SecurityCloudflare started recognizing bots by how they move the mouseCloudflare's new engine, Precursor, doesn't ask who you are at the door - it watches you through the whole session: keystroke rhythm, cursor movement, when the window had focus. The human hand draws arcs, because it has a wrist. Automation goes straight.SecurityFour Joomla extensions land on the actively exploited list in four daysCISA added Balbooa Forms and iCagenda to its catalog of vulnerabilities being exploited right now. Both allow unauthenticated file upload and code execution on the server. Three days earlier, two other Joomla extensions joined the same list - with the same hole.SecurityTen holes in curl: your passwords can travel to a stranger's server on a redirectUbuntu patched ten holes in curl at once - the tool that fetches something in every script, container and CI pipeline. The ugliest one sends saved passwords to a server that simply returned a redirect. Advisory-level note: it doesn't claim active exploitation.SecurityUbuntu patched a pile of holes in Apache - the kind of fix nobody notices until it's too lateUbuntu tightened up Apache with one patch that closes 12 holes at once. All three supported LTS versions are affected. There's one action: you update.SecurityA vulnerability in Adobe ColdFusion scored 10.0 is being actively exploitedCISA added CVE-2026-48282 to the Known Exploited Vulnerabilities catalog over evidence of active exploitation. NVD scores it 10.0 on CVSS - the maximum value. Federal agencies have until 10 July.SecuritySeven holes in FatFs threaten millions of embedded devices, and there's no full patchrunZero disclosed 7 vulnerabilities at once in the FatFs file system - embedded in drones, cameras, hardware wallets, and dozens of platforms. Only one has been patched. For the rest, there's no fix yet.SecurityA hole in the heart of Linux hands root to anyone, and AI had walked right past itCVE-2026-46242. Use-after-free in epoll that escalates an ordinary user to root - on desktops, servers, even Android. The irony: Anthropic's AI model Mythos found the neighboring bug in the same code. This exact one, it missed.SecurityFBI and Google pulled the plug on 2 million hijacked home devicesOn 2 July the FBI seized the domains of NetNut. Google tore down the backend. The network - one of the largest residential proxies - was secretly turning smart TVs and routers into cover for cybercriminals and spies.
83 stories