Mozilla Patches Critical Flaws Amidst AI-Driven Security Surge

A series of critical vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2026-8094, CVE-2026-8091, CVE-2026-5735, CVE-2026-8093, and CVE-2026-8092, have been addressed in recent updates. These flaws range from WebRTC component issues and incorrect boundary conditions in media playback to various memory safety bugs that could allow for arbitrary code execution. As The Register reported, Mozilla has increasingly utilized AI-driven discovery tools to identify and remediate these security gaps. Security teams should prioritize patching to the latest versions, including Firefox 150 and Thunderbird 150, to mitigate these high-risk exposures.

Ollama versions prior to 0.17.1 are affected by a heap out-of-bounds read vulnerability, tracked as CVE-2026-7482, which resides in the GGUF model loader. An attacker can exploit this by providing a crafted GGUF file via the /api/create endpoint, where declared tensor offsets and sizes exceed the actual file length, potentially leading to remote process memory leaks. As The Hacker News reported, this flaw poses a significant risk to the estimated 300,000 exposed Ollama deployments globally. Users are strongly urged to update their instances immediately to prevent unauthorized information theft.

Universal Robots PolyScope versions prior to 5.25.1 contain a critical OS command injection vulnerability, CVE-2026-8153, within the Dashboard Server interface. This flaw allows an unauthenticated attacker to execute arbitrary code on the robot's operating system by crafting malicious commands. Given the potential for physical impact in industrial environments, this vulnerability represents a high-priority risk. Organizations utilizing these robotic systems should verify their current firmware version and apply the necessary updates to secure the Dashboard Server interface against unauthorized access.

NiceHash QuickMiner version 6.12.0 is vulnerable to a supply-chain-style attack, CVE-2025-56513, due to the software's failure to validate digital signatures or hash checks during updates performed over HTTP. An attacker capable of intercepting or redirecting network traffic can hijack the update process to deliver malicious payloads to the host system. This lack of integrity verification is a severe security oversight for an application that manages system resources. Users should ensure they are running patched versions and, where possible, restrict update traffic to trusted, encrypted channels.

Several high-severity vulnerabilities have been disclosed across various platforms, including a Zip Slip path traversal in OpenMRS Core (CVE-2026-40076) and multiple SQL injection flaws in Rucio (CVE-2026-29090, CVE-2026-29080). Additionally, Gotenberg versions 8.30.1 and earlier are susceptible to command injection via unsanitized metadata values (CVE-2026-40281), while Tenda CX12L firmware 16.03.53.12 contains a stack-based buffer overflow (CVE-2026-8138). Security teams should audit their environments for these specific applications and prioritize patching or implementing compensating controls to prevent potential exploitation.