IBM i 7.6 and earlier releases contain CVE-2026-84414, a CVSS 7.8 flaw that allows local authenticated attackers to change ownership of arbitrary files. The vulnerability affects system integrity across four supported versions and requires immediate review of IBM guidance.
The vulnerability stems from improper validation of an attacker-controlled file path.
Successful exploitation grants the attacker control over file permissions that should remain restricted.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
NVD lists CVE-2026-17285 in IBM API Connect and says it has not scored the flaw. IBM's CVSS 3.1 vector on the page scores 7.7.
A critical heap-based buffer overflow affects the D-Link DIR-878 on firmware 1.20B05 through the HNAP Handler. The flaw allows remote unauthenticated attacks and has a public exploit available.
The FBI has warned that some Artex intrusions reached privileged access in under three hours. The same flash cites personal data taken from about 67,000 people and access to more than 2,250 ConnectWise Cloud Backup tenants.
The Justice Department has court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. A wider freeze of more than $2.7 billion includes private-sector holds, and tracing is still underway.
The Justice Department has announced 354 arrests and the seizure of more than $234 million in cash and virtual currencies from Operation TorNado. The sweep ran from May 2025 to October 2026 and did not split that money between cash and crypto.
