CVE-2026-47074: ex_aws_sns verify_message/1 fails to validate SigningCertURL, allowing unauthenticated SNS message signature spoofing; affects versions 2.0.1 to before 2.3.5.

Unauthenticated SQL injection in dotCMS Publish Audit API endpoints /api/auditPublishing/get and /api/auditPublishing/getAll allows remote attackers to read, modify or destroy database content; affected versions and fixed release noted.

Megalodon used malicious GitHub Actions to steal CI/CD secrets, cloud keys and tokens from 5,500+ repos; immediate secrets rotation, workflow audits and secret managers are essential.

CVE-2026-25193: installer logs can contain service account credentials; change passwords and delete installer logs under %programdata%\Gallagher\Command Centre.

Critical 9.8 remote code execution in Dolibarr ERP CRM 7.0.3 via the db_name parameter in install/step1.php, unauthenticated attackers can execute arbitrary PHP and run commands via check.php cmd.

CVE-2026-5843: MLX-LM in Docker Model Runner on macOS allows arbitrary Python via model_file in config.json, leading to code execution on the host as the Docker Desktop user. Inventory, isolate and restrict registry pulls immediately.

Operator arrested in Canada after 25,000 DDoS commands and peaks near 31.4 Tbps; practical steps for businesses to verify DDoS readiness and supplier obligations.