A command injection vulnerability in GitHub’s push pipeline could let an authenticated user achieve remote code execution with just a single git push, impacting GitHub.com and GitHub Enterprise Server. The exposure potentially put millions of repositories at risk; organizations should urgently apply GHES updates, review audit logs for unusual push options, and enforce least-privilege push access to sensitive repos.
Source: SecurityWeek
AI finds 271 Firefox zero-days; Firefox 150 ships fixes as Mythos changes the game
Mozilla’s latest release includes fixes for 271 security vulnerabilities identified during testing with Anthropic’s Claude Mythos preview, underscoring how frontier AI can surface large volumes of latent bugs quickly. The scale of findings highlights a new phase in vulnerability discovery—defenders should accelerate patch cycles and expect adversaries to wield similar AI capabilities.
Source: Schneier on Security
Microsoft patches Entra ID flaw that let AI agents escalate to tenant takeover
A vulnerability in the Microsoft Entra ID Agent ID Administrator role allowed AI agents to escalate privileges and impersonate highly privileged identities. Microsoft has issued a fix; customers should audit role assignments, review service principal permissions, and tighten agent identity governance to prevent similar abuse paths.
Source: SC Media
New “PhantomRPC” privilege escalation technique in Windows remains unpatched
Researchers detailed a Windows technique dubbed PhantomRPC where a fake RPC server impersonates target services to escalate privileges to SYSTEM. With no patch available, defenders should harden RPC exposure, restrict untrusted network paths, monitor for anomalous RPC activity, and apply least-privilege service configurations while awaiting vendor remediation.
Source: SecurityWeek
CISA adds actively exploited Windows and ScreenConnect flaws to KEV
CISA’s KEV update flags a Windows Shell issue and ConnectWise ScreenConnect path traversal (CVE-2024-1708) as actively exploited, mandating rapid remediation for federal agencies and signaling urgent risk to enterprises. Prioritize patching, hunt for suspicious ScreenConnect access patterns, and validate that external admin interfaces are locked down.
Source: The Hacker News
GlassWorm: 70+ malicious Open VSX “sleeper” extensions impersonate popular projects
Security researchers linked over 70 cloned Open VSX extensions to the GlassWorm campaign, likely positioned as sleeper payloads to target developer environments. Teams should audit installed extensions, verify publishers, implement extension allowlists, and monitor CI/CD systems for anomalous activity stemming from developer tooling.
Source: SecurityWeek
VECT “ransomware” is actually a destructive wiper—paying won’t recover your data
Check Point reports that VECT permanently destroys large files instead of encrypting them across Windows, Linux, and ESXi variants, making recovery impossible even for the operators. The group leveraged a vast affiliate network via underground forums; defenders should treat VECT infections as destructive incidents, emphasize offline/immutable backups, and block its initial access vectors.
Source: Check Point Blog
You May Also Be Interested In...
LiteLLM SQL injection (CVE-2026-42208) exploited within 36 hours of disclosure
Vimeo confirms user and customer data breach tied to third-party incident