Adobe Patches Critical Vulnerabilities in Bridge and Format Plugins
Adobe has released security updates to address multiple critical vulnerabilities affecting Adobe Bridge and Adobe Format Plugins. The company published the corresponding security advisories on July 28, 2026, and made patched versions available immediately.
In Adobe Bridge, eight vulnerabilities were resolved. These include search path issues tracked as CVE-2026-48395 and CVE-2026-48391, authorization bypass problems identified as CVE-2026-48396 and CVE-2026-48390, path traversal flaw CVE-2026-48374, and out-of-bounds write issues CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394. Exploitation of these flaws could allow attackers to execute arbitrary code or gain elevated privileges.
Adobe Format Plugins was affected by a heap-based buffer overflow vulnerability tracked as CVE-2026-48372. Successful exploitation may permit remote attackers to execute arbitrary code on the target system.
Users are strongly advised to apply the latest updates without delay. The fixes are available through Adobe’s standard update mechanisms and via the links provided in the official advisories.
Related articles
The Tale of Active Directory Domain Sabotage: Architect Plants DNS-Killing Task on Departing Branch Controllers
A detailed case study from a former Windows Server 2003 Active Directory environment describes how an architect embedded a monitoring script on branch domain controllers to detect prolonged loss of VPN connectivity to headquarters. The script incremented a hidden registry counter each time the head office IP failed to respond and triggered a net stop dns command once the threshold was exceeded, effectively collapsing the AD domain for the departing branches. The architect later cleaned up traces by reassigning tasks and ownership to the SYSTEM account. A network engineer eventually noticed the repeated DNS service stops, restarted the service multiple times, and eventually contacted the architect. The story illustrates both the critical dependency of Active Directory on DNS and the inherent risk posed by highly privileged administrators who can weaponize that dependency. Two main conclusions are drawn: DNS failure immediately renders an AD domain unusable, and every domain administrator represents the primary threat to domain integrity.
Apple Patches CVE-2026-43760 Screen Sharing Flaw Granting Root Access on macOS
A vulnerability in the macOS Screen Sharing feature allows remote attackers to execute commands with root privileges under specific configurations. Identified as CVE-2026-43760 and tied to the screensharingd service, the flaw affects systems with Screen Sharing or Remote Management enabled alongside the legacy VNC password option. Attackers who know the VNC password can exploit unauthenticated account binding to retrieve protected files such as /etc/sudoers or write policies into /private/etc/sudoers.d. This grants non-privileged accounts passwordless sudo rights. The issue stems from VNC-authenticated connections not being mapped to specific macOS accounts while file-transfer components retain root privileges. Apple addressed the vulnerability in macOS Tahoe 26.6 and macOS Sonoma 14.8.8, both released on July 27, 2026.
CISA Adds Ray AI Framework Flaw CVE-2025-62593 to KEV Catalog After Confirmed Exploitation
US authorities have issued a warning that a critical vulnerability in the Ray framework for scaling AI and Python applications is being actively exploited in real-world attacks. The flaw, tracked as CVE-2025-62593, allows remote code execution through browsers such as Firefox and Safari, potentially enabling attackers to run malicious code simply by displaying an ad on a compromised page. CISA added the issue to its Known Exploited Vulnerabilities catalog on August 17, 2026, and directed federal agencies to apply mitigations by August 20. Originally disclosed in November 2025 and fixed in Ray version 2.52.0, the vulnerability carries a CVSS v4.0 base score of 9.4 and is rated Critical. Developers using Ray in environments that also run Firefox or Safari face additional risk from DNS rebinding attacks that can lead to code injection. Organizations relying on Ray are urged to verify patch status and monitor for signs of compromise.
GitLab Issues Critical Security Updates Fixing Unauthenticated Project Modification Flaws
GitLab has released security updates for its Community Edition and Enterprise Edition platforms to address two vulnerabilities, including one rated critical. The flaws were reported through the company's bug bounty program and affect multiple supported versions. CVE-2026-19478 is a code injection issue that allows remote attackers to tamper with or delete public projects and user data via GraphQL directives without authentication under certain conditions. CVE-2026-19650 is a CSRF vulnerability stemming from insufficient validation in GraphQL multiplexed query handling, enabling mutation execution through GET requests. Both CVEs received high CVSS scores, prompting GitLab to urge immediate upgrades to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.