ModifiedThu, Aug 06 · 03:26 PM CDT

Open article ↗

Wed, May 13 · 06:16 PM CDT

CVE-2026-43999

9.9/10 · Must read/watch

NVDvuln

Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin

CVECVE-2026-43999

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 13 · 06:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Wed, Jan 28 · 04:16 PM CST

CVE-2025-61140

9.8/10 · Must read/watch

NVDvuln

Summary
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

CVECVE-2025-61140

SeverityCRITICAL

TypeUPDATED

PublishedWed, Jan 28 · 04:16 PM CST

ModifiedThu, Aug 06 · 01:16 PM CDT

Open article ↗

Fri, Jul 10 · 10:16 PM CDT

CVE-2026-10768

9.8/10 · Must read/watch

NVDvuln

Summary
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

CVECVE-2026-10768

SeverityCRITICAL

TypeUPDATED

PublishedFri, Jul 10 · 10:16 PM CDT

ModifiedThu, Aug 06 · 03:08 PM CDT

Open article ↗

Fri, Jul 10 · 10:16 PM CDT

CVE-2026-12535

9.8/10 · Must read/watch

NVDvuln

Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

CVECVE-2026-12535

SeverityCRITICAL

TypeUPDATED

PublishedFri, Jul 10 · 10:16 PM CDT

ModifiedThu, Aug 06 · 02:44 PM CDT

Open article ↗

Wed, May 13 · 06:16 PM CDT

CVE-2026-44008

9.8/10 · Must read/watch

NVDvuln

Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Functi

CVECVE-2026-44008

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 13 · 06:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Wed, May 13 · 06:16 PM CDT

CVE-2026-44009

9.8/10 · Must read/watch

NVDvuln

Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.

CVECVE-2026-44009

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 13 · 06:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Wed, May 13 · 06:16 PM CDT

CVE-2026-45411

9.8/10 · Must read/watch

NVDvuln

Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed t

CVECVE-2026-45411

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 13 · 06:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Wed, Apr 22 · 09:16 AM CDT

CVE-2026-6235

9.8/10 · Must read/watch

NVDvuln

Summary
The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated atta

CVECVE-2026-6235

SeverityCRITICAL

TypeUPDATED

PublishedWed, Apr 22 · 09:16 AM CDT

ModifiedThu, Aug 06 · 10:18 PM CDT

Open article ↗

Fri, Jul 10 · 09:17 PM CDT

CVE-2026-9726

9.8/10 · Must read/watch

NVDvuln

Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

CVECVE-2026-9726

SeverityCRITICAL

TypeUPDATED

PublishedFri, Jul 10 · 09:17 PM CDT

ModifiedThu, Aug 06 · 06:28 PM CDT

Open article ↗

Fri, May 22 · 04:16 PM CDT

CVE-2026-39821

9.6/10 · Must read/watch

NVDvuln

Summary
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a

CVECVE-2026-39821

SeverityCRITICAL

TypeUPDATED

PublishedFri, May 22 · 04:16 PM CDT

ModifiedThu, Aug 06 · 01:17 PM CDT

Open article ↗

Fri, Mar 20 · 11:16 PM CDT

CVE-2026-33186

9.1/10 · Must read/watch

NVDvuln

Summary
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g.,

CVECVE-2026-33186

SeverityCRITICAL

TypeUPDATED

PublishedFri, Mar 20 · 11:16 PM CDT

ModifiedThu, Aug 06 · 01:17 PM CDT

Open article ↗

Fri, May 22 · 04:16 AM CDT

CVE-2026-39830

9.1/10 · Must read/watch

NVDvuln

Summary
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

CVECVE-2026-39830

SeverityCRITICAL

TypeUPDATED

PublishedFri, May 22 · 04:16 AM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Fri, May 22 · 04:16 AM CDT

CVE-2026-42508

9.1/10 · Must read/watch

NVDvuln

Summary
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

CVECVE-2026-42508

SeverityCRITICAL

TypeUPDATED

PublishedFri, May 22 · 04:16 AM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Wed, May 13 · 06:16 PM CDT

CVE-2026-44007

9.1/10 · Must read/watch

NVDvuln

Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestrict

CVECVE-2026-44007

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 13 · 06:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Mon, Aug 04 · 07:15 AM CDT

CVE-2025-20701

8.8/10 · Worth your time

NVDvuln

Summary
In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVECVE-2025-20701

SeverityHIGH

TypeUPDATED

PublishedMon, Aug 04 · 07:15 AM CDT

ModifiedThu, Aug 06 · 10:16 PM CDT

Open article ↗

Thu, Mar 19 · 02:16 PM CDT

CVE-2025-71260

8.8/10 · Worth your time

NVDvuln

Summary
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote cod

CVECVE-2025-71260

SeverityHIGH

TypeUPDATED

PublishedThu, Mar 19 · 02:16 PM CDT

ModifiedThu, Aug 06 · 03:21 PM CDT

Open article ↗

Mon, Apr 06 · 01:17 PM CDT

CVE-2026-3524

8.8/10 · Worth your time

NVDvuln

Summary
Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

CVECVE-2026-3524

SeverityHIGH

TypeUPDATED

PublishedMon, Apr 06 · 01:17 PM CDT

ModifiedThu, Aug 06 · 02:21 PM CDT

Open article ↗

Thu, May 14 · 02:16 PM CDT

CVE-2026-6477

8.8/10 · Worth your time

NVDvuln

Summary
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length

CVECVE-2026-6477

SeverityHIGH

TypeUPDATED

PublishedThu, May 14 · 02:16 PM CDT

ModifiedThu, Aug 06 · 01:18 PM CDT

Open article ↗

Sun, Jun 28 · 12:16 AM CDT

CVE-2026-10643

8.7/10 · Worth your time

NVDvuln

Summary
Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of an aligned cmsg header plus the payload.

CVECVE-2026-10643

SeverityHIGH

TypeUPDATED

PublishedSun, Jun 28 · 12:16 AM CDT

ModifiedThu, Aug 06 · 10:16 PM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.