NewsThe Hacker News29.07.2026

Mythos Asks the Right Question. It Doesn't Answer It.

AI is compressing exploit timelines. The real question isn't whether your vulnerability management playbook needs to change, it's which part of it you've been getting wrong all along. The conversation happening in security circles right now goes something like this: Mythos is here. Exploit timelines are collapsing. Does the vulnerability management playbook need to change? The honest answer is

Other advisories

Not ratedosv:CLEANSTART-2025-GV56895Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2
Not ratedosv:CVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID
Not ratedosv:CVE-2026-111904phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
Not ratedosv:ECHO-a985-43d5-9a0cGHSA-r44j-crv5-q35m / NVD's own CPE match pins this to the single exact version percona-toolkit:3.6.0, with no version range -- the advisory is "unreviewed" and carries no upper bound, so CPE-based scanners (Trivy/Grype/Wiz) treat it as affecting every later version too. The vulnerable code (weak SHA-256-as-KDF password hashing in src/go/pt-secure-collect/encrypt.go) was replaced with a proper HKDF derivation upstream in commit 78f20304 ("Use KDF instead of hash"), first shipped in v3.7.0 and present in our v3.7.1 build. Independent of the version question, this package never builds pt-secure-collect at all -- only pt-online-schema-change (a separate Perl tool); the build step explicitly drops the manifypods->gotools coupling so Go tools are never compiled.
Not ratedosv:CVE-2026-107639ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename
Not ratedosv:CVE-2026-105397LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation
HighCVE-2026-102578Moodle: sql injection in question bank web service
Not ratedosv:CVE-2026-102626LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

Other news entries

Source: https://thehackernews.com/2026/07/mythos-asks-right-question-it-doesnt.html

More on Question

Other advisories

Other news entries