Weekly Roundup: Critical Vulnerabilities Hit VMware ESX, FortiOS, Chrome, fastjson, Cisco FMC and Ruby on Rails
Security NEXT has released its weekly ranking of the most-read articles published between July 26 and August 1, 2026. The list is led by reports of serious vulnerabilities in several major enterprise and consumer platforms.
The top story covers newly disclosed critical flaws in VMware ESX and VMware vCenter, accompanied by official patches. Second place went to confirmation from U.S. authorities that threat actors are actively exploiting vulnerabilities in FortiOS and VeloCloud Orchestrator.
Google issued a large security update for Chrome that resolves 370 vulnerabilities. A separate entry highlights a flaw in the Java data-conversion library fastjson that has already been observed in exploitation attempts.
Apple released iOS 26.6 and iPadOS 26.6, addressing 87 security issues. Cisco warned customers about a vulnerability in its firewall management product Cisco FMC that is already being exploited in the wild.
Other notable items include a cyber-attack on an ANA Group online store that may have resulted in the leakage of personal information, a serious vulnerability in OpenAM, an update for Node.js fixing 11 issues, and a critical flaw named KindaRails2Shell affecting Ruby on Rails.
Related articles
pgAdmin 4 Issues Critical Security Update Addressing Seven Vulnerabilities Including Prior Patch Failures
The pgAdmin 4 development team has released version 9.17 to resolve seven vulnerabilities in the popular PostgreSQL database management tool. The update covers two newly discovered issues rated Critical, one Critical flaw stemming from incomplete remediation in the previous 9.16 release, and four additional vulnerabilities. Among the new flaws is CVE-2026-17566, an OS command injection vulnerability in the query-based data export feature caused by insufficient SQL validation. Another Critical issue, CVE-2026-17349, allows duplication of shared servers to inadvertently copy stored database credentials belonging to other users. The incomplete fix for CVE-2026-12045 led to CVE-2026-17351, which bypasses the read-only restrictions of the AI Assistant due to differing string literal interpretations between the SQL parsing library and PostgreSQL.
Dangerous C++ Traps: Memory Safety Issues, Undefined Behavior, and Code That Betrays Developers
Around 70% of vulnerabilities assigned CVE numbers by Microsoft each year stem from memory safety errors, with Chromium reporting a similar pattern for serious Chrome bugs. The article examines how C++ deliberately permits low-level memory access for performance but demands strict discipline to avoid undefined behavior (UB). It details real-world cases including Heartbleed (CVE-2014-0160) in OpenSSL, use-after-free errors, buffer overflows, and data races. Modern tools such as AddressSanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer are presented as essential for detection, alongside recommendations for RAII, std::span, and smart pointers. The piece also discusses C++26 changes introducing erroneous behavior for uninitialized variables and advises when to consider memory-safe languages like Rust for new components. Practical migration steps and compiler warning strategies are outlined to reduce risk in existing codebases.
Critical CosmosEscape Flaw Breaks Customer Isolation in Azure Cosmos DB
A critical vulnerability named CosmosEscape allowed attackers to escape the restricted Gremlin API environment and execute arbitrary code on the DB Gateway component of Azure Cosmos DB. The flaw exploited weaknesses in .NET reflection protections, enabling file read/write operations and command execution that ultimately yielded the Cosmos Master Key. With this global signing key, an attacker could retrieve the primary key for any customer account and gain full read/write access. The exploit also exposed the Config Store containing account names, subscription identifiers, tenant details, and network rules. Even network-isolated and private instances remained vulnerable because the DB Gateway itself enforced those restrictions. Internal Microsoft services including Entra ID, Teams, and Copilot rely on Cosmos DB, amplifying the potential impact of the issue.
Critical RCE Vulnerability CVE-2026-66066 Affects Ruby on Rails Active Storage with libvips
A severe vulnerability tracked as CVE-2026-66066 has been identified in the Ruby on Rails web application framework. The flaw, also referred to as KindaRails2Shell by researchers, impacts applications that use Active Storage with the libvips image processing engine. Attackers can exploit the issue by uploading specially crafted files to read arbitrary files without authentication. This exposure may lead to theft of environment variables, secret keys, and external service credentials, enabling remote code execution or further attacks. The vulnerability stems from unsafe operations in the dependent libvips library. It carries a CVSS v4.0 base score of 9.5 and is rated Critical. JPCERT/CC has issued an advisory urging immediate updates.