Weekly Roundup: Critical Vulnerabilities Hit VMware ESX, FortiOS, Chrome, fastjson, Cisco FMC and Ruby on Rails
Security NEXT has released its weekly ranking of the most-read articles published between July 26 and August 1, 2026. The list is led by reports of serious vulnerabilities in several major enterprise and consumer platforms.
The top story covers newly disclosed critical flaws in VMware ESX and VMware vCenter, accompanied by official patches. Second place went to confirmation from U.S. authorities that threat actors are actively exploiting vulnerabilities in FortiOS and VeloCloud Orchestrator.
Google issued a large security update for Chrome that resolves 370 vulnerabilities. A separate entry highlights a flaw in the Java data-conversion library fastjson that has already been observed in exploitation attempts.
Apple released iOS 26.6 and iPadOS 26.6, addressing 87 security issues. Cisco warned customers about a vulnerability in its firewall management product Cisco FMC that is already being exploited in the wild.
Other notable items include a cyber-attack on an ANA Group online store that may have resulted in the leakage of personal information, a serious vulnerability in OpenAM, an update for Node.js fixing 11 issues, and a critical flaw named KindaRails2Shell affecting Ruby on Rails.
Related articles
Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization
A new open-source tool called Vulnaware has been developed to address the persistent gap between vulnerability discovery and remediation in enterprise environments. The project focuses on intelligent prioritization rather than attempting to fix every reported CVE, recognizing that fewer than 10 percent of published vulnerabilities are ever exploited. It integrates outputs from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS, then applies scoring based on CISA KEV catalog presence, public exploit availability from Vulncheck feeds, and trend data. Prioritized issues are automatically converted into tickets in Jira Service Management, GLPI, Znuny, and osTicket, while also delivering alerts via Telegram and email. The approach aligns with the updated CISA BOD 26-04 framework that replaced flat 15- and 25-day deadlines with risk-based timelines of 3, 14, or 60 days. By treating vulnerability remediation as a managed change or service request under ITIL4 principles, Vulnaware ensures that critical issues reach the correct engineering teams with proper SLA tracking.
PostgreSQL Releases Security Update Fixing 28 Vulnerabilities and Over 110 Bugs
The PostgreSQL development team issued a major security update on August 13, 2026, addressing 28 vulnerabilities along with more than 110 bugs. While no issues reached a CVSSv3.1 base score of 9.0 or higher, 18 vulnerabilities scored 7.0 or above, with 14 rated at 8.8. Several flaws enable arbitrary code execution, including heap buffer overflows in regular expression processing and the to_char function. Additional fixes cover heap buffer overflows in pg_stat_statements and pg_dump, type confusion issues, and an SQL injection vulnerability. The update resolves specific CVEs such as CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-16238, CVE-2026-16239, and CVE-2026-15741.
Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory
A vulnerability has been identified in the go-archive archive processing library used by Docker and related software. The flaw, tracked as CVE-2026-17106, affects the Unpack, UnpackLayer, and Untar functions and permits files to be created or overwritten outside the intended extraction directory. The issue stems from a mismatch between the path string validated by the code and the actual path resolved by the operating system. Docker rated the vulnerability 7.1 under CVSS v4.0 and classified it as High severity. A proof-of-concept exploit has already been published for macOS and Linux. The fix was implemented in go-archive 0.3.0 and shipped in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0.
Microsoft Defender Zero-Day ShieldBreak Enables SYSTEM Privilege Escalation, Bypassing July Rogue Planet Patch
Security researcher Nightmare Eclipse has publicly disclosed a new zero-day vulnerability named ShieldBreak in Microsoft Defender that allows any standard Windows account to escalate privileges directly to SYSTEM level. The flaw exploits a TOCTOU race condition in Defender's file scanning API callbacks, enabling attackers to swap file contents during the brief window when the scanner reads the file. Although linked to the earlier Rogue Planet vulnerability (CVE-2026-50656), the July patch did not fully address the attack surface, and an adjusted proof-of-concept continues to work on patched systems. Defender's high privileges and trusted status in enterprise environments amplify the risk, as compromised processes can execute malicious actions that appear legitimate in logs. Public disclosure without prior private reporting leaves a window of exposure until Microsoft issues an official fix. Blue teams are advised to enforce strict local permissions, monitor for anomalous Defender process behavior such as unusual child processes or repeated file handle operations, and implement layered defenses including application whitelisting and network segmentation.