JetBrains disclosed a critical unauthenticated RCE bug (CVE‑2026‑63077) in all TeamCity on‑premises editions that lets an attacker bypass login and run OS commands. The flaw is fixed in versions 2025.11.7 and 2026.1.3, and a security‑patch plugin is available for older 2017.1+ builds.
LavaHQ scanned UDP port 623 and identified 36,872 internet‑exposed IPMI interfaces. A flaw (CVE‑2013‑4786) caused 24,650 of them to reveal password‑derived HMAC‑SHA1 hashes, making bulk offline cracking trivial; dozens of weak, factory defaults were recovered, confirming active exploitation. A compromised BMC gives attackers full control over server infrastructure.
A CVSS 10.0 vulnerability (CVE‑2026‑59726) in Ruflo’s MCP bridge exposed unauthenticated POST /mcp endpoints, letting attackers execute commands, obtain a shell in the bridge container, read provider API keys, and poison the AgentDB learning store. All Ruflo releases before 3.16.3 are vulnerable; the issue is patched in version 3.16.3.
Broadcom’s VMSA‑2026‑0006 fixes CVE‑2026‑59309, letting attackers bypass vCenter authentication, CVE‑2026‑59310, a directory‑traversal that enables remote code execution, and CVE‑2026‑47876, a VMXNET3 bug that permits VM escape. Patches are in vCenter 8.0 U3k and ESXi 8.0 U3k, protecting all VMware Telco Cloud deployments.
Nozomi Networks discovered Tengu, a Mirai‑derived IoT botnet that triggers a hardware watchdog reboot when defenders terminate its main process. The forced reboot reactivates its hidden guardian and other persistence hooks, letting the malware regain control on compromised Linux devices. The threat spreads via Telnet credential brute‑force and supports dozens of DDoS attacks.
The Russian FSB charged Pavel Durov under Article 205.1 for failing to remove Telegram channels, chats and bots used by Ukrainian services and extremist groups to plan sabotage, attacks and cyber‑fraud. The move escalates legal pressure on the messenger, placing Durov on an international wanted list.
The FCC has prohibited new imports of foreign‑made humanoid robots, quadruped robots, and power inverters, citing cybersecurity and national‑security concerns. The move, aimed squarely at China, cuts off a market where Chinese firms hold about 85% of shipments and could ripple through supply chains and U.S., China tech relations.
You’re caught up.
That was all 7 stories in the 29 July issue.