Loading story…
The Open Information Security Foundation (OISF) released Suricata 8.0.7, a security update addressing 68 reported security issues alongside performance, detection-accuracy, and stability defects. CVE identifiers were still pending for the issues at publication; OISF and CVSS v3.1 rated two of the flaws Critical.
OISF attributed the unusually large volume of findings partly to increased AI-assisted vulnerability analysis. Organizations using Suricata should prioritize upgrading to 8.0.7, particularly because the Suricata 7 branch reached end of life with version 7.0.17; the associated LibHTP project is also end of life and its repository has been archived.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
OISF released Suricata 8.0.7, addressing 68 vulnerability tickets as well as performance, accuracy, and stability issues. Two tickets, 9004 and 8974, were rated Critical by both OISF and CVSS 3.1; CVE identifiers were pending for all reported issues at publication.
Suricata 7 reached end of life with version 7.0.17 as its final release. LibHTP also reached end of life and its repository was archived when Suricata 7 support ended.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceforum.suricata.io
Open sourceicinga.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Traffic Server has received security updates for **16 vulnerabilities**, including **four critical** and **eleven high-severity** issues affecting versions `8.0.0` through `8.1.9`, `9.0.0` through `9.2.14`, and `10.0.0` through `10.1.3`. CSIRT Italia said the flaws can enable **arbitrary code execution, denial of service, security restriction bypass, information disclosure, and tampering**, and assigned the advisory a high systemic impact score. Apache recommends upgrading affected deployments to **`9.2.15`** or **`10.1.4`**. The published CVEs include **`CVE-2026-58150`**, a critical HTTP/2 `Transfer-Encoding` handling flaw that enables downgrade request smuggling, as well as **`CVE-2026-58159`** for ACL bypass, **`CVE-2026-58161`** for TLS/SNI memory-safety crashes, and **`CVE-2026-58151`** for HTTP/2 resource-exhaustion denial of service. Additional issues affect multiple plugins, including **ESI** SSRF and recursion in `CVE-2026-58178`, stack and integer overflows in `regex_remap` (`CVE-2026-58179`), stack exhaustion in `uri_signing` and `url_sig` (`CVE-2026-58181`), resource-consumption flaws in `ts_lua` (`CVE-2026-58182`), crashes in `prefetch` (`CVE-2026-58183`), and memory-safety weaknesses in experimental plugins (`CVE-2026-58188`).
Jul 31, 2026
Splunk released patches for three vulnerabilities affecting **Splunk Enterprise**, **Splunk Cloud Platform**, and the **Splunk AI Toolkit**, including a high-severity denial-of-service bug and two issues that can expose sensitive data. `CVE-2026-20240` affects the `splunk_archiver` app, where a low-privileged user can abuse the `coldToFrozen.sh` script to rename critical directories and render an instance inoperable. `CVE-2026-20239` stems from improper output sanitization in the TcpChannel component and can leak session cookies and cleartext HTTP response bodies into the `_internal` log index, while `CVE-2026-20238` is an access-control weakness in the Splunk AI Toolkit that can bypass intended search restrictions and expose restricted data. Splunk said the issues were fixed in updated releases, including **AI Toolkit 5.7.3** for `CVE-2026-20238`, and urged customers to upgrade affected deployments. The company also published interim mitigations for organizations that cannot patch immediately, including restricting access to the `_internal` index to administrators, disabling the **Splunk Archiver** application, reviewing inherited roles and permissions, and removing the problematic `srchFilter` entry from local configuration where applicable. The advisories highlight risks to both platform availability and the confidentiality of operational data stored in Splunk environments.
Jun 29, 2026
Ivanti released security updates for eight vulnerabilities across **Cloud Services Application (CSA)**, **Connect Secure (ICS)**, **Policy Secure (IPS)**, **Desktop and Server Management (DSM)**, **Sentry**, and **Patch SDK**, including five rated critical. The most severe issues affect CSA, ICS, and IPS and could allow **SQL injection**, **remote code execution**, **authentication bypass**, and ultimately full system compromise, while a separate advisory also addressed **`CVE-2024-7572`** in DSM. Additional flaws can lead to denial of service, unauthorized system changes, file deletion, and bypass of security mechanisms. Ivanti said Patch SDK exposure also affects dependent products including **Endpoint Manager**, **Security Controls**, **Patch for Configuration Manager**, **Neurons for Patch Management**, and **Neurons Agent Platform**, and urged customers to upgrade immediately to supported fixed versions for ICS, IPS, DSM, and other impacted platforms.
Jul 23, 2026