Two of today's disclosures concern vulnerabilities that had been sitting in widely deployed infrastructure for years. PostgreSQL's CVE-2026-6471 traces back to the introduction of logical decoding in 2014, allowing a low-privilege REPLICATION account to escalate to permanent superuser access and install a backdoor that survives restarts and manual reversion. Cisco's own review of IOS XR, described as a "comprehensive internal security review", uncovered two separate 9.8-rated flaws alongside several high-severity issues in carrier-grade equipment that has been in service for years. Neither case involved a new attack technique; both show what can surface when mature systems receive a deeper security review.

AI tooling featured in two other disclosures, but its role was less about finding something genuinely new than reducing the effort needed to exploit or expose existing weaknesses. A researcher used a coding agent to reconstruct a nearly four-year-old ballot-order vulnerability in Georgia's voting scanners, analysing voter behaviour from public early-voting lists and cast-vote records without touching a machine or network. Separately, a stealth startup found that AI coding agents, including Claude, were installing unregistered packages and domains referenced in llms.txt files scraped from Fortune 500 and defence-contractor sites, with agents phoning home within an hour of the researchers registering those names. The underlying weaknesses were already there; the AI tools made them easier to investigate or operationalise.

Google released Chrome 152.0.7977.82/.83 for Windows, Mac and Linux, fixing 12 security vulnerabilities. The update addresses ten high-severity bugs, including type confusion, use-after-free and out-of-bounds issues across V8, Compositing, WebGL, Skia and DevTools. Google confirmed an exploit exists in the wild for CVE-2026-85046, a type confusion flaw in V8.

France's ANSSI, leading the G7 Cybersecurity Working Group under France's 2026 G7 Presidency, issued a joint call to action alongside G7 partners, the European Commission and ENISA. The statement builds on a 2025 G7 declaration negotiated under Canada's presidency, which set out recommendations for migrating to quantum-resistant algorithms. The working group is now pressing public and private sector decision-makers to prepare immediately for the transition, warning that the quantum threat is imminent.

Cyera Research disclosed CVE-2026-6471, a critical PostgreSQL vulnerability present since 2014 across versions 9.4 through 18. Low-privilege accounts holding the REPLICATION attribute could exploit an unvalidated output plugin path in logical replication to achieve remote code execution and escalate to superuser. Attackers could then install a persistent backdoor via pg_hba.conf changes and preload library registration, surviving restarts and manual reversion.

Rapid7 Labs identified a new Linux toolkit, dubbed "ted backdoor" and "curlRAT," targeting South Korea's automotive and media sectors. The malware trojanises HAProxy along with crond, agetty, atd, sshd and polkitd, enabling remote command execution, script injection into web traffic and credential harvesting. Rapid7 attributes the campaign with medium confidence to DPRK-linked actors, citing infrastructure overlaps with APT37 and tradecraft similarities to Lazarus Group operations.

Kaspersky identified two new backdoors from financially motivated group Toy Ghouls, which target Russian organisations using HiveMQ's MQTT broker or the Element messenger as command-and-control channels. Delivered via WinRM, the malware encrypts its configuration with a machine-bound key and installs as a Windows service. Commands are executed through PowerShell or the Windows command line, with results relayed back through the same messaging channels.