Every 24 hours
Tech News
Original reporting on what changed in security, rewritten in full and dated with the day the story broke. Each edition adds at least four articles and skips a topic already covered.
Jul 22, 2026
Critical SSRF Vulnerability Discovered in Gitea Affects Internal File Security
A significant security vulnerability has been identified in Gitea, an open-source platform for managing Git repositories. The issue, classified as CVE-2026-34966, revolves around a server-side request forgery (SSRF) vulnerability that arises during the migration asset download process. This flaw allows unauthorized access to internal files and sensitive cloud metadata, effectively bypassing existing security measures intended to restrict such access.
The implications of this vulnerability are severe, as it exposes internal systems and data that are typically protected from external threats. Organizations utilizing Gitea for their development and project management may find themselves at risk of data breaches, which could potentially lead to unauthorized data manipulation or exposure of sensitive information.
Developers and system administrators are urged to assess their Gitea installations and implement necessary security measures to mitigate this risk. The SSRF vulnerability highlights the importance of thorough security assessments, especially for applications that handle sensitive data or operate within cloud environments.
As the cybersecurity landscape continues to evolve, organizations must remain vigilant and proactive in their incident response strategies to safeguard against emerging threats. It is crucial for affected entities to stay informed about updates from Gitea and apply patches as they become available to protect their systems from exploitation.
Jun 29, 2026
New Ransomware Campaign Leveraging Bumblebee and AdaptixC2
A new ransomware campaign has emerged, utilizing the Bumblebee and AdaptixC2 frameworks to deliver the Akira ransomware. This campaign first came to light in a threat brief issued to customers in July 2025, followed by a public flash alert in August 2025, which was a collaborative effort with Swisscom B2B CSIRT. The alert highlighted multiple intrusions associated with this ongoing threat, indicating a coordinated effort to exploit vulnerabilities in various systems.
Organizations that have been affected by this campaign are facing significant risks, as the Akira ransomware can lead to severe data loss and operational disruptions. The use of Bumblebee and AdaptixC2 in the attack vector suggests that attackers are leveraging sophisticated methods to infiltrate networks. This highlights the growing complexity of ransomware threats and the need for organizations to remain vigilant against evolving tactics.
As the threat landscape continues to evolve, businesses must prioritize incident response and threat intelligence to mitigate the risks associated with such ransomware campaigns. The collaboration between cybersecurity firms and incident response teams is crucial in identifying and addressing these threats promptly. Organizations are urged to enhance their security protocols and ensure they are prepared to respond effectively to potential intrusions.
The implications of this ransomware campaign extend beyond immediate data loss; they also raise concerns about compliance and the potential for long-term reputational damage. Companies must be aware of the regulatory frameworks that govern data protection and ensure their systems are resilient against such attacks. As the Akira ransomware continues to spread, the focus on cybersecurity will remain paramount in safeguarding critical business assets.