Google patched 12 Chrome vulnerabilities, including CVE-2026-85046 (CVSS 8.8), an actively exploited type confusion bug in the V8 JavaScript and WebAssembly engine fixed in Chrome 152.0.7977.82.
Cisco fixed CVE-2026-20212 (CVSS 9.8), a critical flaw in 10 Silicon One-based Nexus 9000 switches that lets an unauthenticated remote attacker run code as root. It also shipped an IOS XR hardening release bundling seven CVEs, two rated 9.8, with no workaround for any IOS XR version.
Wordfence recorded more than 440,000 exploit attempts against two critical WordPress plugin flaws, including CVE-2026-14894 (CVSS 9.8) in Super Forms, a missing file type validation that lets unauthenticated attackers upload arbitrary files, and a remote code execution flaw in Elementor Pro.
Thomson Reuters disclosed that an unauthorized party obtained files from C-Track, the court case management platform of its West Publishing unit, in March 2026. Courts in 11 U.S. states, the U.S. Virgin Islands and Ontario are affected; the activity was discovered on June 30 and some records may contain Social Security numbers and sealed data.
Pegasus spyware infected the iPhone of a Serbian student activist through an iMessage zero-click exploit.
Researchers detailed BraZetsu, a Python-based Windows malware framework that feeds an underground marketplace selling access to compromised hosts, turning infected systems into inventory for initial access brokers.
The Outsider phishing kit generated 700 new phishing pages after a Google-led disruption.
Plex urged users to update to Plex Media Server 1.43.3 and Plex Desktop 1.115.0, which fix multiple security flaws it has not yet described; CVE identifiers have been requested.
The G7 published a call to action urging governments to launch national strategies for the transition to post-quantum encryption.