SecurityTicks

New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch 2026-08-05 at 15:47 By A memory corruption flaw in the Linux kernel’s Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel

Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk 2026-08-05 at 15:47 By Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled device codes that victims approve on Microsoft’s real authentication page. Once access and refresh tokens are issued, attackers may retain

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data 2026-08-05 at 14:52 By A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The “evil twin” extensions were uploaded to the

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup 2026-08-05 at 14:04 By An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The

Leaked n8n API Tokens Exposed Live Instances to Credential Theft 2026-08-05 at 13:35 By GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability. We scanned public GitHub commits for exposed

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself 2026-08-05 at 12:54 By An agent running Anthropic’s Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project during a cyber evaluation by the UK’s AI Security Institute. When a bystander

CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited 2026-08-05 at 12:54 By The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows – CVE-2026-9198 (CVSS