Cyber Security News

Hacking Editorial Brief — July 10, 2026

Active Exploitation Campaigns Target Gitea Docker and Langflow Vulnerabilities

Threat actors are actively exploiting two critical vulnerabilities in developer-focused platforms. CVE-2026-20896 in Gitea Docker images allows unauthenticated attackers to gain elevated access through X-WEBAUTH-USER header spoofing, with probing activity now observed in the wild. Separately, CVE-2026-5027, a high-severity path traversal flaw in Langflow AI development platform, is under active exploitation enabling attackers to write arbitrary files on exposed servers. Both vulnerabilities affect internet-facing infrastructure commonly used in DevOps environments, representing immediate risks to organizations running unpatched instances.

Healthcare Provider AdaptHealth Discloses Material Breach; ShinyHunters Threatens MSG Data Leak

AdaptHealth Corp. disclosed a material cybersecurity incident where a threat actor gained unauthorized access to cloud-based patient management systems and exfiltrated sensitive healthcare data. The company has not specified the attack vector or timeline of the intrusion. In a separate incident, the ShinyHunters threat group threatened to leak nearly 26 million records from Madison Square Garden Entertainment after the company allegedly refused ransom demands on June 12. The claimed database includes tracking data and risk scores on celebrities, though independent verification of the breach remains pending. Both incidents follow Accenture's confirmed breach disclosure after threat actor "888" advertised 35 GB of stolen data on underground forums.

Sources: The Hacker News · Bleeping Computer · Benzinga · USA Today