Keycloak disclosed and patched a high-severity privilege escalation flaw, CVE-2026-9795, in its Fine-Grained Admin Permissions v2 (FGAPv2) feature after researchers reported that a delegated administrator could bypass missing authorization checks in the admin REST API and add arbitrary realm roles to a client’s scope mapping. That weakness allowed limited administrators to inject elevated roles such as realm-admin into tokens later issued to users authenticating through the affected client, creating a path to downstream privilege escalation in deployments running Keycloak 26.2.0 and later with FGAPv2 enabled.

The issue was later listed as fixed in Keycloak release 26.6.4, alongside several other security bugs including CVE-2026-9099, CVE-2026-9083, CVE-2026-9086, CVE-2026-9705, CVE-2026-9799, CVE-2026-9800, and CVE-2026-11800. Red Hat also shipped security updates for its Keycloak 26.4.11 images and operator on OpenShift, addressing a broad set of vulnerabilities across the Admin REST API, Account REST API, OIDC dynamic client registration, UMA authorization, token handling, redirect validation, and scope processing, with impacts ranging from information disclosure and SSRF to account takeover, policy bypass, and denial of service.

U.S. prosecutors announced two significant ransomware case outcomes: Armenian national Karen Serobovich Vardanyan pleaded guilty to conspiracy and computer fraud for helping compromise U.S. organizations and deploy Ryuk ransomware, while Florida resident Angelo Martino was sentenced to 70 months for assisting the BlackCat/ALPHV gang. Court records say Vardanyan provided initial access to victim networks between November 2019 and April 2020, with victims including a Michigan company, a technology firm in Wilsonville, Oregon, and a Texas school. Prosecutors linked Vardanyan and his co-conspirators to roughly 1,610 bitcoin in ransom payments, valued at about $15 million at the time.

Vardanyan was arrested in Kyiv in April 2025, extradited to the United States in 2025, and now faces up to 15 years in prison, fines of $250,000 per charge, and more than $1.1 million in restitution; sentencing is scheduled for September 2026. In the separate BlackCat/ALPHV case, Martino was convicted for abusing his position as a ransomware negotiator to share confidential victim negotiation information with attackers, and his co-conspirators Ryan Goldberg and Kevin Martin had already received four-year prison terms. The cases underscore continued U.S. efforts to disrupt both ransomware operators and the support networks that enable extortion campaigns.

Debian has released Debian 13.6 as a point update focused on security and maintenance, alongside Debian 12.15 for the previous stable branch. Debian 13.6 bundles roughly 120 security updates and more than 120 bug fixes, with patches affecting the Linux kernel and widely deployed packages including Nginx, Redis, FFmpeg, Thunderbird, Chromium, PHP, Postfix, Samba, wireless-regdb, and Wireshark. The update is intended to bring existing installations current rather than introduce a new major version.

A notable change in Debian 13.6 is an updated shim-signed and fwupd 2.0.20 stack to support newer Microsoft UEFI Secure Boot certificate chains and updates to Secure Boot CA, KEK, and DBX databases after expiration issues with the default UEFI Secure Boot CA used on many PCs. Debian also reverted or removed the legacy geoip-database package because newer GeoLite data was found incompatible with Debian Free Software Guidelines and the older dataset had become outdated, pushing migration toward maintained alternatives such as GeoLite2.

CERT Polska disclosed four vulnerabilities in GNU gawk, tracked as CVE-2026-40467, CVE-2026-40468, CVE-2026-40469, and CVE-2026-40553. The issues were highlighted in a CERT Polska advisory and later amplified by security reporting, identifying the widely used pattern-scanning and text-processing utility as affected software.

Public reporting provides only limited detail so far, with no technical breakdown, exploitation evidence, or impact assessment included in the referenced notices. Organizations using GNU gawk should review the CERT Polska advisory, identify affected deployments, and prioritize vendor guidance or updates as more remediation details become available.

Researchers disclosed Ghostcommit, a proof-of-concept software supply-chain attack that hides prompt-injection instructions inside a PNG image referenced by an AGENTS.md file, allowing malicious pull requests to appear benign during review. In the demonstrated scenario, AI code reviewers such as Cursor Bugbot and CodeRabbit did not meaningfully inspect image content, so the pull request could be merged even though the real instructions were concealed in the image rather than visible text.

After merge, the attack is triggered when a developer later asks a coding agent to perform a routine task and the agent reads the hidden image instructions, accesses repository secrets such as the .env file, encodes the contents as integer tuples, and inserts them into source code in a way that can evade typical secret scanners. Researchers from the University of Missouri-Kansas City's ASSET Research Group said exploitation depended more on the coding harness than the underlying model, with Cursor and Antigravity leaking secrets across multiple models while Claude Code consistently refused; they reported the issue to vendors and built a multimodal GitHub review app that detected nearly all tested variants, including image-based attacks, with no false positives in their evaluation.

Proofpoint reported that attackers are increasingly abusing OAuth client ID spoofing against Microsoft Entra ID to enumerate accounts and validate credentials without registering a legitimate OAuth application. The activity relies on Resource Owner Password Credentials (ROPC) authentication requests that use spoofed or random clientid values, allowing attackers to distinguish invalid usernames, valid usernames with incorrect passwords, and in some cases valid username-password pairs based on Microsoft Entra AADSTS error responses.

Proofpoint said it observed at least two large-scale campaigns, UNKpyreq2323 and UNK_OutFlareAZ, using different infrastructure, user agents, and client ID generation patterns, indicating the technique is being adopted by multiple threat actors. Microsoft’s published Entra error code behavior helps explain how responses such as AADSTS700016 can leak authentication state, and defenders were urged to review Entra sign-in logs for blank or missing application names or IDs and to treat some apparent failed logins as possible signs of successful credential validation by an attacker.

Researchers identified a Windows DLL backdoor dubbed SolidPDFCreator and attributed it to the China-linked threat group Mustang Panda, describing the malware as a stage-1 backdoor used in a campaign targeting entities in India. The sample was tied to "Target India – Campaign 3" and documented as an early-access implant intended to establish an initial foothold on compromised systems.

Available reporting describes the malware as a DLL-based payload and provides core triage details including file type, size, hashes, compiler characteristics, and binary section information. The publication of these indicators gives defenders material to hunt for related activity and assess whether Mustang Panda infrastructure or tooling associated with SolidPDFCreator is present in their Windows environments.

The UK, France, the EU, and partner cyber agencies publicly attributed a broad cyber-espionage campaign to FSB Centre 16, linking the Russian intelligence unit to both the long-running Turla intrusion set and active exploitation of internet-facing routers and network devices. UK and allied authorities warned that the actor is scanning globally for poorly configured infrastructure, abusing default or weak SNMP credentials and known Cisco-related weaknesses such as Smart Install and web-management flaws to seize control of devices, with critical sectors including communications, defence, energy, financial services, government, and healthcare identified as high-risk targets.

French authorities said entities in France, including ministries and organizations in the diplomatic, defence, justice, and technology sectors, were targeted and compromised using Turla tradecraft that has been active since at least 2004. The coordinated disclosures were accompanied by formal attribution statements from France and the EU, while the UK said EU member states and London also attributed the December 2025 attack on Poland’s energy grid to FSB Centre 16 and announced sanctions against 24 individuals and entities tied to Russian destructive cyber and hybrid operations. Defenders were urged to harden network devices by adopting SNMPv3, disabling legacy SNMP versions, enforcing strong unique passwords, and restricting access to management interfaces.