Rosetta Intel

Generated automatically · 14 sources scanned · 13 items selected

Critical Vulnerabilities

Citrix NetScaler ADC / Gateway SAML memory overread — CVE-2026-8451, CVSS 8.8
Insufficient input validation in NetScaler's in-house XML parser at the /saml/login endpoint lets an attacker send a never-closing SAML AuthnRequest attribute and read past the buffer, leaking sensitive memory (the "CitrixBleed" pattern). A coordinated scanning campaign hit appliances configured as SAML IdPs within 24h of the advisory, with a confirmed exploitation payload observed. Affects 14.1 < 14.1-72.61 and 13.1 < 13.1-63.18 (plus FIPS builds); part of six flaws fixed in advisory CTX696604.
The Hacker News · SOCRadar · eSecurity Planet
WinRAR RAR5 recovery-volume heap overflow — CVE-2026-14191
A crafted set of two or more .rev recovery-volume files makes WinRAR / UnRAR write outside allocated memory → potential code execution. No confirmed in-the-wild exploitation yet, but WinRAR sits on hundreds of millions of machines and still has no auto-update — users must install 7.23 manually. Classic legacy-software risk.
Malwarebytes · Cyber News Centre

In-the-Wild Exploitation (CISA KEV)

Microsoft SharePoint Server RCE — CVE-2026-45659, CVSS 8.8
Deserialization of untrusted data; an authenticated attacker with Site Member permissions can execute code remotely. Added to KEV July 1; federal patch deadline is today, July 4, 2026. Attacks attributed to Storm-2603, which deploys Warlock ransomware via on-prem SharePoint. Patch shipped by Microsoft in May 2026.
The Hacker News · securityonline
Citrix NetScaler CVE-2026-8451 — active exploitation confirmed (see Critical above). Treat internet-facing SAML IdP appliances as a patch-now priority.
latesthackingnews

Vendor Advisories

Citrix— CTX696604 patches six NetScaler ADC / Gateway flaws (memory overread, file read, DoS). Upgrade to 14.1-72.61 / 13.1-63.18.
cybersecuritynews· CSA Singapore
Apple— early out-of-cycle iOS / macOS Tahoe / Safari updates fixing 30+ vulnerabilities, including four WebKit memory-corruption flaws found using AI tooling. Apple says it is deliberately shrinking the disclosure-to-patch window to beat AI-accelerated exploit development.
Malwarebytes
RARLAB— WinRAR 7.23 fixes CVE-2026-14191; manual update required.
Malwarebytes

Web Security Research

CitrixBleed-pattern deep dives— CVE-2026-8451 root cause traced to a hand-rolled XML parser that stops only on a null byte or >, so an unterminated SAML attribute walks past the buffer. A clean worked example of why bespoke parsers on trust boundaries keep producing memory-disclosure primitives.
SOCRadar· Lupovis
AI-assisted bug hunting goes mainstream— Apple's latest WebKit fixes were surfaced by AI tooling, a signal that fuzzing/triage augmented by models is now shipping real CVEs on both offense and defense.
Malwarebytes

AI Security

JADEPUFFER — first end-to-end AI-agent-run ransomware— An LLM-driven agent handled the entire attack: initial access, credential theft, lateral movement, then encrypting and wiping a production database. Entry point was CVE-2025-3248, a missing-authentication flaw in Langflow (open-source AI-app / agent builder). A milestone for autonomous offensive tooling.
The Hacker News
AI compresses the exploit window— Apple explicitly cites AI-accelerated exploit development as the reason it is patching faster; the disclosure-to-weaponization gap is now a board-level operational risk.
Cyber News Centre

Threat Intelligence

FortiBleed credential-theft campaign tied to INC & Lynx ransomware— Mass FortiGate credential theft linked directly to ransomware deployment for the first time. ~11,250 FortiGate portals scanned across 150+ countries, confirmed admin access on 409 targets, full chain completed on 354, resulting in at least 12 ransomware deployments and hundreds of encrypted endpoints. An operator tied to FortiBleed infrastructure was found working negotiation panels for both groups.
The Hacker News· BleepingComputer
Storm-2603 / Warlock via SharePoint— the actor behind CVE-2026-45659 exploitation has been deploying Warlock ransomware off on-prem SharePoint since mid-2025.
The Hacker News

Ransomware Today

RansomLook's API/RSS was unreachable this run (provenance gate + sandbox network blocked), so today's picture is drawn from public trackers rather than a precise 24h leak-site count. Qilin remains the most prolific group overall, followed by Akira and Play; SafePay's volume continues its steep 2025→2026 climb, and healthcare stays the most-targeted sector. The freshest hard link this cycle is the FortiBleed → INC/Lynx pipeline (≥12 confirmed deployments).
Full victim table

Bug Bounty

The Bug Bounty track now updates on its own daily schedule (deep-dive analysis + themed recent disclosures).
Open the Bug Bounty daily section

AI Frontier

OpenAI

Unveiled a custom "Jalapeño" inference chip(announced ~July 1), pushing further into in-house silicon ahead of its IPO. Dean Ball joins July 6 to lead a new "Strategic Futures" team focused on catastrophic risk, recursive self-improvement, and frontier-lab/government relations.

Anthropic

Launched Claude Sonnet 5, billed as its most agentic model yet — autonomous browser/terminal use at near-Opus-4.8 performance for significantly lower cost. Separately, the U.S. government lifted national-security restrictions on the Fable 5 and Mythos 5 models.

Google DeepMind / AI

Shipped two generative-media models: Nano Banana 2 Lite(fastest, most cost-efficient image generation) and Gemini Omni Flash.

Failed Sources (if any)

RansomLook API + RSS — unreachable this run (web_fetch provenance gate; sandbox network blocked). Ransomware section built from public trackers as fallback.
Chinese community sources (FreeBuf / 先知 / 安全客) — not individually fetched this run; no material selected.

Sources used: see intel/sources.yaml

Rosetta Daily · Jul 4, 2026