Critical Vulnerabilities Patched in OpenAM with Release of Version 16.1.2
OpenAM has been found to contain multiple vulnerabilities, some of which allow remote code execution. The development team addressed these issues by releasing security update OpenAM 16.1.2 on July 20, 2026, covering 18 vulnerabilities in total, including those inherited from third-party dependencies.
The flaw tracked as CVE-2026-62379 affects the authentication endpoint. It permits loading and instantiating arbitrary Java classes specified in XML without any validation, enabling unauthenticated attackers to execute code on the server. Another critical issue, CVE-2026-62263, arises from insufficient restrictions on deserialized objects during authentication, again allowing unauthenticated remote code execution.
GitHub assigned CVE-2026-62379 a CVSS v3.1 base score of 9.8, while CVE-2026-62263 received a CVSS v4.0 score of 9.2; both are rated Critical. The update additionally fixes cross-site scripting vulnerability CVE-2026-62280 on the authorization consent page and resolves issues in dependent software including the Node.js component, js-yaml, and websocket-driver.
Full list of addressed CVEs
- CVE-2026-45736
- CVE-2026-48779
- CVE-2026-49982
- CVE-2026-53550
- CVE-2026-54466
- CVE-2026-54490
- CVE-2026-61787
- CVE-2026-62261
- CVE-2026-62263
- CVE-2026-62280
- CVE-2026-62379
- CVE-2026-63463
- CVE-2026-63467
- CVE-2026-63468
- CVE-2026-63484
- CVE-2026-63485
- CVE-2026-63487
- CVE-2026-63488
Related articles
Cisco, Eltex, and MikroTik Switches Tested Against 90 DHCP Spoofing Attacks
Researchers conducted a detailed comparison of three popular network switches to evaluate their effectiveness in blocking DHCP spoofing attacks, a common Layer 2 threat that can compromise data in local networks. The tested devices included the Cisco 2960 with hardware-based protections, the Russian Eltex MES1428 also featuring ASIC-implemented security, and the more affordable MikroTik CRS that relies on CPU-processed Bridge Filter rules. Using a legitimate ALT Linux DHCP server, a Kali Linux attacker running a custom Scapy Python script, and a victim machine, the team launched 30 attacks per device with protections enabled. Results showed Cisco blocking 100% of attacks with the fastest detection times around 415 ms and minimal CPU impact, while Eltex achieved 93.3% effectiveness and MikroTik only 80% with significantly higher latency and processor load. The study highlights hardware versus software implementation differences and provides recommendations for critical infrastructure versus small office environments.
Check Point Issues Urgent Fixes for Critical Exploited SmartConsole Vulnerability CVE-2026-16232
Check Point has released emergency patches for a critical vulnerability in the SmartConsole login process that is already being actively exploited in real-world attacks. The flaw, tracked as CVE-2026-16232 with a CVSS score of 9.3, allows unauthenticated remote attackers to obtain valid access tokens and gain full administrative privileges over the management environment. Exploitation requires the management server to be directly exposed to the internet without IP address restrictions for trusted clients. The company has confirmed attacks against a small number of customers and notified those affected. The update also addresses two additional vulnerabilities, CVE-2026-62144 and CVE-2026-62145, and is delivered through the Jumbo Hotfix package released on July 22, 2026.
Google Releases Fifth Chrome Security Update in July, Addressing Four High-Severity Vulnerabilities
Google has issued the fifth security update for its Chrome browser in July 2026, releasing patches for four high-severity vulnerabilities. The update, published on July 23, 2026, includes versions Chrome 150.0.7871.187 and 150.0.7871.186 for Windows and macOS, along with Chrome 150.0.7871.186 for Linux. This follows previous July updates that fixed 27 issues on July 8, 15 on July 14, 7 on July 16, and 12 on July 21. The four newly addressed flaws, reported between late May and mid-June, all carry a High severity rating. They include an out-of-bounds write vulnerability in the codec component tracked as CVE-2026-16807, plus three Use After Free issues in WebMCP (CVE-2026-16806), the Blink rendering engine (CVE-2026-16805), and input processing (CVE-2026-16804).
PHP Type Juggling Vulnerabilities: How Loose Comparisons Enable Authentication Bypass in Legacy Applications
PHP Type Juggling remains a persistent source of critical authentication bypass vulnerabilities because the language's dynamic typing and loose comparison operator == automatically coerce strings, arrays, and scientific notation values into numbers. The article explains why == differs fundamentally from the strict === operator, how magic hashes starting with 0e followed by digits can be treated as zero, and why functions like hash_hmac return NULL when given arrays instead of strings in older PHP versions. It details practical exploitation techniques including sending parameter[]=value to force arrays, bypassing HMAC checks, and the changes introduced in PHP 8 that eliminated many unexpected string-to-number conversions. The piece also covers detection methods for penetration testers, such as searching for == usage around cryptographic functions, and provides concrete defensive recommendations including mandatory use of hash_equals and strict in_array comparisons. Finally, it directs readers to a hands-on ONE TASK exercise on the free White Hacker Profession course platform to practice identifying and exploiting these issues in a realistic application.