Fast forward to July 10, 2026: ShareFile customers got an email telling them to physically shut down the Windows servers running their Storage Zone Controllers, immediately, because Progress had identified a “credible external security threat.” No CVE. No patch. No real explanation beyond “trust us, unplug it” — an email that leaked to Reddit’s r/sysadmin before Progress said a public word about it.

This isn’t even ShareFile’s first rodeo this year. Back in March, Progress quietly patched a pre-auth remote code execution chain in those same Storage Zone Controllers — CVE-2026-2699 and CVE-2026-2701, a CVSS 9.8 authentication bypass chained to a 9.1 RCE, found by watchTowr Labs. The bug was almost insultingly simple: one bad boolean in a .NET redirect kept an admin panel rendering after it should have booted the visitor out, and from there an attacker could smuggle a webshell into the webroot disguised as a legitimate file upload — no login required. watchTowr counted roughly 30,000 of these boxes exposed directly to the public internet.

So: buy a second file-transfer vendor to escape the reputational shadow of the first one’s catastrophic breach, and four months after patching one critical flaw in it, send customers a second “please turn off your file server, we won’t say why” email in the same year. If Progress Software were a stock, you’d short it on symbolism alone.

To be fair, Progress is handling this one better than MOVEit — disabling access and shutting things down before confirming any actual compromise, rather than after. That’s the right instinct. But if you’re an admin who’s now had two “kill your file server” emails from the same vendor in twelve months, the conversation stops being “patch and monitor” and starts being “why does this vendor still hold our clients’ contracts and payroll files.”

The practical takeaway for anyone moving sensitive files through third-party platforms, SaaS or on-prem, isn’t “panic-switch vendors.” It’s that your own credential hygiene is the one layer you actually control when the vendor’s isn’t holding. If admin logins, client portals, or shared drives are sitting behind reused or weak passwords, a vendor’s bad week becomes your bad week too.

Sources: BleepingComputer, The Hacker News, Tech Times, watchTowr Labs, TechCrunch, Techzine

There’s a very specific flavor of dumb in cybersecurity right now, and it belongs to your AI coding assistant. Researchers from Tel Aviv University, Technion, and Intuit just published an attack called “HalluSquatting,” and the mechanism is almost insultingly simple: your coding agent hallucinates a package or repo name that doesn’t exist, and an attacker who saw that coming has already registered it — stuffed with malware.

Here’s how it plays out. Ask Cursor, GitHub Copilot, Windsurf, Cline, Gemini CLI, or OpenClaw to clone a repo or install a “skill,” and these tools will sometimes confidently invent a name that sounds plausible but was never real — the same species of confabulation as an AI citing a court case that doesn’t exist. Normally that’s just an annoying wrong answer. But an attacker who’s been probing the same models can predict which fake names they’re likely to dream up, register those names for real on GitHub or npm ahead of time, and load them with a payload. When your assistant hallucinates the name and pulls it down through its own terminal access, it doesn’t just suggest bad code — it executes the attacker’s commands directly, no click required from you.

Traditional botnets spread through weak passwords and unpatched boxes. This one spreads through your coding assistant’s imagination.

The numbers are the part that should actually worry you: the researchers measured hallucination rates up to 85% in repo-cloning tasks and up to 100% in certain skill-installation scenarios. That’s not an edge case — that’s the median outcome for entire categories of prompts. And because the exploit rides in through the model’s own hallucination rather than a phishing link or malicious attachment, it slides past every defense built for how humans get owned, not how AI agents do.

The uncomfortable subtext is that this isn’t a bug you patch — it’s the tradeoff of giving an LLM a terminal and telling it to be fast and helpful. Every “agentic coding” pitch of the last two years has been “let it just do the thing,” and this is what “just do the thing” looks like when the thing it does is invent a URL and then trust it.

None of this means throw your Cursor subscription in the bin. It means the same discipline that used to apply to random npm installs off Stack Overflow now applies to whatever your AI just typed into a terminal on your behalf — check what actually got pulled down before you run it, and put something between the agent and blind execution that actually inspects the package instead of trusting the vibes.

Good week to actually read what your AI just installed.

Sources:แหล่งข้อมูล: SecurityWeek, The Hacker News, Decrypt, SC Media

Ubiquiti’s UniFi lineup built its entire reputation on one promise: enterprise-grade networking gear that a single IT person (or a broadcast engineer moonlighting as network admin) can manage from a slick app, from anywhere, without a six-figure Cisco support contract. That promise is also, this week, the reason roughly 100,000 UniFi devices are sitting on the open internet with a target on their backs.

On July 8, Ubiquiti shipped Security Advisory Bulletin 066, patching seven critical flaws spread across UniFi Connect, Talk, Access, Protect, and OS. The headline item, CVE-2026-50746, scores a flawless 10.0 on the CVSS scale — the vulnerability equivalent of a perfect judges’ score, except the routine is “unauthenticated attacker sends one crafted request and gets arbitrary command execution on your building’s access control and lighting controller.” No login required, no user interaction. Six more flaws in the same bulletin sit in the 9.0–9.9 range, touching UniFi Talk’s phone system, UniFi Access’s door controllers, and UniFi Protect’s video feeds via an SSRF chain.

Point the controller at the world, manage it from your phone, never think about it again — until someone else does the thinking for you.

The kicker: threat intel firm Censys puts roughly 100,000 UniFi OS endpoints reachable straight from the public internet right now — which is precisely the deployment pattern UniFi’s whole pitch encourages. Ubiquiti says there’s no evidence these seven are being actively exploited yet, but a different trio of UniFi OS bugs was already flagged by CISA as weaponized in real-world attacks just last month. And Ubiquiti gear has history here: Russian state-sponsored hackers ran the MooBot botnet off compromised Ubiquiti EdgeOS routers for years before a 2024 law enforcement takedown finally killed it.

None of this makes UniFi bad gear. It makes it exactly what it’s always been: brilliant hardware wrapped in a management philosophy that assumes the internet is friendlier than it is. If you’re running UniFi Connect, Access, Protect, or Talk — and if you’ve got a studio, small office, or rental property with a Ubiquiti controller in a closet somewhere, you probably are — patch to the fixed builds today (Connect 3.4.20, Talk 5.2.2, Access 4.2.29, Protect 7.1.83, OS 5.1.19) and then ask the harder question: why does that controller have a public IP at all?

For most small deployments, the honest answer is: it doesn’t need one. The controller should sit behind a private, authenticated access layer that only your team can reach — not the entire internet plus whoever’s scanning Shodan and Censys this week.

Sources:แหล่งข้อมูล: The Hacker News, Ubiquiti Security Advisory Bulletin 066, Tech Times, BleepingComputer

One day before her 16th birthday, a soft-spoken teenager from Phuket, Thailand walked onto the America’s Got Talent stage looking every bit as nervous as any first-time contestant. Ninety seconds later, she was growling out The Cranberries’ “Zombie” with an electric guitar slung over her shoulder, and the room had completely flipped.

Nene Royal’s audition, which aired July 7 as part of AGT’s 21st season, has since become one of the most shared clips of the season — and for good reason. It’s a study in contrast: a quiet kid with an oversized dream, and a performer who commands a stage like she’s done it a thousand times.

The setup. Royal told the judging panel she’d been playing guitar since age seven and that her “biggest dream is that I really want to be a superstar on tour.” It was, by her own admission, the biggest stage she’d ever played. Her father stood at the side of the stage for support as she readied her guitar — a small, human detail that made the transformation that followed land even harder.

The performance. Rather than reach for a pop ballad or a run of vocal acrobatics — the safe choices most 16-year-old contestants make — Royal went for something riskier: a gritty, fully rocked-up cover of The Cranberries’ 1994 alt-rock landmark “Zombie.” She opened with a roaring guitar slide and nimble fretwork, then unleashed a guttural growl before pulling back into the song’s more melodic core, channeling Dolores O’Riordan’s full range — tender one moment, ferocious the next. By the final chorus she had the crowd, and several judges, singing along.

All four judges voted yes.

“That was spectacular. You have a really good chance to do very good in this competition.” — Sofía Vergara

“You are such a surprise with the energy and the rock and roll. You are a rock star, young lady. You really are.” — Howie Mandel

“You’ve got really good vocal control and you can kill it on the guitar. You’re like a match made in heaven. You’re brilliant.” — Mel B

“The tone of your voice is like really authentic. Even the fact that it was all a bit messy made the audition for me really good.” — Simon Cowell

After the four yeses, Royal reverted right back to her shy, nervous-smile self as she exited the stage — the same contrast that opened the audition, played in reverse.

Who is Nene Royal? She’s largely self-taught, having picked up guitar by ear watching online videos. Her competitive résumé already includes a second-place finish in Thailand’s Overdrive Guitar Contest (The Guitar Battle) in 2023 and an Outstanding Player award at the King Power Band Competition in September 2025. She’s also a Featured Artist with Enya Music, plays regular weekend shows in Phuket, and is working on material for a debut EP. Her online following has already passed 3 million across platforms.

Her audition also landed at a fitting moment for the song itself: The Cranberries recently announced their first-ever live album, Live at London Astoria II, 1994, arriving August 28 — a reminder that “Zombie” is still finding new audiences, three decades and one AGT stage later.

Sources: Loudwire, Billboard, MEAWW, AGT audition clip

At 4:30am yesterday, somewhere in a data centre on Australia’s east coast, a clock drifted. Not by much — these things never are. But it was enough to knock Telstra’s network sideways for the third major outage in twelve months, and by the time the country woke up, Victoria’s regional trains had stopped, Canberra’s MyWay+ ticketing system was dark, 378 traffic lights in South Australia were frozen mid-cycle, CommBank was telling shopkeepers to switch their EFTPOS terminals over to Optus, and — this is the part that actually matters — people trying to call Triple Zero couldn’t get through.

Telstra says the fault was in “time synchronisation mechanisms across several nodes,” which is corporate-speak for: the network’s internal clocks stopped agreeing with each other, and everything downstream that assumes they do fell over. If that sentence means something to you in your gut, you’ve probably spent a career staring at genlock or NTP servers wondering why the whole chain just went to black. Turns out national telco infrastructure has the same Achilles’ heel as a studio truck: sync drifts, and suddenly nothing talks to anything.

The kicker landed overnight. Telstra thought it had this fixed by yesterday evening. Instead, a secondary fault surfaced, again hitting Triple Zero calls — Telstra says it’s cut the error rate by roughly 90% but it’s not zero, and welfare checks are underway for customers whose emergency calls silently failed. Over 100,000 customers are potentially affected by the secondary issue alone.

This isn’t a one-off. Optus had two national outages last year — the September one is linked to two deaths, from people who couldn’t reach emergency services. Vodafone went down nationally in June. Telstra’s now had two failures in two days on top of that history.

“Telcos are the least trusted industry in our country as we stand today, and days like today demonstrate why Australians feel that way. It will be up to Telstra to make things right.” — Federal Communications Minister Anika Wells

Consumer group ACCAN called it “the latest in a spate of reliability flashpoints across the Australian telco sector.” The Communications Workers Union blamed Telstra’s own staffing cuts. Take your pick of villains — the pattern is the actual story now, not any single outage.

Here’s the real takeaway, and it’s not “boycott Telstra” — every Australian carrier shares towers, backhaul, and apparently a taste for timekeeping bugs. A second SIM from a different retail brand doesn’t buy you real redundancy if it’s still riding the same physical network underneath. Actual redundancy is a path that doesn’t touch any terrestrial network at all — a satellite communicator, something like a Garmin inReach or a Zoleo, that talks straight to a constellation instead of a cell tower, for the mornings when the entire ground-based system — not just your provider — has a bad day.

Sources:แหล่งข้อมูล: Telstra Exchange, WhistleOut, Telecompaper, Canberra Times

There’s a special kind of schadenfreude reserved for watching a security consultancy get owned by Security 101. This week it was Accenture’s turn.

A threat actor going by “888” — a handle with previous, mostly unimpressive form against the company — popped up on the cybercrime forum PwnForums claiming to have lifted “just over 35gb” of Accenture’s source code, plus a grab-bag of the stuff that should never leave a vault: RSA keys, SSH keys, Azure personal access tokens, and Azure Storage access keys. As proof, they posted a screenshot showing exfiltration from a private Azure DevOps repo tied to an accenture.com production URL.

Accenture’s response was the corporate equivalent of stepping over a puddle without acknowledging it’s raining: “aware of this isolated matter,” source “remediated,” no impact to operations, no confirmation of what was actually taken.

Governments and boardrooms spend fortunes on firms whose whole pitch is “we’ll audit your posture.” Turns out the audit doesn’t always start at home.

Here’s the part that should needle anyone who’s run a CI/CD pipeline: none of the alleged haul is exotic. It’s not a zero-day, not some nation-state supply-chain masterstroke. If the claims hold up, it’s the oldest story in DevOps — long-lived tokens and keys sitting in a repo where a compromised credential or a leaked config file was enough to walk out the door with the crown jewels. Accenture’s entire commercial pitch to clients is “we’ll help you not do this.” The gap between the brochure and the breach report is where the comedy lives.

For anyone running production systems — including a one-person shop wiring together a Python/ffmpeg pipeline with API keys scattered across a CSV-driven batch job — the actual lesson isn’t “don’t get hacked, lol.” It’s that access tokens, SSH keys and API secrets need to live somewhere that isn’t a config file or a Slack DM, with rotation and audit trails, not vibes.

Sources:แหล่งข้อมูล: Help Net Security, Bleeping Computer, Cybernews, GBHackers

Somewhere in a data center, a piece of software called Squid — the humble proxy server that’s been quietly routing web traffic since the Clinton administration — has been leaking people’s passwords in plain text. For twenty-nine years. Nobody noticed.

It took an AI to catch it.

The bug, now cheekily nicknamed “Squidbleed” (CVE-2026-47729, a nod to the infamous Heartbleed), is a classic heap over-read: Squid’s code checks for whitespace in a chunk of text without first checking whether it’s run off the end of the buffer. When it does, it reads whatever happens to be sitting in adjacent memory — which, on a busy shared proxy, might be a stranger’s login credentials from the request before yours. Confidentiality-only, no crash, no dramatic hack. Just twenty-nine years of one user occasionally getting handed a taste of somebody else’s session.

The part that stings: this is the kind of bug security researchers are trained to look for. Buffer boundary checks are Auditing 101. It sat in open-source code, readable by anyone, for nearly three decades. What finally caught it wasn’t a human at all — it was Anthropic’s Claude Mythos, sniffing around old C code the way it’s apparently started doing to FFmpeg and other creaky infrastructure projects, and flagging the exact strchr() call that everyone else’s eyes had slid past since 1997.

Governments spent the last few years worrying about frontier AI models being restricted for “national security risk.” Turns out one of those models’ actual day job is finding the vulnerabilities a small army of human pentesters missed for three decades.

The fix, for the record, is unglamorous: a null-terminator check, merged back in April. If you’re running Squid anywhere in your stack, patch it.

The bigger takeaway for the rest of us: this bug specifically leaked credentials — usernames, passwords, API keys — sitting in cleartext HTTP headers. The one thing standing between “your password briefly existed in someone else’s memory buffer” and “your password is now useless to whoever grabbed it” is whether you were reusing that password anywhere else, or whether it was sitting in a proper vault instead of your browser’s autofill.

Sources:แหล่งข้อมูล: The Hacker News, The Register, CyberSecurityNews