Daily briefing · August 2, 2026
Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass Flaws
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
August 2 brings a quiet but technically dense vulnerability day, with no active exploitation or weaponized exploits confirmed. The bulk of the spotlight falls on Bouncy Castle for Java, where six CVEs — four critical — expose deep cryptographic trust issues ranging from certificate validation gaps to DH key agreement flaws. Defenders should treat these as high-priority patch targets despite the absence of in-the-wild activity.
Today’s brief
- Six Bouncy Castle for Java CVEs published today, four rated CRITICAL (CVSS 9.3), covering TLS, PKI, and ASN.1 parsing
- PyAthena SQL injection (CVSS 9.3) enables unauthenticated data manipulation on AWS Athena environments
- better-auth framework carries two auth bypass flaws — one enabling DoS via baseURL poisoning, another bypassing rate limits via path normalization
- No active exploitation or weaponized code confirmed today — patch priority driven by CVSS and cryptographic attack surface
Critical highlights
1
Bouncy Castle accepts stapled OCSP responses without binding them to the certificate under inspection, effectively nullifying revocation checks. Attackers could present a revoked certificate alongside a valid OCSP staple for a different cert, bypassing PKI revocation enforcement entirely.
2
Bouncy Castle's JSSE hostname verifier falls back to the Common Name (CN) field by default — a behavior explicitly documented as opt-in only. This mismatch allows TLS certificate hostname spoofing in environments relying on Bouncy Castle for connection validation.
3
In Bouncy Castle's MTI/A0 Diffie-Hellman key agreement, the peer's public value is exponentiated without validation, opening the door to small-subgroup attacks or malicious key injection. This can undermine the confidentiality of sessions established through this key exchange path.
4
A trailing dot appended to rfc822Name or URI values in X.509 Name Constraints can be used to bypass certificate path enforcement in Bouncy Castle. This allows an attacker with a subordinate certificate to evade namespace restrictions that should have been enforced by the CA.
5
PyAthena's DefaultParameterFormatter improperly escapes single quotes using backslashes for DELETE and CTAS statements, a method Athena and Trino do not recognize as escaping. Unauthenticated attackers can inject arbitrary SQL, potentially reading, modifying, or deleting data in connected Athena environments.
6
Vikunja (versions 0.24.0 through 2.3.0) fails to verify that the caller of the task-collection endpoint is authorized for the requested project view, a classic BOLA flaw. A link-share token holder can enumerate tasks from arbitrary projects outside their authorized scope.
7
An unauthenticated attacker who sends the very first request to a better-auth server (before baseURL is set) can poison the router's base path, causing all subsequent routes to return 404 — effectively a denial of service at startup. Systems with BETTER_AUTH_URL explicitly configured are not affected.
8
The rou3 router library bundled in better-auth normalizes away empty path segments, meaning requests to //path bypass disabledPaths and path-level rate limit rules. Attackers can abuse this to reach intentionally blocked endpoints or exhaust backend resources.
9
A lazy ASN.1 sequence parsing flaw in Bouncy Castle resets the nesting-depth guard, potentially allowing crafted input to cause unbounded recursion or stack exhaustion. This is particularly concerning in services that parse untrusted certificates or cryptographic structures at scale.
10
Bouncy Castle's RSA PKCS#1 signature verification skips the final two bytes of the hash when the NULL parameter is omitted from the DigestInfo structure. This verification shortcut could allow forged signatures to pass validation, undermining the integrity of RSA-signed data.
Ransomware today
The group thegentlemen has recently claimed two Brazilian victims: the Municipal Chamber of Serra, a government institution, and CRB group, a professional services firm. Among the most active ransomware groups over the last 30 days, lockbit5 leads with 23 victims — all in Brazil — followed by Section9 (6, all BR), Global Secret Group (4, all BR), qilin (3), and Deadlock (3).
The Municipal Chamber of Serra BRthegentlemen · Government & Defense
CRB group BRthegentlemen · Professional Services
lockbit5 23Section9 6Global Secret Group 4qilin 3Deadlock 3thegentlemen 2
Active groups & APTs
Several threat actor profiles have been updated or flagged recently, including againstthewest, apt73, kazu, kelvinsecurity, krybit, and coinbasecartel, though none have publicly claimed victims at this time. Their presence in threat intelligence feeds warrants monitoring, as lack of claimed victims does not preclude reconnaissance or early-stage operations.
Brazil focus
Brazil continues to face concentrated ransomware pressure, with recent victims spanning critical and sensitive sectors: Global Secret Group hit SPDM (healthcare) and Sinop Energia (energy), Section9 claimed targets in agriculture, financial services, and an undisclosed domain, and thegentlemen added a municipal government and a professional services firm. The breadth of targeted sectors — from public administration to energy and finance — underscores the indiscriminate targeting posture of active groups against Brazilian organizations.
The Municipal Chamber of Serrathegentlemen · Government & Defense
CRB groupthegentlemen · Professional Services
SPDMGlobal Secret Group · Healthcare
Sinop EnergiaGlobal Secret Group · Energy & Utilities
*****.ind.brSection9 · Agriculture and Food Production
*****.com.brSection9 · Financial Services
********.com.brSection9
Sinop EnergiaGlobal Secret Group · Energy & Utilities
Today’s recommendation: Organizations using Bouncy Castle for Java (any edition, including FIPS) should prioritize upgrading to version 1.85 or the respective patched LTS/FIPS release, as today's batch of CVEs collectively weaken TLS, PKI, and cryptographic primitives. Teams running PyAthena or better-auth in production should also apply the latest patches and audit configurations for explicit baseURL and disabled-path settings.
Even on quieter days, the right question is not whether a CVE made headlines, but whether any of the affected libraries or components are silently embedded in your own supply chain — validating your actual exposure is the only way to answer that.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
August 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress StacksJuly 26, 2026 — Quiet Vulnerability Day as Brazil Faces Ransomware Wave From Multiple GroupsJuly 25, 2026 — CVSS 10.0 in SiYuan and Auth Bypass in OpenRemote Lead a Calm Day for New ExploitsJuly 24, 2026 — Three CVSS 10.0 Microsoft Cloud Flaws Lead a Calm but Notable Patch Dayview full archive →