Posts of last 24 hours

CVE-2026-53289 | Linux Kernel up to 7.0.9 ice ice_sriov.c ice_reset_all_vfs txq_map null pointer dereference (WID-SEC-2026-2119)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.1.174/6.6.140/6.12.90/6.18.32/7.0.9. Affected is the function ice_reset_all_vfs of the file ice_sriov.c of the component ice. Executing a manipulation of the argument txq_map can lead to null pointer dereference. This vulnerability is tracked as CVE-2026-53289. The attack is only possible within the local network. No exploit exists. You should upgrade the affected component.
https://vuldb.com/vuln/374363
CVE-2026-53288 | Linux Kernel up to 6.12.90/6.18.32/7.0.9 arm64 declare_kernel_vmas stack-based overflow (WID-SEC-2026-2119)
A vulnerability was found in Linux Kernel up to 6.12.90/6.18.32/7.0.9. It has been rated as critical. Affected is the function declare_kernel_vmas of the component arm64. This manipulation causes stack-based buffer overflow. This vulnerability is registered as CVE-2026-53288. It is feasible to perform the attack on the physical device. No exploit is available. Upgrading the affected component is advised.
https://vuldb.com/vuln/374396
CMD

You must login to view this content

https://darkfeed.io/2026/06/29/cmd-29/
Supreme Court delivers ‘major win’ for tech privacy in Chatrie ruling

Dissenting justices who criticized the ruling said it would have “seismic” implications for the Fourth Amendment.

The post Supreme Court delivers ‘major win’ for tech privacy in Chatrie ruling appeared first on CyberScoop.

https://cyberscoop.com/supreme-court-geofence-warrant-ruling-phone-privacy-chatrie/
New Claude Code Attack Allows Attackers to Take Full Control of Developers’ Systems

Researchers at Mozilla’s Zero Day Investigative Network (0DIN) have demonstrated a proof-of-concept attack that shows how a completely clean-looking GitHub repository can trick AI-powered coding agents like Claude Code into silently opening a reverse shell on a developer’s machine, without a single line of malicious code ever appearing in the repository. Published on June 25, […]

The post New Claude Code Attack Allows Attackers to Take Full Control of Developers’ Systems appeared first on Cyber Security News.

https://cybersecuritynews.com/new-claude-code-attack/
US racks up about 400 wins over illegal World Cup streaming sites
The World Cup’s organizing body, FIFA, helped identify hundreds of domains taken down in an action organized by the U.S., along with the help of U.S. broadcaster NBC Universal and other entities.
https://therecord.media/us-takes-down-hundreds-world-cup-streaming-sites
DragonForce Ransomware Leaks Data Allegedly Stolen from U.S. Healthcare Firm VIP Imaging
DragonForce ransomware has published 8.67 GB of data allegedly stolen from VIP Imaging, a U.S. cardiac imaging provider in Anaheim, California. Unverified.
https://darkwebinformer.com/dragonforce-ransomware-leaks-data-allegedly-stolen-from-u-s-healthcare-firm-vip-imaging/
U.S. Seizes Hundreds Domains Used to Stream World Cup Matches Illegally

The U.S. Department of Justice (DOJ) has announced the seizure of nearly 400 domains used to illegally stream FIFA World Cup 2026 matches, marking a significant crackdown on global digital piracy networks. The operation, conducted under “Operation Offsides,” targeted websites that were broadcasting live World Cup matches without authorization, in violation of U.S. copyright laws. […]

The post U.S. Seizes Hundreds Domains Used to Stream World Cup Matches Illegally appeared first on Cyber Security News.

https://cybersecuritynews.com/u-s-seizes-domains-world-cup-matches-illegally/
CVE-2024-21490 | angular 1.3.0 ng-srcset Directive redos (SNYK-JS-ANGULAR-6091113 / Nessus ID 242412)
A vulnerability has been found in angular 1.3.0 and classified as problematic. This issue affects some unknown processing of the component ng-srcset Directive Handler. Performing a manipulation results in inefficient regular expression complexity. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is cataloged as CVE-2024-21490. It is possible to initiate the attack remotely. There is no exploit available.
https://vuldb.com/vuln/253390
CVE-2026-41855 | Vmware Spring Framework up to 5.3.48/6.1.27/6.2.18/7.0.7 deserialization (EUVD-2026-35344)
A vulnerability has been found in Vmware Spring Framework up to 5.3.48/6.1.27/6.2.18/7.0.7 and classified as problematic. Impacted is an unknown function of the component org.springframework.jms.support.converter.MappingJackson2MessageConverter/org.springframework.jms.support.converter.JacksonJsonMessageConverter. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2026-41855. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.
https://vuldb.com/vuln/369408

Managed ad