IT News Roundup: DHS Breach, Critical Vulnerabilities, and Meta's AI Cloud Plans - July 8, 2026

The past few days have brought a mix of urgent security alerts and significant industry shifts. A breach of a sensitive Department of Homeland Security network used by thousands of law enforcement officials has federal investigators scrambling, while two critical software vulnerabilities — one in Adobe ColdFusion and another in Gitea — are being actively exploited in the wild. On the infrastructure front, Meta is reportedly planning a cloud business to monetize its vast AI computing surplus, and the UN convened its first Global Dialogue on AI Governance in Geneva. Below are the key stories from the past 24 to 48 hours.

DHS Network Breach Exposes Security Planning for Major Events

Federal investigators are probing a breach of a sensitive Department of Homeland Security network used by thousands of law enforcement and emergency management officials to coordinate security for major events. According to reports from DataBreachToday and UpGuard, the intrusion may have exposed security planning documents for World Cup events and other high-profile gatherings.

A top senator has warned that the breach could carry national security consequences. The DHS network in question serves as a coordination platform for security operations across federal, state, and local agencies, making the scope of the compromise difficult to fully assess at this stage. Federal investigators are working to determine how threat actors gained access and what data was exfiltrated.

The incident underscores the persistent risk to government networks and the challenges of securing systems that must balance accessibility with high-level security requirements.

Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-48282) Under Active Exploitation

Attackers are actively exploiting a maximum-severity vulnerability in Adobe ColdFusion, tracked as CVE-2026-48282, with a CVSS score of 10.0. The flaw is an improper limitation of a pathname to a restricted directory — essentially a path traversal vulnerability — that can lead to arbitrary code execution in the context of the current user, according to the NVD and BleepingComputer.

The vulnerability affects ColdFusion versions 2025.9, 2023.20, and earlier. Exploitation does not require user interaction, and the scope is changed, meaning the impact extends beyond the vulnerable component to the entire application and underlying system. Adobe has released an emergency security update to address the issue.

Organizations running affected versions of ColdFusion should apply patches immediately. The vulnerability threatens confidentiality, integrity, and availability, and exploitation has already been observed in the wild by vulnerability intelligence firm KEVIntel.

Gitea Docker Authentication Bypass (CVE-2026-20896) Actively Exploited

Threat actors are probing and exploiting a critical authentication bypass vulnerability in the Gitea Docker image, tracked as CVE-2026-20896. The flaw affects versions up to and including 1.26.2 and allows attackers to bypass authentication by sending a forged X-WEBAUTH-USER header, as reported by SecurityWeek and The Hacker News.

The root cause is that Gitea's Docker image sets REVERSE_PROXY_TRUSTED_PROXIES=* by default, meaning it trusts reverse-proxy authentication headers from any source IP address. When reverse-proxy authentication is enabled, an attacker can impersonate any user with a single HTTP header, gaining full access to repositories, source code, and stored secrets.

The primary targets include small and medium-sized enterprises, open-source projects, and larger organizations leveraging Gitea for self-hosted code hosting. Users are urged to upgrade to patched versions and review their reverse-proxy configurations to restrict trusted proxy sources.

Meta Plans Cloud Business to Sell Excess AI Computing Power

Meta Platforms is developing plans for a cloud infrastructure business that will sell access to AI computing power and models, setting up a new vector of competition with Amazon Web Services, Microsoft Azure, and Google Cloud, according to Bloomberg.

Meta has invested heavily in AI infrastructure over the past two years, building out massive data center capacity to train and run its own large language models. With significant compute resources sitting idle between training runs, the company sees an opportunity to monetize excess capacity by offering it to other AI developers and enterprises.

The move would make Meta the latest big-tech company to enter the cloud infrastructure market, joining a crowded field that also includes newer players like CoreWeave. Industry analysts note that Meta's entry could drive down prices for AI compute but also intensify competition in an already fast-growing sector.

24 Billion Stolen Records Found Exposed in Massive Online Data Dump

Security researchers have discovered an exposed collection of approximately 24 billion stolen records online, including usernames, passwords, email addresses, and other sensitive account data, as reported by Malwarebytes.

The data dump appears to aggregate records from multiple past breaches and leaks, compiled into a single, poorly secured repository accessible on the open internet. The sheer volume — 24 billion records — dwarfs previous mass data exposures and suggests that a significant portion of internet users may have at least one compromised credential in the collection.

Security experts recommend that individuals check whether their credentials appear in the dump using breach notification services, and change passwords for any affected accounts. Organizations should enforce multi-factor authentication and monitor for suspicious login activity.

Open Source Vulnerabilities Double as AI Adoption Accelerates

Black Duck's 2026 Open Source Security Risk Analysis (OSSRA) report reveals that the average number of open source vulnerabilities per codebase has doubled to 581, driven largely by the rapid adoption of AI and machine learning frameworks, according to Black Duck.

The report found that 87% of codebases are now at risk from open source vulnerabilities, and 65% have been hit by attacks. The surge is attributed to AI frameworks pulling in large dependency trees, many of which contain known but unpatched vulnerabilities.

The findings highlight the growing challenge of managing software supply chain risk in an era where AI tooling introduces complex, deeply nested dependency graphs. Automated vulnerability monitoring and regular dependency audits are becoming essential practices rather than optional safeguards.

UN Hosts First Global Dialogue on AI Governance in Geneva

The United Nations convened its first Global Dialogue on AI Governance in Geneva on July 6–7, 2026, bringing together the international community to discuss approaches to managing artificial intelligence technology, according to UN News.

The dialogue was informed by the work of a UN advisory panel that has warned of the potential for catastrophic harm from unregulated AI systems. Delegates discussed international frameworks for AI safety, alignment with human rights standards, and mechanisms for cross-border cooperation on AI risk management.

The Geneva summit comes amid growing calls for global AI governance standards, with the US White House expected to announce voluntary AI safety standards in the coming weeks. The outcome of the dialogue is expected to feed into broader UN efforts to establish binding or semi-binding international norms for AI development and deployment.