Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers across US Critical Infrastructure

The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology OT devices, including programmable logic controllers PLCs. These actions disrupted PLCs across several U.S. critical infrastructure sectors through...

EUVD-2026-47557

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS US executes to...

EUVD-2026-47555

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS US. While the...

CVE-2026-60982

Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle US...

CVE-2026-62562

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

CVE-2026-62521

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: US Payroll - General. Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

CVE-2026-62465

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS US executes to...

PT-2026-63235

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle HRMS US versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can...

PT-2026-63237

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle HRMS US versions 12.2.3 through 12.2.15 Description An issue exists in the US Payroll Year End component of the Oracle HRMS US product. A low privileged attacker with network access via HTTP can compromise the...

PT-2026-63218

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle HRMS US versions 12.2.7 through 12.2.15 Description An issue in the US Payroll - General component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation...

PT-2026-63219

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle HRMS US versions 12.2.3 through 12.2.15 Description A flaw in the US Payroll - General component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthoriz...

PT-2026-62719

Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle U.S...

ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories

A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation. Old bugs are back, weak defaults are earni...

FluxInk-Sunia SPB Peripheral Driver LPE Vulnerability - Lenovo Support US

No description provided...

Multi-Vendor BIOS Security Vulnerabilities (July 2026) - Lenovo Support US

No description provided...

FBI and Spanish Police Arrest Alleged Cyber Army of Russia Reborn Member

Spanish police and the FBI arrested an alleged Cyber Army of Russia Reborn member as international efforts against pro Russia cyberattacks continue worldwide...

Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls

Anthropic is putting Claude Fable 5 back online worldwide. On June 30, the U.S. Commerce Department lifted the export controls it had imposed on Fable and its more tightly controlled sibling Mythos 5 about two and a half weeks earlier. Fable 5 returns to users on Wednesday, July 1, across...

CVE-2026-44020 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString without protection against XML External Entity XXE attacks. An attacker could...

CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday urged Fortinet customers with FortiGate appliances to take steps to secure against ongoing malicious activity aimed at thousands of internet-accessible devices. The sweeping campaign, believed to be the work of...

CVE-2026-54103

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could chang...