Archive snapshot

Wed, Aug 26 · 12:00 PM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Wed, Aug 26 · 12:00 PM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

5

Worth skimming

5

Tracked videos

1

NVD vulnerabilities

25

Top stories

Wed, Aug 26 · 12:00 PM CDT

Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel

9.3/10 · Must read/watch

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, Aug 26 · 12:00 PM CDT

Four in Five AI Tools Run with No IT Oversight, New Research Finds

8.7/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, Aug 26 · 12:00 PM CDT

Average Cyber Insurance Losses Increase Despite Fewer Claims

8.7/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, 26 Aug 2026 17:25:00 +0530

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

8.7/10 · Worth your time

The Hacker Newsvulnidentity

Summary
The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-202

Open article ↗

Wed, 26 Aug 2026 19:14:31 +0530

NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions

8.6/10 · Worth your time

The Hacker Newsaiidentity

Summary
Cybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies that's used as a proxy to redirect Microsoft 365 sign-ins, while capturing authenticated sessions in the process. In a report shared wi

Open article ↗

Worth skimming

Wed, 26 Aug 2026 17:06:49 +0530

Imagine the SOC Without a Queue: From Alert Backlog to AI Hypothesis Engine

8.6/10 · Worth your time

The Hacker Newsai

Summary
The SOC we've always known was built around a model that guarantees most of the alert queue will never receive analyst review. There's never time. In a traditional SOC, the typical progression follows a well-known pattern: an alert arrives; a detection engine

Open article ↗

Wed, Aug 26 · 11:00 AM CDT

Disruption with Some GitHub Services

8.4/10 · Worth your time

Hacker Newssupply-chain

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 1 hour ago.

Open article ↗

Wed, Aug 26 · 12:00 PM CDT

Linux Foundation Introduces TRACE Standard for AI Runtime Evidence

8.2/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, Aug 26 · 12:00 PM CDT

Interpol Operation Jackal IV Identifies 263 Cybercrime Suspects

8.2/10 · Worth your time

Infosecurity Magazinegeneral

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Wed, 26 Aug 2026 18:37:02 +0530

CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

8.1/10 · Worth your time

The Hacker Newsaipolicy

Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the results of two red team assessments it conducted simultaneously against two critical infrastructure organizations, using what it described as similar tradecraft while recording

Open article ↗

Videos worth watching

Wed, Aug 26 · 09:03 AM CDT

Device Code Phishing

8.8/10 · Worth your time

YouTube / John Hammondgeneral

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Summary
A quick look at how device code phishing abuses a legitimate Microsoft authentication flow to steal OAuth tokens.Watch the full video: https://youtu.be/NKS8G...

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

NVD vulnerabilities

Thu, Apr 09 · 03:16 PM CDT

CVE-2025-62718

9.9/10 · Must read/watch

NVDvuln

Summary
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the config

CVECVE-2025-62718

SeverityCRITICAL

TypeUPDATED

PublishedThu, Apr 09 · 03:16 PM CDT

ModifiedTue, Aug 25 · 01:17 PM CDT

Open article ↗

Mon, Jan 19 · 06:16 PM CST

CVE-2026-22797

9.9/10 · Must read/watch

NVDvuln

Summary
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such

CVECVE-2026-22797

SeverityCRITICAL

TypeUPDATED

PublishedMon, Jan 19 · 06:16 PM CST

ModifiedTue, Aug 25 · 01:17 PM CDT

Open article ↗

Thu, Apr 06 · 09:59 PM CDT

CVE-2016-8735

9.8/10 · Must read/watch

NVDvuln

Summary
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 O

CVECVE-2016-8735

SeverityCRITICAL

TypeUPDATED

PublishedThu, Apr 06 · 09:59 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Fri, Apr 26 · 07:29 PM CDT

CVE-2019-2725

9.8/10 · Must read/watch

NVDvuln

Summary
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successf

CVECVE-2019-2725

SeverityCRITICAL

TypeUPDATED

PublishedFri, Apr 26 · 07:29 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Fri, May 01 · 07:15 PM CDT

CVE-2020-10683

9.8/10 · Must read/watch

NVDvuln

Summary
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

CVECVE-2020-10683

SeverityCRITICAL

TypeUPDATED

PublishedFri, May 01 · 07:15 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Mon, Feb 24 · 10:15 PM CST

CVE-2020-1938

9.8/10 · Must read/watch

NVDvuln

Summary
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. I

CVECVE-2020-1938

SeverityCRITICAL

TypeUPDATED

PublishedMon, Feb 24 · 10:15 PM CST

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Mon, Mar 02 · 04:15 AM CST

CVE-2020-9546

9.8/10 · Must read/watch

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

CVECVE-2020-9546

SeverityCRITICAL

TypeUPDATED

PublishedMon, Mar 02 · 04:15 AM CST

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Mon, Mar 02 · 04:15 AM CST

CVE-2020-9548

9.8/10 · Must read/watch

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

CVECVE-2020-9548

SeverityCRITICAL

TypeUPDATED

PublishedMon, Mar 02 · 04:15 AM CST

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Mon, Feb 09 · 05:16 AM CST

CVE-2026-1615

9.8/10 · Must read/watch

NVDvuln

Summary
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerabilit

CVECVE-2026-1615

SeverityCRITICAL

TypeUPDATED

PublishedMon, Feb 09 · 05:16 AM CST

ModifiedTue, Aug 25 · 01:17 PM CDT

Open article ↗

Wed, Mar 18 · 12:16 AM CDT

CVE-2026-27459

9.8/10 · Must read/watch

NVDvuln

Summary
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values t

CVECVE-2026-27459

SeverityCRITICAL

TypeUPDATED

PublishedWed, Mar 18 · 12:16 AM CDT

ModifiedTue, Aug 25 · 01:18 PM CDT

Open article ↗

Fri, Mar 06 · 07:16 PM CST

CVE-2026-29063

9.8/10 · Must read/watch

NVDvuln

Summary
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVECVE-2026-29063

SeverityCRITICAL

TypeUPDATED

PublishedFri, Mar 06 · 07:16 PM CST

ModifiedTue, Aug 25 · 01:18 PM CDT

Open article ↗

Tue, Jan 27 · 04:16 PM CST

CVE-2026-24874

9.1/10 · Must read/watch

NVDvuln

Summary
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30.

CVECVE-2026-24874

SeverityCRITICAL

TypeUPDATED

PublishedTue, Jan 27 · 04:16 PM CST

ModifiedTue, Aug 25 · 03:20 PM CDT

Open article ↗

Fri, Mar 20 · 11:16 PM CDT

CVE-2026-33186

9.1/10 · Must read/watch

NVDvuln

Summary
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g.,

CVECVE-2026-33186

SeverityCRITICAL

TypeUPDATED

PublishedFri, Mar 20 · 11:16 PM CDT

ModifiedTue, Aug 25 · 01:18 PM CDT

Open article ↗

Wed, May 21 · 10:15 PM CDT

CVE-2025-34027

9.0/10 · Must read/watch

NVDvuln

Summary
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race conditio

CVECVE-2025-34027

SeverityCRITICAL

TypeUPDATED

PublishedWed, May 21 · 10:15 PM CDT

ModifiedTue, Aug 25 · 03:04 PM CDT

Open article ↗

Fri, May 11 · 08:29 PM CDT

CVE-2018-1258

8.8/10 · Worth your time

NVDvuln

Summary
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

CVECVE-2018-1258

SeverityHIGH

TypeUPDATED

PublishedFri, May 11 · 08:29 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Wed, Mar 18 · 10:15 PM CDT

CVE-2020-10672

8.8/10 · Worth your time

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

CVECVE-2020-10672

SeverityHIGH

TypeUPDATED

PublishedWed, Mar 18 · 10:15 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Wed, Mar 18 · 10:15 PM CDT

CVE-2020-10673

8.8/10 · Worth your time

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

CVECVE-2020-10673

SeverityHIGH

TypeUPDATED

PublishedWed, Mar 18 · 10:15 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Thu, Mar 26 · 01:15 PM CDT

CVE-2020-10968

8.8/10 · Worth your time

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

CVECVE-2020-10968

SeverityHIGH

TypeUPDATED

PublishedThu, Mar 26 · 01:15 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Thu, Mar 26 · 01:15 PM CDT

CVE-2020-10969

8.8/10 · Worth your time

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

CVECVE-2020-10969

SeverityHIGH

TypeUPDATED

PublishedThu, Mar 26 · 01:15 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Tue, Mar 31 · 05:15 AM CDT

CVE-2020-11111

8.8/10 · Worth your time

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

CVECVE-2020-11111

SeverityHIGH

TypeUPDATED

PublishedTue, Mar 31 · 05:15 AM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Tue, Mar 31 · 05:15 AM CDT

CVE-2020-11112

8.8/10 · Worth your time

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

CVECVE-2020-11112

SeverityHIGH

TypeUPDATED

PublishedTue, Mar 31 · 05:15 AM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Tue, Mar 31 · 05:15 AM CDT

CVE-2020-11113

8.8/10 · Worth your time

NVDvuln

Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

CVECVE-2020-11113

SeverityHIGH

TypeUPDATED

PublishedTue, Mar 31 · 05:15 AM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Wed, May 21 · 11:15 PM CDT

CVE-2025-34025

8.8/10 · Worth your time

NVDvuln

Summary
The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting of host binary paths that allow the container to modify host paths. The escape can be used to trigger remote code execution or direct host access depending on t

CVECVE-2025-34025

SeverityHIGH

TypeUPDATED

PublishedWed, May 21 · 11:15 PM CDT

ModifiedTue, Aug 25 · 02:40 PM CDT

Open article ↗

Fri, May 13 · 08:15 AM CDT

CVE-2022-25762

8.6/10 · Worth your time

NVDvuln

Summary
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case cou

CVECVE-2022-25762

SeverityHIGH

TypeUPDATED

PublishedFri, May 13 · 08:15 AM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Wed, Jul 21 · 03:15 PM CDT

CVE-2021-2351

8.3/10 · Worth your time

NVDvuln

Summary
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks req

CVECVE-2021-2351

SeverityHIGH

TypeUPDATED

PublishedWed, Jul 21 · 03:15 PM CDT

ModifiedTue, Aug 25 · 04:28 PM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.