Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit

How I Became Brazil's First Visually Impaired Cybersecurity Graduate — and Changed Vulnerability Research

Juan Mathews Rebello Santos trở thành người đầu tiên ở Brazil tốt nghiệp ngành an ninh mạng khi bị khiếm thị, đồng thời là nhà nghiên cứu mù đầu tiên công bố CVE (CVE-2025-26326) trên NVD của Mỹ. Anh phát hiện lỗ hổng trên các sản phẩm của Google, Microsoft, Nubank và Smiles chỉ bằng công cụ screen reader, đồng thời sáng lập BNVD.org, viết sách an ninh mạng bằng tiếng Bồ Đào Nha dành cho người khiếm thị và sở hữu hơn 50 chứng chỉ. Bài viết cũng nhấn mạnh những rào cản tiếp cận trong ngành công nghệ đối với người khiếm thị, từ hệ thống đại học không thân thiện đến hàng trăm đơn xin việc không hồi âm, và kêu gọi thiết kế bao dung là yếu tố bắt buộc, không phải sự ưu ái.

Đọc bài này để hiểu cách một lập trình viên mù nhìn đã phá vỡ giới hạn kỹ thuật số bằng sự sáng tạo và kỹ năng chuyên môn, đồng thời khám phá những thách thức thực tế mà những người có khuyết tật thị giác phải đối mặt trong ngành công nghệ và cách họ có thể chuyển đổi những trở ngại thành cơ hội.

Microsoft closes book on Nightmare Eclipse's RoguePlanet zero-day

Microsoft has patched a zero-day vulnerability in Microsoft Defender, tracked under the name RoguePlanet and discovered by Nightmare Eclipse. The fix arrives weeks after exploit code was publicly released.

Felons, Fraudsters Flog Offensive Cybersecurity Startup

A cybersecurity startup called IRIS C2, which publicly offers up to $7 million for zero-day exploits and offensive security capabilities, is operated by Jacob Wohl and Jack Burkman — convicted felons with a documented history of fabricating intelligence companies, spreading disinformation, orchestrating voter suppression robocalls, and running businesses under assumed names. Wohl, who has no formal cybersecurity training, claims the company has 40 employees and government contracts but provides no verifiable specifics. The story raises serious concerns about the legitimacy of the venture and the risks it poses to vulnerability researchers who might engage with it.

6th July – Threat Intelligence Report

Weekly threat intelligence roundup covering major ransomware incidents at River Bank & Trust, Indra Group, Nidec, and Aflac. AI-related threats include a browser-native ransomware technique abusing Chrome's File System Access API, shell injection flaws in 11 AI coding agents, and LLM phantom squatting used for phishing. Critical vulnerabilities patched include Oracle E-Business Suite RCE (CVE-2026-46817), Linux kernel privilege escalation (CVE-2026-46242), Citrix NetScaler memory disclosure (CVE-2026-8451), and Progress Kemp LoadMaster command injection (CVE-2026-8037). Threat intelligence highlights include a North Korea-linked supply chain campaign (PolinRider), a ransomware-credential theft partnership, and evolution of ClickFix into an API-driven malware delivery ecosystem.

GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6

GitLab released patch versions 19.1.1, 19.0.3, and 18.11.6 for CE and EE on June 24, 2026. The release addresses 13 CVEs including two high-severity XSS vulnerabilities (CVSS 8.7 and 8.0) in the Analytics Dashboard and Web IDE, an information disclosure issue in Duo Workflows (CVSS 7.7), and multiple authorization bypass and access control issues across CI/CD, DAST, Maven Package Registry, and other components. Self-managed GitLab installations are strongly urged to upgrade immediately. The patch also includes bug fixes across all three versions and includes database migrations that may cause downtime on single-node instances.

I Found an Unauthenticated File Disclosure Bug in a WordPress Plugin — Then Found Out I Was a Few Weeks Late

A security researcher audited the SP Project & Document Manager WordPress plugin (v4.71) and discovered an unauthenticated file disclosure vulnerability. The root cause is a logic flaw in the view_file() access gate: a negated wp_verify_nonce() call is OR-chained with all legitimate permission checks, meaning any unauthenticated visitor with no nonce bypasses all access controls for files inside project folders. A second independent bypass was found in download.php, where a missing default option value causes all permission checks to be skipped. The researcher later discovered the view_file() finding overlaps with CVE-2026-10737, filed weeks earlier. The write-up covers the full methodology, Docker-based isolated test environment setup, proof-of-concept validation, and honest reflection on independently rediscovering an already-reported bug.

BeyondTrust warns of critical flaws in remote access software

BeyondTrust has disclosed two critical vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in its Remote Support (RS) and Privileged Remote Access (PRA) software, both affecting versions 25.3.2 and earlier. The flaws allow unauthenticated remote attackers to bypass authentication and gain unauthorized access under specific configurations. Two additional high-severity issues (CVE-2026-40140 and CVE-2026-40141) enabling denial-of-service and unauthorized data access were also patched. Cloud customers were automatically patched on April 21, 2026; self-hosted customers must apply the April security rollup or upgrade to RS/PRA 25.3.3 or above. BeyondTrust has a history of exploited vulnerabilities, including a prior RCE flaw used in ransomware attacks and zero-days leveraged by the Chinese state-backed Silk Typhoon group to breach the U.S. Treasury Department.