Velkrypt Wire
A newly disclosed OpenSSH bug can let attackers sign in to accounts that have no password set. Researchers saw exploitation attempts almost immediately, and one honeypot was taken to root. Audit for passwordless accounts and update OpenSSH as soon as your distribution ships the fix.
Attackers reached the bank's systems through a third-party platform, then moved the bank's own money out as stablecoins. Customer accounts were not touched, the bank says.
CVE-2026-19868 lets an attacker with credentials for one login method slip past SAML checks, including SAML-enforced MFA.
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution (CVSS 9.8). Festo has updated fix guidance for FactoryViews and MES4 installs that bundle XAMPP.
Repositories posing as security utilities are being used to infect the people most likely to download them: researchers and defenders.
Prosecutors say the scheme impersonated executives and lawyers; one Missouri hospital system lost $4.8 million.
The response follows a run of breaches across Asia, including an incident at internet company GMO's Onamae service.
Enterprise switch owners should check D-Link's advisory and restrict management interfaces until fixes are applied.
Attacks first blamed on a patched flaw actually used CVE-2026-107441, an out-of-bounds write that allows OS commands through crafted HTTP requests.
Researchers at QiAnXin's XLab found the implant in the server that runs CWP, a free panel widely used to manage Linux hosting boxes.
Lockdown Mode, added in June to limit data theft through prompt injection, could be sidestepped before OpenAI fixed the flaw.
Retailers in several European countries reported refrigeration systems tampered with remotely. A separate attack on a French blood bank site did not affect blood products.
The record crypto heist began in June, when an employee installed a tampered installer while setting up an AI coding tool.
Restart Chrome to apply the update. Critical browser bugs are a common first step in drive-by attacks.
CVE-2026-119977, a time-of-check/time-of-use race in WordPress Core, is now on the KEV catalog based on evidence of active exploitation.
Manufacturer Videostrong planted the backdoor in set-top boxes and sold criminals access to the resulting network.
Integration tokens and API tokens may be exposed. GitBook revoked all personal API tokens and its MCP server needs re-authentication.
The leaked personnel database was pulled from an Okta system used by the department and is now hosted by a transparency group.
CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable identifiers) are being used in the wild.
One email every week: the exploited vulnerabilities to patch, the breaches that matter and what to do about them.