DEV Community: BeyondMachines

JetBrains Fixes Critical TeamCity Authentication Bypass Allowing Remote Code Execution

BeyondMachines — Tue, 28 Jul 2026 20:01:50 +0000

Summary

JetBrains patched a critical authentication bypass (CVE-2026-63077) in TeamCity On-Premises that allows unauthenticated remote code execution. The flaw affects all on-premises versions and could lead to a full takeover of CI/CD pipelines.

Take Action:

If you run TeamCity On-Premises, urgently update to version 2025.11.7 or 2026.1.3 to patch CVE-2026-63077. All on-premises versions are vulnerable to a full server takeover. TeamCity Cloud is already patched and needs no action. If you can't update right away, install the security patch plugin (for versions 2017.1 and later) and restrict access to your TeamCity server to trusted internal networks or a VPN.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

GitLab Remote Code Execution Chain Exploits Long-Standing Memory Flaws in Oj Parser

BeyondMachines — Tue, 28 Jul 2026 10:01:42 +0000

Summary

GitLab patched a critical remote code execution chain involving two memory corruption flaws in the Oj Ruby JSON parser that allow authenticated users to take over servers via malicious Jupyter notebook diffs.

Take Action:

If you run self-managed GitLab, upgrade immediately to version 18.10.8, 18.11.5, or 19.0.2. There's a working exploit published and any user who can push code to a project can take over the server. If you're on version 15.2 through 18.9, those are no longer supported and won't get a patch, so you must move to a supported release to be protected.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Arista Patches Critical VeloCloud Orchestrator Zero-Day Under Active Attack

BeyondMachines — Tue, 28 Jul 2026 09:01:43 +0000

Summary

Arista Networks released an emergency advisory for a CVSS 10.0 OS command injection vulnerability in VeloCloud Orchestrator On-Prem that is currently being exploited in the wild. The flaw allows unauthenticated attackers to gain full control over the orchestrator and all managed SD-WAN edge devices.

Take Action:

Make sure all VeloCloud Orchestrator On-Prem devices are isolated from the internet and accessible only from trusted administrative networks. Then immediately upgrade to a fixed release (5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1) and block the known malicious IPs (8.19.75.217, 206.72.242.124, 206.72.242.162) at your firewall. After patching rotate all credentials and certificates so attackers can't reuse any potentially stolen data.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

CISA Warns of Active Exploitation in Fortinet FortiOS SSL-VPN Patch Bypass

BeyondMachines — Tue, 28 Jul 2026 08:01:42 +0000

Summary

CISA reports active explotation of CVE-2025-68686, a flaw in Fortinet FortiOS that allows attackers to bypass security patches and maintain persistent access on compromised devices.

Take Action:

If you use Fortinet devices, make sure they are isolated from the internet and accessible only from trusted networks. Then update FortiOS ASAP to version 7.6.2, 7.4.7, or later. This flaw is combined with others, so make sure all your Fortinet devices are up-to-date. And check your devices for indicators of compromise, this flaw allowed hackers to maintain access over patch cycles.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

State of (in)security - Week 30, 2026

BeyondMachines — Mon, 27 Jul 2026 19:01:42 +0000

Summary

During week 30 of 2026, cybersecurity monitoring recorded 7 advisories and 28 incidents/breaches affecting roughly 80 million individuals. The largest breach is Suno exposing 55.3 million users and AI training source code. Malware/ransomware and unauthorized access are the leading causes of incidents and healthcare and IT/software as the most-targeted industries.

Take Action:

Patch the actively exploited on-premises SharePoint (CVE-2026-50522), self-hosted ServiceNow, Fastjson 1.x Java apps, Oracle systems (July 2026 Critical Patch Update), and WordPress. Then update Firefox and Thunderbird and confirm your Adobe Acrobat Chrome extension is running version 26.5.2.3 or later.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Whitfield Regional Hospital Discloses Data Breach Exposing Sensitive Patient Information

BeyondMachines — Mon, 27 Jul 2026 18:01:43 +0000

Summary

Whitfield Regional Hospital in Alabama disclosed a data breach involving unauthorized access to its network between May 15 and June 8, 2025. The incident exposed sensitive personal, financial, and medical information, including Social Security numbers and health insurance data. The hospital is offering affected individuals 12 months of complimentary credit monitoring and identity protection services through Experian.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Wildwood Surgical Center Discloses Data Breach Exposing Patient and Medical Records

BeyondMachines — Mon, 27 Jul 2026 17:01:43 +0000

Summary

Wildwood Surgical Center disclosed a data breach from June 2025 that exposed the personal, medical, and financial information of an undisclosed number of patients. The facility detected the unauthorized access in 2025 but did not complete its data review and victim notification process until July 2026.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Michigan Surgical Center Reports Data Breach Following Ransomware Claims by The Gentlemen Group

BeyondMachines — Mon, 27 Jul 2026 16:02:01 +0000

Summary

Michigan Surgical Center LLC disclosed a data breach on July 17, 2026, following ransomware claims by "The Gentlemen" group. The center is offering 24 months of free credit monitoring to affected individuals while investigating the extent of the unauthorized access.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

MongoDB Patches 26 Vulnerabilities Including Critical Memory Corruption Flaw

BeyondMachines — Mon, 27 Jul 2026 15:01:43 +0000

Summary

MongoDB released security updates to fix 26 vulnerabilities, including a critical memory corruption flaw (CVE-2026-13072) and multiple high-severity issues that allow unauthorized data access and service crashes.

Take Action:

If you run self-hosted MongoDB, update your servers now to the latest patched version (7.0.39, 8.0.28, 8.2.12, 8.3.7, or 9.0.0-rc1). There's a critical flaw that could let attackers crash your database or run their own code. If you use MongoDB Atlas or another managed service, you're already covered and don't need to do anything.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Penobscot Valley Hospital Discloses Data Breach Impacting Patient PHI and Financial Records

BeyondMachines — Mon, 27 Jul 2026 14:01:42 +0000

Summary

Penobscot Valley Hospital in Maine suffered a data breach where attackers accessed files containing patient health information, Social Security numbers, and financial data. The hospital is offering identity monitoring services to affected individuals.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

TripleX Group Claims 1TB Data Breach of Bank of Baroda Customer Records

BeyondMachines — Mon, 27 Jul 2026 12:01:42 +0000

Summary

The TripleX hacking group claims to have leaked 1TB of sensitive Bank of Baroda customer and internal data on the dark web. The bank has not yet confirmed the incident.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Thailand Securities Depository Discloses Investor Portal Data Breach

BeyondMachines — Mon, 27 Jul 2026 11:01:42 +0000

Summary

Thailand Securities Depository (TSD) disclosed a data breach on July 26, 2026, after detecting unauthorized access to users’ personal information through its Investor Portal. The company blocked access to the affected system and confirmed that the incident did not affect securities trading, financial information, or assets held in its custody.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines