Hackers Exploit Critical Auth Bypass in Gitea Docker Image: Attackers are actively abusing a critical flaw in the official Docker image for the self-hosted Git service Gitea, tracked as CVE-2026-20896, which ships with reverse-proxy authentication trusting an identity header from any source IP. That misconfiguration lets an unauthenticated internet client claim to be any user, including admins, and researchers say exploitation began less than two weeks before the bug was even publicly disclosed. With roughly 6,200 instances exposed on the public web, maintainers have released two patched versions and urged anyone unable to upgrade immediately to lock down the trusted-proxy setting and review access logs for signs of compromise.
Critical Adobe ColdFusion Vulnerability Exploited in Attacks: A maximum-severity path traversal bug in Adobe ColdFusion, CVE-2026-48282, is already under active attack just days after patches shipped, with one monitoring platform recording in-the-wild exploitation within two hours of public disclosure. The flaw, which carries a perfect 10.0 severity score, can lead to arbitrary code execution and affects ColdFusion 2025.9, 2023.20, and earlier versions. Federal agencies were ordered to patch by July 10, and the rapid turnaround from disclosure to exploitation is being cited as a warning sign of how little time organizations now have to test and deploy fixes before attackers move.
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros: Researchers disclosed a use-after-free bug in Linux’s futex code, present since 2011, that lets any logged-in local user escalate straight to root and even escape containers, with a working exploit reported to be 97% reliable. The flaw needs no special permissions or network access, just ordinary threading calls available to any local process, and the researchers say it can be chained with a separate Firefox sandbox escape to turn a single malicious link click into full device takeover. Patches are rolling out unevenly across distributions, so affected organizations are advised to confirm they have the final fixed kernel build rather than an early one, since the original patch introduced its own follow-up bug.
‘BusySnake’ Infostealer Slithers Into Critical Infrastructure Networks: A previously undocumented threat group researchers call Armored Likho has compromised government agencies and electrical power entities across Russia, Brazil, and Kazakhstan using spear-phishing lures disguised as official notices or benefits paperwork. The final payload is a heavily obfuscated Python-based infostealer dubbed BusySnake, capable of harvesting browser passwords, cookies, cryptographic keys, and messaging credentials, while also enabling persistent remote access through reverse SSH tunnels. Analysts noted that some of the malware’s loader code appears to have been generated with the help of large language models, reflecting a broader trend of AI-assisted malware development among espionage-focused threat actors.
Accenture Acknowledges Security Incident Following 35GB Data Theft Claim: A threat actor going by the handle “888” claims to have stolen roughly 35GB of data from the technology consulting giant, including source code, RSA and SSH keys, Azure access tokens, and configuration files, posting a screenshot allegedly showing exfiltration from a private Azure DevOps repository tied to an accenture.com production URL. The company confirmed it is aware of an “isolated matter” and says it has remediated the source, though it has not confirmed the scope of any data exfiltration or commented on the specific claims. It is not the company’s first brush with a data exposure incident, following past episodes involving unsecured cloud storage and a 2021 ransomware attack.
