The Same Bug Was True and False in the Same Week
Big Picture
Most weeks the news is a list of bugs. This week the story was the machinery behind the list. Advisory databases hit record volume and slowed down, NIST openly stopped scoring most CVEs, the KEV catalog shed entries that should not have been there, and a benchmark showed AI scanners disagreeing with themselves. The feeds that teams triage from are getting noisier at the exact moment everyone leans on them harder.
TL;DR
The Vulnerability Pipeline Broke Its Own Record and Still Fell Behind
GitHub's Advisory Database published 1,560 reviewed advisories in May, five times its normal monthly output and the highest in its history. It still could not keep up. Private vulnerability reports climbed from roughly 550 a week in January to more than 3,000 a week by May, repository advisories went from 650 to over 5,000 a week, and GitHub's own CVE requests hit nearly 4,000 in May alone, close to ten times the prior year. Review times stretched from days to weeks, which means longer exposure windows are now built into the disclosure process itself.
NIST made the strain official. On April 15 it rebuilt NVD operations around triage, enriching only CVEs that land in CISA's KEV catalog or affect federal and critical software, and tagging everything else "Lowest Priority, not scheduled for immediate enrichment." CVE submissions rose 263% between 2020 and 2025, and the agency conceded the backlog cannot be cleared at that volume. The irony is that the whole system is now leaning harder on KEV at the moment KEV's own accuracy is in question. Vulnerability researcher Brian Martin documented KEV entries CISA silently removed: one CVE a researcher proved was fabricated, one added because of a typo in the identifier, and one Microsoft confirmed was never exploited after the NHS and several vendors had already published alerts. Snyk argued the same week for pulling from multiple vulnerability sources rather than trusting any single database.
Takeaways
Teams that prioritize straight off a single feed are building on ground that is both slower and less accurate than it was a year ago. With the NVD no longer scoring most CVEs, a KEV listing or vendor advisory now carries weight the database entry used to.
AI Found the Bug on Tuesday and Missed It on Thursday
Snyk ran 300 security scans across ten JavaScript projects, five identical repetitions per configuration, to test whether LLM code review is repeatable. When the model flagged a bug that matched a known reference finding, it was stable: 84.8% of those showed up in all five runs. The extra findings told a different story. Nearly half, 49.7%, appeared in only one run out of five. A developer could scan the same code twice and get materially different reports.
Two more results cut against the "point an LLM at your code" pitch. The best configuration scored 75.4% on the F1 measure, still 24.6 points below deterministic static analysis on the same code. And spending more made it worse: Claude Opus 4.7 Max cost 5.7 times more than a mid-tier config and scored lower. A separate write-up in tl;dr sec pointed the same direction from the offensive side, where a purpose-built testing harness found four times more real bugs than a raw frontier model on apps with no public write-ups. The scaffolding around the model, not the model's raw size, did the work.
Pixee co-founder Arshan Dabirsiaghi made the same argument this week, using a case where a bare prompt classified one insecure-randomness finding differently from run to run. His line: "a prompt can make a model sound like your AppSec team, but the harness is what makes it behave like one."
Takeaways
The instability was all in the findings outside the reference set, so an LLM gate can pass or fail the same commit depending on the run. If you wire one in, pin and log the model version and treat its novel findings as leads to chase, not merge-blockers.
The Number on the Dashboard Is Not the Risk
GitHub's security team published how it drove secret-scanning alerts to zero, and the useful part is the math. The initial scan surfaced more than 20,000 secrets across 15,000 repositories. But 18,000 of them sat in just five repositories and were inactive: test fixtures and fake-but-valid credentials. Only about 2,000 needed real work. The headline count was off by an order of magnitude from the actual risk, and separating the two took nine months.
Trail of Bits made a related point from the testing side while bringing mutation testing to a new language. Test coverage, the team writes, is the most reassuring lie in development: a green 100% coverage report tells you the test runner walked the code, not that any test would fail if the code broke. Both stories land on the same discomfort. A dashboard number, whether it is open alerts or coverage percentage, can look like safety while measuring something else entirely. For context on scale, GitGuardian counted 28.65 million secrets leaked on public GitHub in 2025, up 34% year over year, with AI-assisted commits leaking at roughly twice the base rate.
Takeaways
Ninety percent of GitHub's 20,000 "secrets" sat in five repositories and were inert. A total without its distribution tells you almost nothing, so the first question about any alert count is where it concentrates, not how big it is.
Three Enterprise Products, Days From Disclosure to Attack
While the meta-story played out, the ordinary one kept going. Adobe's ColdFusion cluster included CVE-2026-48282, a CVSS 10.0 path-traversal-to-RCE flaw that needs no authentication. Exploitation started within minutes of watchTowr publishing its teardown of the bulletin, and CISA added the CVE to KEV on July 7 with a July 10 federal patch deadline. BeyondTrust patched a CVSS 9.2 authentication bypass in its remote-access software, and threat actors were probing a Gitea Docker flaw just 13 days after disclosure.
The common thread is timing. All three sit at the edge of enterprise networks, and all three drew attacker attention inside two weeks of going public. The ColdFusion case is sharper still: the exploitation clock started the moment a researcher published, not when the patch shipped. That is faster than many organizations' routine patch cycles, which is the practical reason the prioritization problem in the first deep dive matters. When the window is this short, guessing wrong about what to patch first has a cost.
That July 10 deadline is not a one-off. CISA's BOD 26-04, issued June 10, now gives federal agencies as little as three days to remediate the highest-risk KEV vulnerabilities, and Pixee's Surag Patel notes the same clock applies to internal systems, not just internet-facing ones.
Takeaways
For ColdFusion the exploitation started when watchTowr published its analysis, not when Adobe shipped the patch, so a public teardown is now its own exposure event. Patch BeyondTrust, ColdFusion, and Gitea ahead of the routine cycle this week.
Vulnerabilities in the Wild
CVE-2026-48282, Adobe ColdFusion path traversal to RCE
Path traversal to unauthenticated remote code execution via RDS. Exploitation started within minutes of watchTowr's public teardown; CISA added it to the KEV catalog on July 7 with a July 10 federal patch deadline. CVSS 10.0 (Critical); actively exploited in the wild. Source
CVE-2026-20896, Gitea Docker image authentication bypass
The Docker image trusts the X-WEBAUTH-USER header from any source IP, letting an unauthenticated internet client escalate to any account. Threat actors were observed probing it 13 days after disclosure. CVSS 9.8 (Critical); probing observed in the wild. Source
CVE-2024-42009, Roundcube webmail credential theft
Exploited by a suspected China-aligned cluster against physics and engineering departments at US and Canadian universities to siphon credentials. CVSS 9.3 (Critical); actively exploited in the wild. Source
CVE-2026-40138, BeyondTrust Remote Support / PRA authentication bypass
A pre-authentication authentication bypass in the remote-access products; unauthenticated attackers could take control of affected devices. Patched. CVSS 9.2 (Critical); no confirmed in-wild exploitation. Source
CVE-2026-8451, Citrix NetScaler pre-auth memory overread (CitrixBleed class)
A pre-authentication memory overread in the recurring CitrixBleed vulnerability class, reported by watchTowr in March and disclosed now while under attack. Memory-disclosure; under active attack. Source
CVE-2026-53359, Linux KVM use-after-free (Januscape)
A 16-year-old use-after-free in the shadow MMU that KVM shares across Intel and AMD; a guest VM can corrupt host kernel state. The public proof-of-concept panics the host. No CVSS assigned; public PoC, no in-wild exploitation reported. Source
CVE-2025-3248, Langflow remote code execution
RCE in internet-facing Langflow instances; the initial-access vector Sysdig's autonomous JadePuffer ransomware agent used to enter its victim. Critical; exploited as JadePuffer's entry point. Source
Linux "Bad Epoll" local root
A local root-access vulnerability with a publicly released proof-of-concept exploit. Local privilege escalation; PoC released. Source
Additional disclosed PoCs (Exploit-DB)
Lower-severity web-app exploits published this week: Joomla Extension 4.1.4 PHP object injection, Pulpy 0.1.1-Beta filesystem sandbox bypass, KNX visualisering broken access control, WordPress WPZOOM Portfolio 1.4.21 reflected XSS, and KeepInMind 0.8.4.2 stored XSS. Proof-of-concept exploits; severity varies. Joomla · Pulpy · KNX · WPZOOM · KeepInMind
Curated Reading List
Thought-Provoking
• The Coming Divide: AI-Native or Left Behind (Daniel Miessler) Why it's worth your time: a sharp framing of the widening gap between people who have woven AI through their work and those who haven't. Useful for how you talk to your board about AI adoption, not just how you defend against it.
• Progress Kemp LoadMaster: uninitialized heap to pre-auth RCE (watchTowr Labs) Why it's worth your time: a one-line escape_quotes() slip becomes pre-auth RCE on an edge load balancer, the kind of teardown worth handing a junior engineer.
• tl;dr sec #335 (Clint Gibler) Why it's worth your time: prompt injection as role confusion, the new MCP spec, and PHP ecosystem security, with a working practitioner's commentary rather than a headline skim.
• A VulnOps Field Guide for Agentic Code (Nick Shevelyov, vCSO.ai; former CSO, Silicon Valley Bank) Why it's worth your time: argues that teams shipping AI-written code cannot let the builders grade their own security work, capped by the line "you have not solved the problem, you have just perfectly demonstrated it."
Current Events
• This AI agent autonomously hacked a network and demanded a ransom (CSO Online) Why it's worth your time: Sysdig's JadePuffer is the first documented fully autonomous LLM ransomware chain, worth understanding on the facts before the vendor framing arrives.
• Public GitHub Issue Could Trick Agentic Workflows Into Leaking Private Repo Data (The Hacker News) Why it's worth your time: a concrete, reproducible agentic-workflow supply-chain leak. If you run GitHub agentic workflows, this is a same-day check.
