https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Adobe.Sun, 26 Jul 2026 22:32:51 GMThttps://schneier.com/blog/archives/2026/07/end-to-end-encryption-and-going-dark.htmlcst-3097A new academic paper analyzes the third round of the 'Going Dark' debate, tracing encryption policy from the 1990s Crypto Wars through current end-to-end encryption (E2EE) controversies. The authors identify five distinct E2EE technical scenarios and demonstrate that E2EE is embedded throughout modern infrastructure including Transport Layer Security, Secure Shell, Virtual Private Networks, and Zero Trust Architecture, arguing that broad restrictions would harm cybersecurity and government operations.Thu, 23 Jul 2026 11:03:50 GMThttps://bleepingcomputer.com/news/security/adobe-chrome-extension-flaw-let-sites-access-private-whatsapp-chatscst-2996A vulnerability in the Adobe Acrobat extension for Chrome allowed unauthorized access to WhatsApp Web conversations and data without requiring authentication. The flaw exposed private messages and information that should have been protected, affecting users who had both the extension and WhatsApp Web open in their browser.Wed, 22 Jul 2026 13:22:20 GMThttps://tenable.com/blog/oracle-july-2026-critical-patch-update-addresses-1235-cvescst-2966Oracle released its July 2026 Critical Patch Update on July 21, addressing 1235 unique CVEs across 1449 patches spanning 32 product families. The release included 261 critical patches (18% of all patches), with Oracle E-Business Suite and Fusion Middleware receiving the largest share of fixes. The update covers vulnerabilities across multiple severity levels, with 219 patches in Fusion Middleware exploitable remotely without authentication.Tue, 21 Jul 2026 21:07:46 GMThttps://cyberscoop.com/director-of-commerce-ai-standards-office-out-after-three-monthscst-2861Chris Fall has stepped down as director of the Center for AI Standards and Innovation (CAISI) at the National Institute of Standards and Technology (NIST) after three months, with NIST Director Arvind Raman assuming the acting director role. CAISI has become a key federal hub for testing frontier AI models from companies like OpenAI and Anthropic to assess cybersecurity and national security risks, including potential offensive hacking capabilities and assistance with weapons development. Fall's departure comes as the White House has elevated CAISI's work as a critical mechanism for evaluating whether new AI models represent a meaningful advance in dangerous capabilities.Mon, 20 Jul 2026 18:10:03 GMThttps://elastic.co/security-labs/contagious-interview-malware-svg-steganographycst-2774Elastic Security Labs discovered a North Korean-aligned campaign, tracked as REF9403, that uses fake job postings and coding challenges to distribute malware hidden in SVG image files via steganography. The trojanized code repositories appear functional but install a four-stage payload including credential and wallet stealers, file exfiltration, a Socket.IO-based remote access trojan, and clipboard stealing capabilities. The campaign demonstrates how threat actors target developers to establish initial access for downstream supply chain attacks.Sat, 18 Jul 2026 00:00:00 GMThttps://cloud.google.com/blog/topics/threat-intelligence/exposed-cloud-functions-hardencst-2607Mandiant security assessments identify publicly exposed serverless applications and functions lacking authentication that frequently contain vulnerabilities in custom code or third-party packages. Successful exploitation of application-level flaws like local file inclusion or command injection can grant attackers remote code execution and container-level access, which may lead to lateral movement and cloud environment compromise. The article describes attack scenarios and hardening strategies for securing serverless deployments that must remain publicly accessible.Wed, 15 Jul 2026 14:00:00 GMThttps://thehackernews.com/2026/07/firefox-chrome-adobe-and-vmware-updates.htmlcst-2594Mozilla released Firefox updates to patch two critical vulnerabilities in the JavaScript/WebAssembly and DOM/Navigation components with known public exploit code. Chrome, Adobe, and VMware also issued updates for multiple critical security flaws, though details on those vendors' patches are not provided in this incomplete summary.Wed, 15 Jul 2026 13:18:53 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5099539-extended-security-updatecst-2513Microsoft released Windows 10 KB5099539, an extended security update containing July 2026 Patch Tuesday fixes for 570 vulnerabilities and additional security patches. This update addresses a substantial volume of identified flaws across the Windows 10 platform.Tue, 14 Jul 2026 18:49:28 GMThttps://securityweek.com/adobe-patches-critical-coldfusion-vulnerabilitiescst-2519Adobe released patches for critical vulnerabilities in ColdFusion that could enable remote code execution and privilege escalation. The flaws pose significant risk to organizations running vulnerable versions of the application server.Tue, 14 Jul 2026 17:06:35 GMThttps://bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloudcst-2474The vendor released security updates addressing 16 vulnerabilities across multiple products in July 2026, including three critical flaws in NetWeaver, Commerce Cloud, and AppRouter. The updates cover significant exposure in SAP's enterprise middleware and cloud commerce platforms.Tue, 14 Jul 2026 11:42:21 GMThttps://securityweek.com/in-other-news-dhs-database-hacked-adobe-boosts-patch-cadence-canada-disrupts-ransomware-opscst-2335This news roundup mentions several security stories: a breach of a Department of Homeland Security database, Adobe increasing its patch release frequency, and Canadian authorities disrupting ransomware operations. The article also references a lawsuit between Abnormal AI and Anthropic, a data breach affecting 7 million AssuranceAmerica customers, and the NSA reactivating its Tailored Access Operations unit.Fri, 10 Jul 2026 15:01:19 GMThttps://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-sentencedcst-2283Angelo John Martino III, a ransomware negotiator at DigitalMint, was sentenced to 70 months in prison for conspiring with BlackCat affiliates to extort $75.3 million from five U.S. companies he was hired to help during ransomware incidents. Martino shared confidential negotiating positions and insurance policy limits with his co-conspirators to maximize ransom demands, effectively playing both sides of negotiations between April and September 2023. His co-conspirators, including fellow DigitalMint negotiator Kevin Tyler Martin and Sygnia incident response manager Ryan Clifford Goldberg, received four-year sentences for their roles in deploying BlackCat ransomware against additional victims.Fri, 10 Jul 2026 00:16:13 GMThttps://risky.biz/ssupreme-court-undermines-section-702cst-2233A recent US Supreme Court decision may disrupt Section 702 intelligence collection involving data from Europe. Section 702 permits the US government to compel communication service providers to assist in collecting intelligence on non-US persons, and this collection has depended on data sharing agreements that enable legal personal data transfers from the EU to the US. The ruling creates legal uncertainty for the transatlantic intelligence framework that has underpinned both foreign intelligence operations and international commerce.Thu, 09 Jul 2026 08:48:42 GMThttps://securityweek.com/cisa-urges-immediate-patching-of-exploited-coldfusion-langflow-joomla-flawscst-2155CISA has added four newly exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: critical flaws in Adobe ColdFusion and Langflow, plus two Joomla extension vulnerabilities. Federal agencies have until July 10 to apply patches for these active threats.Wed, 08 Jul 2026 10:45:25 GMThttps://bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accountscst-481A phishing campaign is impersonating over 30 major brands including Adobe, Netflix, Coca-Cola, and OpenAI by posing as fake job interviews targeting marketing professionals to harvest Google account credentials. Attackers use the trusted brand names and interview format to build credibility and increase the likelihood that targets will enter their login information on fraudulent sites.Mon, 06 Jul 2026 20:27:37 GMThttps://bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attackscst-2A critical Adobe ColdFusion vulnerability (CVE-2026-48282) is being actively exploited in the wild, according to KEVIntel. The flaw carries maximum severity rating and poses an immediate threat to organizations running affected ColdFusion instances.Mon, 06 Jul 2026 13:18:37 GMThttps://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanzacst-554Adobe released a security advisory on June 30 addressing multiple critical vulnerabilities in ColdFusion 2025 (Update 9 and below) and ColdFusion 2023 (Update 20 and below), including several arbitrary code execution flaws, privilege escalation issues, and file system access vulnerabilities. The analysis highlights that several vulnerabilities involve the Remote Development Services (RDS) feature, which requires being explicitly enabled and having authentication disabled to be exploited, and researchers note difficulty in mapping all disclosed CVEs to specific vulnerability details.Thu, 02 Jul 2026 16:38:28 GMThttps://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.htmlcst-46Adobe released patches for multiple critical vulnerabilities in ColdFusion and Campaign Classic, including seven flaws with CVSS 10.0 scores that could enable arbitrary code execution, privilege escalation, file system read access, and security feature bypass. The patches address critical and important severity issues across both products.Wed, 01 Jul 2026 15:25:46 GMThttps://thehackernews.com/2026/07/anthropic-restores-claude-fable-5-after.htmlcst-53Anthropic restored access to Claude Fable 5 globally on July 1 after the U.S. Commerce Department lifted export controls that had been in place for approximately two and a half weeks. The model is now available across Claude.ai, the Claude Platform, Claude Code, and Claude Cowork.Wed, 01 Jul 2026 06:46:17 GMThttps://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firmcst-131The Popa Android botnet has compromised millions of consumer TV boxes over four years, forcing them to serve as residential proxies for advertising fraud, account takeovers, and data scraping. Researchers from multiple security firms have linked Popa to NetNut, a residential proxy provider operated by publicly-traded Israeli firm Alarum Technologies, with evidence connecting a Popa control domain (ninjatech.io) to NetNut's vice president of research and development.Thu, 18 Jun 2026 17:37:58 GMThttps://risky.biz/srsly-risky-biz-anthropic-lacks-emotional-intelligencecst-171Anthropic released two new AI models, Mythos 5 and Fable 5, but withdrew them within days after communications between Amazon CEO Andy Jassy and US officials raised concerns about potential jailbreaking vulnerabilities. The Commerce Department subsequently informed Anthropic that the models would be subject to export controls restricting their use by foreign nationals. The incident reflects ongoing friction between AI developers and the US government over model release practices and security standards.Thu, 18 Jun 2026 06:25:00 GMThttps://recordedfuture.com/blog/may-2026-cve-landscapecst-1953In May 2026, Insikt Group identified 41 high-impact vulnerabilities requiring prioritized remediation, representing an 11% increase from April. These vulnerabilities affected 20 vendors, with 21 included in CISA's Known Exploited Vulnerabilities catalog, 19 detected via honeypot data, and one reported by a vendor. Notably, 12 vulnerabilities enabled remote code execution, public proof-of-concept exploits were available for 32 of them, and five were first disclosed between 2008 and 2010, demonstrating continued exploitation of long-standing weaknesses.Mon, 08 Jun 2026 00:00:00 GMThttps://reliaquest.com/blog/threat-spotlight-no-safe-distance-the-business-impact-of-recent-global-developmentscst-2205The US-Israel-Iran conflict is now affecting private companies and critical infrastructure beyond direct military involvement, with Iranian and pro-Iranian groups targeting cloud platforms, medical technology firms, point-of-sale systems, and launching DDoS attacks. Organizations are exposed through business relationships, supply chain roles, and geographic ties rather than direct participation in the conflict. The threat landscape is expanding from espionage toward disruption of critical infrastructure, suppliers, and connected devices.Thu, 12 Mar 2026 09:00:00 GMThttps://thezdi.com/blog/2026/3/10/the-march-2026-security-update-reviewcst-398Adobe released eight bulletins addressing 80 CVEs across multiple products including Acrobat Reader, Experience Manager, and Substance 3D tools in March 2026. Microsoft patched 84 CVEs in Windows, Office, Edge, Azure, and other components, with eight rated Critical severity and no active exploitation reported at release. Notable vulnerabilities include an Excel XSS bug exploitable by Copilot agents for data exfiltration and Office Preview Pane remote code execution issues.Tue, 10 Mar 2026 17:57:37 GMT