PromptArmor found that Atlassian's Rovo assistant can be tricked into sending Jira tickets and Confluence documents to an attacker-controlled server via indirect prompt injection. The exploit works even when web search is disabled, and only one of the two discovered exfiltration paths has been patched.
A heap buffer overflow in the Apache Portable Runtime (APR) Redis client (CVE‑2026‑34501) affects any software that uses APR for Redis connectivity, such as Apache httpd and Subversion. Exploitation could enable remote code execution, making prompt patching essential.
CVE‑2026‑34191 exposes a SQL injection bug in the apr_dbd_oracle driver of the Apache Portable Runtime. Any application that relies on APR for Oracle database access can be tricked into executing arbitrary queries, potentially compromising data integrity and confidentiality.
Hacktivist group Head Mare exploited unpatched TrueConf video‑conferencing servers, swapping legitimate client installers for malicious versions that embed the PhantomCore and PhantomGraph backdoors. The malware grants system‑level access, can dump LSASS credentials, and spreads to any user who downloads the trojanized installer, endangering Russian enterprises and any organization connecting to compromised TrueConf servers.
You’re caught up.
That was all 4 stories in the 9 August issue.