N-able disclosed that its original patch for the N‑central authentication bypass (CVE‑2026‑18577) was incomplete. Hotfix 2 (2026.3.1.10) adds extra hardening, forcing all customers to upgrade or risk continued remote‑code execution and persistence in managed environments.
Researchers show how crafted CSS inside email can break out of webmail sanitizers, letting attackers exfiltrate session tokens, hijack accounts and even steal passwords across Outlook, Gmail, Fastmail, ProtonMail, Yahoo and AOL. The findings force mail providers to rethink HTML/CSS isolation and tighten UI‑level defenses.
A pre‑authentication reflected XSS in WordPress’s login screen (CVE‑2026‑64638) lets an attacker inject script that, when a logged‑in admin clicks the link, can be chained to remote PHP code execution. The flaw affects all versions and is fixed in 7.0.3 and back‑ported to older releases.
MIT CSAIL researchers demonstrate a new 'TONTOU' interrupt‑injection technique that sidesteps neutralization‑based Spectre v2 defenses on recent Intel and AMD CPUs. The exploit reads arbitrary kernel memory, including /etc/shadow password hashes, at a measurable rate on AMD Zen 2. It proves current Spectre mitigations are insufficient, forcing OS vendors to rethink speculative‑execution defenses.
Check Point Research uncovered five memory‑corruption bugs in workerd, the shared runtime behind Cloudflare Code Mode and Workers, and chained them into two sandbox‑escape attacks. The flaws let a malicious worker read other tenants’ secrets and even execute native code on the host, compromising the isolation model that secures millions of edge‑served sites.
New investigations reveal Iranian state-linked hackers are targeting additional U.S. water treatment facilities, extending a campaign that already compromised several municipal systems. The broader intrusion highlights a growing vulnerability in critical infrastructure and could prompt tighter federal cybersecurity mandates for utilities.
You’re caught up.
That was all 6 stories in the 8 August issue.