Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

A newly disclosed vulnerability in Active Directory Certificate Services (AD CS) shows just how dangerous certificate-based authentication can become when trust breaks down. Certighost (CVE-2026-54121) allows a low-privileged domain user, under specific conditions, to obtain a certificate for a Domain Controller, authenticate using PKINIT, and perform DCSync to retrieve the krbtgt secret, potentially leading to complete Active Directory compromise. Microsoft patched the flaw in its July 2026 security updates, but a public proof-of-concept is now available

We are pleased to announce the release of Vulnerability-Lookup 5.5.0!

This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.

What's New

Role-Based Access Control

The boolean admin flags of previous versions are replaced by a full RBAC mechanism: roles and permissions in a unified data model, role assignments with global or per-resource scope, creation policies that automatically grant the creator role when a resource is created, and a configurable default role for self-registration. Permission checks are enforced across the views, the templates and the user, system, KEV, CNA, bundle and sightings APIs. Contributed by @NMD03 in #497.

Each role is a set of fine-grained permissions (bundle:create, cna_publication:publish, kev:modify, ...) that can be edited from the admin interface:

The release also ships the hardening and migration work that followed the initial review: three security gaps around account confirmation and admin lockout were closed, permission checks keep working on a closed session, the creator role assignment is atomic with resource creation, owner role assignments are backfilled for pre-existing resources, the seeding is non-destructive and runs on update, role assignments are no longer bulk-loaded on every request, and the scoped-assignment tables are paginated. A permission-matrix test suite locks the behavior in, and the migration path for existing instances is documented — existing users and their resources are migrated automatically.

AI-suggested MITRE ATT&CK techniques

The vulnerability details page gains a new ATT&CK tab with MITRE ATT&CK techniques suggested by our new AI model, trained with VulnTrain and published as CIRCL/vulnerability-attack-technique-classification-roberta-base on Hugging Face.

A new POST /api/vlai/attack-techniques endpoint proxies the ML-Gateway /classify/attack-techniques service with strict validation of the gateway response. The suggestions are lazy-loaded from the vulnerability description and clearly labelled as AI-generated, with a link to the model card and the exact model revision; gateway, model or network errors are shown to the user and allow a retry.

The approach behind this classifier is described in our paper on mapping CVEs to MITRE ATT&CK techniques.

EUVD ID allocation and creation pipeline

The EUVD support keeps progressing: a per-year EUVD ID allocator with a one-EUVD-per-CVE guarantee, an EnisaID creation pipeline that mints EUVD IDs for published CVEs, bidirectional vendor/product/advisory relationship sets, EUVD search with sort indexes and CVSS/EPSS/date filtering, a source and assigner registry with an assigner filter index, and advisory, vendor/product and CSAF advisory links wired into EUVD creation. Contributed by @archakisn in #475, #476, #479, #480, #488, #489, #491, #498, #499, #500, #501, #502, #503, #509 and #511.

Feeder supervision and CSAF resilience

feeders_manager now watches the feeders and respawns the dead ones, and CSAF sources are suspended with exponential backoff after fully failed cycles (#508, closing #459 and #463). CSAF import memory is bounded — untouched files are skipped and batches flushed on size — while unparseable files stay retryable, the watcher survives launch failures and transient cache errors, and the runtime script_name is aligned with modules.cfg so --stop actually stops the feeders.

More VEX enrichment sources and a VEX records UI

New SUSE CSAF VEX (#483) and Microsoft MSRC CSAF VEX (#469) metadata feeders join the Red Hat one introduced in 5.4.0. A new VEX records browse view allows pivoting from VEX documents to the corresponding CVEs, with index-level paging and input validation (#473).

New feeders: Rocky Linux, Ubuntu and TuxCare

New sources join the platform: Rocky Linux OSV (#482), Ubuntu USN (OSV) and TuxCare CSAF (#487), wired into the web interface and the README.

Profile photo and improved public profile

Users can now upload a profile photo, with Gravatar as fallback (#496). The public profile page was improved: stat tiles and profile links point to the author-filtered public pages, and the header stacks on small screens.

Changes

• Admin — Admin interface redesign: the navbar Admin dropdown is replaced by a full-height sidebar on the admin pages, grouped by mission with an RBAC sub-navigation and a user menu at the bottom. The Maintenance card moved to a dedicated page, the user list can be filtered by role (with role user counts linking to it), breadcrumbs were dropped and the page headings harmonized.

• CWE — Modernized the CWE views: singular /cwe endpoint (with 301 redirects from the legacy paths), vex-style browse list and harmonized detail page; /api/cwe/ can now filter out Discouraged and Prohibited CWEs.
• Sync — Sturdier synchronization of large backfills: pages are streamed with bounded transactions, transient page failures are retried and last_sync is kept on incomplete runs, JSON decode errors are caught per page, and the sightings page size was lowered (#492, #494, #495).
• Feeders — The Red Hat VEX feeder uses the canonical CSAF metadata URL, and csaf_tibco is disabled by default (the endpoint returns 403).
• Documentation — Listed the recently merged feeders in the README and fixed the source gaps.
• Dependencies — Updated Python dependencies (including cryptography 48.0.1 via gcve 0.12.1) and bumped the pinned CodeQL actions.

Fixes

• Feeders — The cvelistv5 vendor/product indexes converge on the shared CNA+ADP helper, and containers.adp is iterated as a list so the adp:shortName:* indexes are actually populated.
• Feeders — The VARIoT feeder paginates its imports itself with small pages, instead of tripping the API's failures on large limits.
• Feeders — The Rocky Linux OSV feeder walks all Apollo pages and dedups against the index (the Apollo API shifts records between pages), and the OSV git mirrors are synced with fetch + reset instead of pull.
• Sightings — Invalid CVE identifiers are rejected by the vulnerability id regex.
• Disclosure — Imported the names is_public_disclosure relies on and fixed test type errors.

Changelog

📂 For the full list of changes, check the GitHub release:
https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v5.5.0

🙏 A big thank you to all contributors and testers!

Feedback and Support

If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository:
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/
Your feedback is always appreciated!

Follow Us on Fediverse/Mastodon

You can follow us on Mastodon and get real-time information about security advisories:
https://social.circl.lu/@vulnerability_lookup/

Oracle has released its July 2026 Critical Patch Update (CPU), containing 1,449 security patches across numerous product families. The advisory includes fixes for vulnerabilities affecting Oracle Database, Fusion Middleware, E-Business Suite, Java, Communications, and many other products, with Oracle recommending that customers apply updates without delay.

Check Point recently disclosed CVE-2026-16232, an authentication bypass in the SmartConsole login process that can allow an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges under specific conditions.

This needs a description so here goes.

You do almost everything through a VPN, and you have an encrypted DNS server or your queries are hidden privately by wireguard or something.

Is anyone the least bit worried that some of us may be on a list for their own absence in the mainstream internet? Would it merit a knock at the door from the McFascists one day?

I'll be open, I'm on TOR right now. I don't personally trust any hole that could link my personal identity to leftist politics, but still the worry persists that I'll be asked a million questions in a white room about paying for internet traffic that is always obscured one day.

Maybe a few simple placeholders like a barely used Facebook account might cover some tracks, but I mean, if they looked, they'd still see tons of packets going to somesuch VPN company, or a TOR node and disappearing, which alone is suspicion enough from the Ai agents that may one day hunt us down like sheep by our online habits.

CVE-2026-50522 is a critical SharePoint deserialization vulnerability that is now being actively exploited. This article examines the vulnerability in depth, including the exploitation workflow, affected versions, machine-key theft for persistent access, patch analysis, indicators of compromise, and practical mitigation guidance for defenders.

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

A recent incident demonstrates how a vulnerability in a perimeter security appliance can become the first step in a much larger intrusion. This article examines the attack progression from PAN-OS GlobalProtect exploitation through credential theft, lateral movement, and eventual Qilin ransomware deployment, along with the published IoCs, attacker TTPs, and defensive recommendat

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

The latest OpenSSL disclosure, HollowByte, demonstrates how seemingly small flaws in protocol handling can translate into denial-of-service conditions through uncontrolled memory consumption. This article examines the vulnerability's technical root cause, affected releases, attack prerequisites, remediation, and what it means for administrators running Internet-facing TLS services

Adrian Mastronardi has released a book called Half a Second; it is a detailed look into the XZ backdoor attempt of 2024. The book is freely available under a (non-free) noncommercial, no-derivatives CC license.

Half a Second tells that story as one continuous narrative: the burned-out volunteer who maintained the code alone and was patiently, expertly manipulated into giving it up; the engineer whose half-second of curiosity caught the attack through a chain of luck and hard-won instinct; and the operator who built it, who has never been identified and, this book argues, may never be.

Since June, Tesla's algorithms have been sharing street-level telemetry about moving objects over a "broker" network, and using it to command a vehicle (to follow and/or avoid moving objects).

Tesla's implementation relies on a persistent bidirectional communication pipeline built upon a highly optimized WebSocket protocol layered over a customized MQTT (Message Queuing Telemetry Transport) broker architecture. When a vehicle running firmware 2026.20.6.1 engages Full Self-Driving, the localized Telemetry Gateway module inside the car begins publishing compressed Protocol Buffers (Protobuf) binaries at an ultra-high frequency of up to 10Hz (ten updates per second). These binaries contain exact spatial vector coordinates, current lateral and longitudinal acceleration matrices, target vector paths, and object classification hashes identified by the occupancy network.

Shark has not acknowledged the vulnerability let alone patched the exploit. If you have a Shark robot vacuum disconnect it from the internet until a patch is available.

I'm a little late with this news, but it's a good write-up.

The unread file was src/_probe/never_read_canary.txt, planted with a unique marker. Cloning the captured bundle recovered it verbatim along with the repo's full commit history, and the same test replicated on a second, unrelated repo.

cross-posted from: https://piefed.world/c/tech/p/1263199/nightmare-eclipse-just-dropped-legacyhive-a-new-windows-privilege-escalation-zero-day-po

Announcement.

The PoC reportedly uses a carefully timed path-switching trick to make Windows mount another user's Registry file, potentially an administrator's, under a standard "helper" account.

Nightmare-Eclipse claims it works across supported Windows desktop and server builds patched through July 2026.

Nightmare-Eclipse says a private version could load arbitrary Registry hives, but that broader version has not been published.

Interestingly, Nightmare-Eclipse previously told us that vulnerability names are inspired by random events in his life. "LegacyHive" appears to break from that convention.

Deja vu: Microsoft patched this broad ProfSvc trust-boundary failure in 2015 as CVE-2015-0004, which also loaded another user's hive. LegacyHive appears to use a new path-swap to revive that bug class.

As of writing: no CVE, no Microsoft advisory, no comment.

Text source: International Cyber Digest.