Starting July 10, 2026, employees at Alibaba were told to stop using Anthropic’s Claude Code and switch to Qoder, the company’s own internal coding tool. On its own, a company banning one vendor’s software isn’t unusual. What makes this case worth understanding is why: it sits at the center of two separate, serious accusations running … Read more
In early July 2026, Alibaba told its employees to stop using Anthropic’s Claude Code and switch to an internal tool instead. The dispute behind that decision involves two separate accusations — one about hidden tracking code, and one about something called a “distillation attack.” The second term is the one most readers have never heard, … Read more
On July 1, 2026, Sysdig’s Threat Research Team published findings on an extortion campaign it named JADEPUFFER — describing it as an “agentic ransomware” operation in which, according to Sysdig’s analysis, an autonomous AI agent carried out the entire attack chain, from initial compromise to database encryption, with minimal human direction. BleepingComputer covered the findings on July … Read more
Scroll through security news for even a week and you’ll see the same three letters again and again: RCE. It’s attached to some of the most severe vulnerabilities ever disclosed — critical flaws in web servers, VPN appliances, AI tools, and enterprise software that get patched immediately because leaving them open is treated as an … Read more
On July 3, 2026, a Linux kernel vulnerability nicknamed “Bad Epoll” became public: CVE-2026-46242, a use-after-free bug in the kernel’s eventpoll subsystem — the same epoll mechanism that powers the event loops behind Redis, Nginx, and Node.js, as explained in our companion guide, What Is epoll?. The bug is a local privilege escalation vulnerability, rated CVSS 3.1 7.8 (High), meaning it … Read more
Introduction When PTC’s Windchill software was hit by a CVSS 9.3 critical vulnerability in June 2026 — one actively exploited to plant webshells on manufacturing and engineering systems — the root cause was not a novel attack technique. It was insecure deserialization. The same class of vulnerability that hit Apache Struts, Oracle WebLogic, and Java-based … Read more
Introduction On June 23, 2026, researchers disclosed CVE-2026-55200 — a CVSS 9.2 remote code execution vulnerability in libssh2, the SSH library embedded in curl, PHP, Python, Ruby, and hundreds of other applications that handle SSH connections in production software. The vulnerability requires no authentication, no privileges, and no user interaction. An attacker who can cause … Read more
Introduction On June 23, 2026, security researchers at Calif Security Research published their analysis of CVE-2026-47729 — a heap buffer overread vulnerability in Squid Proxy that had been present in the codebase since a commit in January 1997. They named it Squidbleed. The vulnerability is real, the affected deployment surface is large, and the discovery … Read more
Introduction For most of the past two decades, the security industry operated on an implicit assumption: defenders had time. A vulnerability would be discovered, a CVE would be published, a patch would ship, and enterprises would deploy it — imperfectly, slowly, but eventually. The attacker’s window existed, but it was measured in weeks or months. … Read more