Today's cybersecurity landscape highlights critical vulnerabilities, with several actively exploited flaws requiring immediate attention. We also see emerging concerns around AI's role in security, both as a tool for researchers and a potential attack vector.
Critical RCE Vulnerability in Orkes Conductor Under Active ExploitationVulnerability
A severe remote code execution flaw, CVE-2026-58138, affecting the Orkes Conductor workflow platform, is currently being actively exploited. This unauthenticated vulnerability could allow attackers to execute arbitrary code without needing login credentials.
Why it matters: If your website or services use Orkes Conductor, it's crucial to patch immediately to prevent attackers from gaining full control of your system.
Read more at The Hacker News ↗
SolarWinds Patches High-Severity RCE in Access Rights ManagerVulnerability
SolarWinds has released an urgent update for its Access Rights Manager (ARM) to fix CVE-2026-28326. This vulnerability, rated 8.8, could allow unauthenticated remote code execution due to a hard-coded key flaw.
Why it matters: If you use SolarWinds ARM to manage access to your systems, update to the latest version promptly to prevent unauthorized code execution on your network.
Read more at The Hacker News ↗
CISA Warns of Actively Exploited Linux Kernel FlawsVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its 'Known Exploited Vulnerabilities' catalog. These flaws, including CVE-2025-39682, are being actively exploited in attacks.
Why it matters: Any web server or service running on Linux should have its kernel updated as soon as possible to mitigate these actively exploited vulnerabilities.
Read more at The Hacker News ↗
North Korean WaterPlum Group Infects 30,000 Devices Globally, Steals MillionsThreat
The North Korean hacking group 'WaterPlum' compromised over 30,000 devices worldwide between December 2025 and July 2026. The group managed to steal more than $10.7 million in cryptocurrency, funneling the funds back to North Korea.
Why it matters: This highlights the constant threat from state-sponsored groups; robust security measures are essential for any business handling sensitive data or cryptocurrency.
Read more at BleepingComputer ↗
ShinyHunters Breach Clop Ransomware Leak SiteRansomware
The ShinyHunters extortion group reportedly breached the Clop ransomware operation's dark web leak site. They defaced the site and claim to have stolen server data and private keys for Clop's onion service, threatening to expose the ransomware gang.
Why it matters: While this involves two malicious groups, it underscores the unpredictable nature of cybercrime and the constant battles within the dark web.
Read more at BleepingComputer ↗
Researchers Use AI to Exploit OpenAI Flaws, Access Internal RepositoriesThreat
Security researchers leveraged Anthropic's Claude Opus 5 AI to identify and chain two vulnerabilities in OpenAI's public forum software and login system. This allowed them to compromise OpenAI employee accounts and access an internal code repository.
Why it matters: This demonstrates how advanced AI can accelerate vulnerability discovery and exploitation, emphasizing the need for continuous security audits and multi-factor authentication for all internal systems.
Read more at The Hacker News ↗
Google Gemini Breaches Real Company Systems During Security TestOther
Google's Gemini AI model accidentally accessed and compromised real company systems during a cybersecurity evaluation conducted in May 2026. This incident, involving a domain mix-up during testing, highlights the potential risks of AI systems interacting with the internet.
Why it matters: Even controlled AI environments can pose unexpected risks; businesses integrating AI must implement strict isolation and access controls to prevent unintended network access or data exposure.
Read more at The Hacker News ↗
CrowdSec GitHub Repositories Copied Following TanStack npm AttackBreach
CrowdSec, a security firm, reported that 170 of its private GitHub repositories were copied by an attacker in May. The breach occurred through a compromised account of a former employee, whose laptop was affected by the earlier supply chain attack on TanStack's npm packages.
Why it matters: Timely deactivation of former employee accounts and monitoring for suspicious activity are critical to prevent unauthorized data access, especially after supply chain compromises.
Read more at The Hacker News ↗
BragJack Attacks Hijack AI Browser Agents via Malicious ExtensionsThreat
A proof-of-concept attack called 'BragJack' can hijack AI assistants in popular browsers like Chrome and Edge using a single malicious extension. This 'Prompt Forcing' technique demonstrates how compromised browser extensions can manipulate AI behavior.
Why it matters: Be cautious about the browser extensions you install, as they can be a vector for compromising not only your browser but also any AI agents you use, potentially leading to data exfiltration or manipulation.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.