#Security Updates
All CosmicBytez Labs articles tagged #Security Updates, across news, security advisories, how-to guides, and projects.
- News
F5, Juniper Networks Patch Critical Vulnerabilities
F5 fixed critical NGINX flaws as Juniper patched 150+ Junos OS bugs, including CVSS 9.8 flaws enabling root-level RCE and device takeover.
- News
Microsoft: October Windows Update May Break Smart App Control
KB5127648 can grey out Smart App Control on Windows 11 24H2+, blocking users from turning it on. No fix yet — only workarounds.
- News
Microsoft Patches Two Dozen RCE Flaws in Office, Including Zero-Click Outlook Bugs
Microsoft's October Office update fixes 24 critical RCE flaws, including five zero-click Outlook Reading Pane bugs rated CVSS 9.8.
- News
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal fixed CVE-2026-108097, a critical Field UI RCE (risk 19/25), in 11.4.10, 11.3.19 and 10.6.19 — unauthenticated via contributed modules.
- News
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
CVE-2026-85097 (CVSS 10.0), a critical flaw in the Bricksforge WordPress plugin, is under active exploitation enabling unauthenticated RCE.
- News
GitLab Warns of Max-Severity Code Execution Vulnerability in CI/CD Regex Compiler
GitLab patched CVE-2026-97229, a CVSS 10.0 flaw letting unauthenticated attackers run code via a crafted CI/CD regex; patch to 19.4.2, 19.3.4, or 19.2.8.
- News
Microsoft: Windows 11 23H2 Reaches End of Support in 30 Days
Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions stop getting security updates after November 10, 2026, Microsoft warns.
- News
Android's October 2026 Security Update Patches 25 Vulnerabilities, Including 7 Critical Bugs
Google's October 2026 Android patch level fixes 25 flaws across Framework and System, with seven rated critical and none exploited in the wild.
- News
SWIFT Banking & Government Middleware Enables RCE
Thales SConnect flaw CVE-2026-18397 (CVSS 9.4) let any site trigger drive-by RCE on hardware-MFA machines used for SWIFT and government logins.
- News
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
OpenSSL fixed 14 flaws including a high-severity DTLS heap leak; WolfSSL 5.9.4 patched 11 bugs, three enabling TLS certificate-forgery attacks.
- News
Kiteworks Lifts Shutdown Advisory After 'Credible Threat Intelligence' From Federal Authorities
Kiteworks found and patched a critical Advanced Forms flaw during a weekend-long precautionary shutdown; no evidence it was ever exploited.
- News
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
FSB-linked Star Blizzard dropped ClickFix for a one-click 'RedFlick' chain, expanding phishing beyond Ukraine to deploy its CosmicPulse backdoor.
- News
Kiteworks Patches Critical Flaw, Brings Customer Systems Online
Kiteworks restored customer systems after a nine-hour precautionary shutdown tied to threat intel, finding and patching a critical Advanced Forms flaw.
- News
Zero Trust for AI Agents Starts With Fixing Zero Visibility
New analysis finds 70% of organizations can't fully monitor AI agents touching sensitive data, and 67% can't track employee-built agentic workflows.
- News
Microsoft Fixes Bug That Broke Windows File History Backup Feature
Microsoft fixed the File History backup bug from September 2026 updates via optional KB5124006/KB5124010 for Windows 11; Windows 10 fix still pending.
- News
WordPress Patches 'Click2Shell' Vulnerability
WordPress 7.1.1 patches a CSRF flaw that let attackers force theme installs and chain to full remote code execution on self-hosted sites.
- News
WordPress 'Comment2Shell' Flaw Turns a Blog Comment Into Admin RCE
A parsing gap lets one approved comment auto-execute in an admin's browser, chaining to full remote code execution on the server.
- News
Click2Shell PoC Exploit Code Now Public for Patched WordPress CSRF Flaw
Researcher Paulos Yibelo published full technical details and working exploit code for the WordPress Click2Shell CSRF-to-RCE chain.
- News
Microsoft: September 2026 Updates Break Windows File History Backup
September's cumulative updates broke File History across Windows 10 and 11, with backups failing silently and no fix yet available.
- News
Check Point, Kaspersky, Tanium Patch Product Vulnerabilities
Check Point, Kaspersky, and Tanium all shipped patches this week — SQL injection and SSRF fixes lead the Kaspersky and Tanium advisories.
- News
New Check Point Flaw Lets Hackers Execute Code With Root Privileges
An unauthenticated stack overflow in Check Point's Security Management Server login process allows root-level remote code execution. CVSS 9.8.
- News
Critical Check Point Flaw Lets Unauthenticated Attackers Run Code as Root
A CVSS 9.8 stack overflow in Check Point's Security Management Server allows unauthenticated root RCE; Kaspersky and Tanium also patch flaws this week.
- News
ISC Patches 14 Vulnerabilities in BIND 9 DNS Server Software
ISC fixes 14 BIND 9 flaws, including 7 high-severity bugs that can crash named, exhaust memory, or poison DNS caches. No active exploitation reported.
- News
Microsoft Fixes Broken Copy-and-Paste for Excel 2016 Users
KB5002914 broke copy-paste, autofill, and formula dragging in Excel; Microsoft's KB5002655 fixes it for MSI-based Office 2016, other versions still pending.
- News
New WordPress 'Click2Shell' Flaw Forces Theme Installs, Can Chain to Code Execution
A URL-parsing mismatch lets one link silently install a WordPress theme for a logged-in admin, chainable to critical remote code execution.
- News
Cisco Patches 44 Vulnerabilities Across FMC, ISE, and Nexus Dashboard
Cisco patches 44 flaws across FMC, ISE, and Nexus Dashboard, including root-access and RCE bugs; two FMC CVEs were already exploited since August.
- News
Microsoft Shares Workaround for Windows Domain Login Issues
Microsoft confirms KB5124008 breaks AD domain login on some Windows 11 PCs and shares a registry workaround while a permanent fix is prepared.
- News
ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks
CVE-2026-84869 (CVSS 9.9) let attackers push and execute files through active ScreenConnect sessions, spreading VBScript payloads since August 20.
- News
Microsoft: September Updates Break Audio on Some Windows PCs
KB5124008 and KB5124012 can break USB Audio Class 1.0 devices on Windows 11 24H2+, with no official fix yet — only a channel-mode workaround.
- News
Telegram Desktop Flaw Let Hidden JavaScript Exfiltrate Exported Chats
A patched Telegram Desktop bug let attackers hide JavaScript inside chat messages that activated when victims opened HTML exports of their chats.
- News
Check Point Patches Critical VPN Vulnerabilities
CVE-2026-85102 and CVE-2026-85103 (CVSS 9.8) let attackers achieve unauthenticated RCE via Check Point VPN certificate handling.
- News
Microsoft Asks Users to Ignore False 'Antivirus Is Turned Off' Errors
Microsoft confirms a Defender bug shows false "antivirus is off" alerts on Windows 11 26H1 and Server 2025 — protection is unaffected, fix pending.
- News
Next.js Patches Two Critical RCE Flaws — AVIF and Windows Path Traversal
Vercel patched two critical Next.js RCEs: a libheif AVIF heap overflow (CVSS 9.5) and a Windows-only path traversal flaw (CVSS 9.0).
- News
Hackers Target Microsoft SharePoint RCE Chain With PoC Exploit
Attackers are probing a two-bug SharePoint chain — a JWT auth bypass plus a BCS flaw — after public PoCs made unauthenticated RCE reachable.
- News
Critical GitLab GraphQL Flaw Lets Unauthenticated Attackers Delete Public Projects
CVE-2026-19478 (CVSS 9.4) lets unauthenticated attackers delete public GitLab projects via GraphQL. Self-managed CE/EE must patch to 19.2.4 immediately.
- News
Microsoft's Patch Tuesday Deluge Continues With August 2026 Updates
Microsoft's August 2026 Patch Tuesday drops critical fixes including a CVSS 9.8 Windows DNS RCE requiring no user interaction.
- News
Max Severity SAP Commerce Cloud Flaw Now Targeted in Attacks
A critical RCE vulnerability in SAP Commerce Cloud, patched just days ago, is already being actively exploited in the wild.
- News
SAP Commerce Cloud RCE Flaw Lets Unauthenticated Attackers Execute Arbitrary Code
CVE-2026-58231 scores CVSS 10.0 in SAP Commerce Cloud Data Hub Adapter — patch immediately as unauthenticated RCE with full system compromise is possible.
- News
Flaws in Google ADK for Python Unlock Agent-to-Agent Attack
Researchers at Pillar Security documented the first confirmed real-world agent-to-agent exploitation in a production system, targeting Google's Agent...
- News
Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable
Thermo Fisher Scientific has patched a vulnerability in Applied Biosystems human identification software that could allow .fsa and .hid forensic DNA...
- Security
CVE-2026-68579: FreeRDP Heap Buffer Overflow in Windows Clipboard Client
A critical heap-based buffer overflow in FreeRDP's Windows clipboard client allows an OLE paste consumer to trigger memory corruption, scoring CVSS 9.6....
- News
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
Adobe has patched a maximum-severity vulnerability in Campaign Classic (ACC), its enterprise marketing automation platform. The flaw carries a perfect...
- News
In Other News: OpenAI Open Source Tool, AWS Links Hacks to North Korea, Mythos Crypto Research
This week's security roundup covers a parcel delivery company breach at OnTrac, Adobe's latest security patches, AWS attribution of recent cloud attacks...
- News
Rails Patches Critical Active Storage Flaw with RCE Potential (CVE-2026-66066)
A critical vulnerability in Ruby on Rails Active Storage allows unauthenticated attackers to read arbitrary server files via crafted image uploads —...
- News
Ruby on Rails Patches Critical Vulnerability Enabling File Read and RCE
The Ruby on Rails team has released an emergency patch for a critical security flaw that allows unauthenticated attackers to read arbitrary files and...
- News
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
A critical remote code execution vulnerability in Gitea, tracked as CVE-2026-60004 with a CVSS score of 9.8, allows any user with ordinary repository...
- Security
CVE-2026-51260: Unsafe memcpy in ESP32-audioI2S Enables Remote Heap Buffer Overflow
A critical CVSS 9.4 heap buffer overflow in schreibfaul1 ESP32-audioI2S 3.4.5 allows remote attackers to corrupt heap memory by serving a malicious audio...
- Security
CVE-2026-48144: Apache Thrift c_glib TLS Certificate Host Mismatch (CVSS 9.1)
A critical TLS hostname verification flaw in Apache Thrift's c_glib bindings allows network-positioned attackers to conduct man-in-the-middle attacks...
- News
n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
A high-severity expression sandbox escape in n8n allows authenticated workflow editors to execute operating-system commands on the host server. Security...
- News
Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
This week's top threats: OpenAI's models escape a sealed test environment, a CVSS 9.3 Check Point flaw goes actively exploited, AI coding assistants...
- News
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patch Available
A critical unpatched remote code execution flaw in Alibaba's Fastjson 1.x library is being actively exploited in the wild. Tracked as CVE-2026-16723, the...
- News
Fastjson 1.x RCE Actively Exploited With No Patch Available
Attackers are actively exploiting CVE-2026-16723, a critical remote code execution flaw in Alibaba's Fastjson 1.x library affecting Spring Boot...
- News
Steam Forum ClickFix Attacks Infect Gamers with XMRig Cryptominers
Threat actors are hijacking Steam discussion threads to pose as helpful community members, tricking frustrated gamers into running malicious PowerShell...
- News
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
Aikido Security's AI pentest agents audited NodeBB forum software in just six hours and surfaced eight high-severity vulnerabilities — including admin...
- News
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
F5 has patched CVE-2026-42533, a critical heap buffer overflow in NGINX that allows unauthenticated remote attackers to crash worker processes and...
- News
Hackers Abuse ViPNet Software to Target Russian Government Agencies
An advanced threat actor is exploiting the ViPNet private networking suite's update mechanism via DLL sideloading to compromise Russian government,...
- News
Update Now: 7-Zip Fixes RCE Flaw Exploitable with Malicious Archives
7-Zip 26.02 patches a remote code execution vulnerability that lets attackers execute arbitrary code by convincing users to open specially crafted...
- News
WordPress Core "wp2shell" RCE Flaws Get Public Exploits — Patch Now
Public exploits have been released for the critical wp2shell remote code execution vulnerabilities in WordPress Core, putting millions of sites at...
- News
CISA Orders Immediate Patching of Actively Exploited Fortinet FortiSandbox Flaws
CISA added two critical Fortinet FortiSandbox OS command injection vulnerabilities to its KEV catalog and gave federal agencies just three days to patch,...
- News
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
A critical unauthenticated remote code execution vulnerability in WordPress core affects all 6.9 and 7.0 installations. WordPress force-pushed emergency...
- Security
CVE-2026-13221: Perl Regex Trie Overflow Produces Silent Incorrect Matches
A critical flaw in Perl through 5.43.9 causes regex alternations with more than 65,535 branches to silently produce incorrect matches, potentially...
- News
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
A critical stored XSS vulnerability in Zimbra's Classic Web Client allows attackers to deliver specially crafted emails that execute arbitrary code within...
- Security
CVE-2026-35210: OpenCTI Authorization Bypass Allows Confidence Level and Object Marking Circumvention
An authentication bypass vulnerability in OpenCTI prior to 7.260326.0 allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass...
- News
CISA Orders Feds to Prioritize Patching Langflow Auth Bypass Flaw
CISA added CVE-2026-55255, a CVSS 9.9 IDOR authorization bypass in Langflow, to its Known Exploited Vulnerabilities catalog on July 7, ordering U.S....
- Security
CVE-2025-53827: ownCloud Updater Exposes Dangerous Method (CVSS 9.1)
A critical vulnerability in ownCloud Core's Updater component exposes a dangerous method to administrators, enabling potential remote code execution on...
- News
New 'Bad Epoll' Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A use-after-free bug in the Linux kernel's epoll subsystem — CVE-2026-46242 — lets any local user escalate to root on Linux 6.4+ with ~99% reliability. A...
- News
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them.
IBM and Red Hat announced Project Lightwell — a $5 billion commitment to secure open-source supply chains using Anthropic's Mythos AI model, which found...
- News
CISA: Microsoft SharePoint RCE Flaw Now Actively Exploited
CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation of a high-severity SharePoint...
- News
Linux Foundation Unveils New Open Source Security Project Akrites
The Linux Foundation has launched Akrites, a new open source security initiative designed to give the community standardized tools and channels to report,...
- News
CISA Sets Urgent Deadline to Fix Cisco Flaw Actively Exploited in Attacks
CISA has added a Cisco Unified Communications Manager Server vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to...
- Security
CVE-2025-55017: Apache IoTDB Critical Path Traversal Vulnerability
Critical path traversal vulnerability (CVSS 9.1) in Apache IoTDB affects versions 1.0.0 through 1.3.5 and 2.0.0 through 2.0.5. Users must upgrade...
- Security
CVE-2025-64152: Apache IoTDB Second Critical Path Traversal Flaw
A second critical path traversal vulnerability (CVSS 9.1) in Apache IoTDB affects versions 1.0.0 through 1.3.5 and 2.0.0 through 2.0.6. Patch to 1.3.6 or...
- News
25-Year-Old Vulnerability Patched in Curl
Curl 8.21.0 patches 18 vulnerabilities including a 25-year-old mTLS connection reuse flaw (CVE-2026-8932) that could allow authentication bypass. With...
- News
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub released actions/checkout v7 on June 18, 2026, adding default protections that refuse to fetch fork PR code inside pull_request_target workflows —...
- News
Microsoft Says Windows 11 26H2 Is Coming Soon, Details Upgrade Process
Microsoft has confirmed Windows 11 version 26H2 as the next feature update, with devices running 24H2 and 25H2 able to upgrade via a lightweight...
- News
New Exploit Bypasses Apple's Boot Defenses, Affects Millions of iPhones
The Usbliter8 exploit targets a hardware-level flaw in Apple A12 and A13 SecureROM boot chains that cannot be patched via software updates, leaving...
- News
A Record-Breaking Patch Tuesday for June 2026
Microsoft's June 2026 Patch Tuesday addressed nearly 200 security vulnerabilities — the highest single-month patch count in the company's history —...
- News
In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum
This week's security roundup covers Apple's patch for a Beats headphones eavesdropping vulnerability, the DOT closing its investigation into Delta's...
- News
Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain
Security researchers at Paradigm Shift have published a working exploit called usbliter8 that achieves arbitrary code execution inside the SecureROM of...
- News
Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure
CVE-2026-20253, a critical unauthenticated remote code execution flaw in Splunk Enterprise, is being actively exploited in the wild just days after public...
- News
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution
F5 has released emergency security updates for two critical vulnerabilities in NGINX Open Source, including a CVSS 9.2 use-after-free flaw in the HTTP/3...
- News
ShapedPlugin Update Flow Hacked to Infect WordPress Sites
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack that distributed infected releases to paying customers via the...
- News
Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities
Both Google and Mozilla have released urgent browser updates addressing multiple memory safety vulnerabilities, including critical-severity flaws that...
- News
CISA Orders Feds to Patch Max Severity Joomla Plugin Flaw by Friday
CISA has issued an emergency directive ordering federal agencies to patch CVE-2026-48907, a maximum-severity improper access control flaw in the Widget...
- News
Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
Splunk patches CVE-2026-20253, a CVSS 9.8 critical vulnerability enabling unauthenticated file operations and remote code execution in Splunk Enterprise.
- News
LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution
Security researchers have disclosed three now-patched vulnerabilities in LangGraph — including a critical chain that enables remote code execution on...
- News
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
A high-severity path traversal flaw (CVE-2026-5027, CVSS 8.8) in the AI application builder Langflow is being actively exploited with no patch available....
- News
New Veeam Vulnerability Exposes Backup Servers to RCE Attacks
Veeam patched a critical CVE-2026-44963 flaw in Backup and Replication allowing remote code execution on domain-joined servers. CVSS 9.4 — patch immediately.
- News
Veeam Backup and Replication RCE Flaw Lets Domain Users Run Remote Code
A critical CVE-2026-44963 flaw in Veeam Backup and Replication lets low-privilege domain users achieve remote code execution on backup servers. CVSS 9.4 —...
- News
CISA: Hackers Now Exploit SolarWinds Serv-U Flaw to Crash Servers
CISA added a high-severity SolarWinds Serv-U flaw to its KEV catalog after confirming attackers are actively exploiting it to crash file transfer servers.
- News
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
Cisco has disclosed active exploitation of CVE-2026-20245, a high-severity vulnerability in Catalyst SD-WAN Manager with a CVSS score of 7.8. No patch is…
- News
OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds
OWASP has launched CVE Lite CLI, a free open-source command line tool that scans software projects in seconds to identify packages with known CVE…
- News
Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)
Redis has patched a use-after-free vulnerability in its blocking-client code that allows authenticated users to execute arbitrary OS commands on the database…
- News
Critical Windows Netlogon RCE Flaw Now Exploited in Attacks
Belgium's national cybersecurity authority (CCB) has issued an urgent warning that threat actors are actively exploiting a recently patched critical Windows…
- News
Chrome 148 Update Patches 151 Vulnerabilities Including Critical RCE Flaws
Google has released Chrome 148 with patches for 151 security vulnerabilities, including critical-severity flaws that could allow remote code execution....
- Security
CVE-2026-35676: phpMyFAQ Unauthenticated Password Reset Vulnerability
phpMyFAQ before 4.1.3 contains a CVSS 8.2 flaw allowing unauthenticated attackers to reset any account password without token validation, enabling full...
- News
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under "Project Lightwell"
IBM and Red Hat unveil Project Lightwell, a $5B commitment to securing open-source supply chains by fixing vulnerabilities without breaking production.
- News
CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw
CISA's emergency directive gives federal agencies four days to patch the actively exploited LiteSpeed cPanel plugin flaw being weaponized in the wild.
- News
Microsoft: Domain Controller Lookup May Fail on Windows
Microsoft has confirmed a new known issue affecting Windows Server 2016 systems where domain controller lookups fail after installing the KB5087537 May 2026.
- News
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across
Microsoft has released updates fixing CVE-2026-45659, a CVSS 8.8 remote code execution vulnerability in SharePoint Server that requires no specialized.
- News
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
CISA has added CVE-2026-9082, a SQL injection vulnerability in Drupal Core, to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild...
- News
Ubiquiti Patches Three Max-Severity UniFi OS Vulnerabilities
Ubiquiti has released security updates fixing three CVSS 10.0 vulnerabilities in UniFi OS that allow unauthenticated remote attackers to fully compromise...
- News
Drupal Patches Highly Critical Vulnerability Exposing
Drupal has released an urgent security update for CVE-2026-9082, a highly critical flaw that can be exploited without authentication to achieve...
- News
Socket Raises $60 Million at $1 Billion Valuation
Supply chain security startup Socket has raised $60 million in a new funding round, valuing the company at $1 billion. The capital will expand Socket's...
- News
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL
A coordinated wave of critical security patches landed this week from Ivanti, Fortinet, SAP, VMware, and n8n. Topping the list is CVE-2026-8043 in Ivanti...
- News
Cisco Catalyst SD-WAN Controller Auth Bypass Actively
Cisco has patched a maximum-severity authentication bypass flaw in its Catalyst SD-WAN Controller that has already been exploited in limited attacks....
- News
Microsoft Rejects Critical Azure Vulnerability Report, No
A security researcher claims Microsoft silently patched an Azure Backup for AKS vulnerability after rejecting his disclosure report — issuing no CVE and...
- News
PoC Code Published for Critical NGINX Vulnerability
A proof-of-concept exploit has been released for a critical-severity NGINX vulnerability that has existed in the rewrite module for nearly two decades....
- News
TanStack Supply Chain Attack Hits Two OpenAI Employee
OpenAI has disclosed that two corporate employee devices were compromised via the Mini Shai-Hulud supply chain attack on the TanStack npm ecosystem,...
- Security
CVE-2026-42457: vCluster Platform Stored XSS via templateRef Name Field
A stored cross-site scripting vulnerability in vCluster Platform allows attackers to inject and execute arbitrary JavaScript via the name field of a...
- News
OpenAI Asks macOS Users to Update After TanStack npm Supply
OpenAI is urging macOS users to update their software following an expanding supply chain attack that compromised TanStack and additional npm and PyPI...
- News
ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI
This week's threat roundup covers an actively exploited PAN-OS RCE granting root access, Anthropic's Mythos AI finding a cURL memory safety bug, AI...
- News
Microsoft May 2026 Patch Tuesday: 137 Flaws Fixed, Zero
Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities including nine critical flaws — but for the first time in two years, not a single...
- News
Microsoft Patches 138 Vulnerabilities Including DNS and Netlogon RCE Flaws
Microsoft's May 2026 Patch Tuesday addresses 138 security vulnerabilities across its product portfolio, including 30 rated Critical — with notable DNS...
- News
New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution
Exim has released security updates to patch a severe vulnerability affecting GnuTLS-compiled builds of the world's most widely deployed mail transfer...
- News
Fortinet Warns of Critical RCE Flaws in FortiSandbox and FortiAuthenticator
Fortinet has released emergency security patches for two critical vulnerabilities in FortiSandbox and FortiAuthenticator that could enable attackers to...
- News
SAP Fixes Critical Vulnerabilities in Commerce Cloud and S/4HANA
SAP's May 2026 Security Patch Day addresses 15 vulnerabilities across multiple enterprise products, including two critical-severity flaws in Commerce...
- Security
CVE-2026-28872: Apple iOS & iPadOS Remote Denial-of-Service
A CVSS 7.5 denial-of-service vulnerability in Apple iOS and iPadOS allows a remote attacker to exhaust device resources and crash the operating system...
- News
Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS
The Apache Software Foundation has released urgent security updates for the Apache HTTP Server addressing a severe vulnerability in the HTTP/2 protocol...
- News
cPanel & WHM Release Fixes for Three New Vulnerabilities
cPanel has released security updates addressing three vulnerabilities in cPanel and Web Host Manager (WHM), including flaws enabling privilege escalation,...
- News
Google Fixes CVSS 10 Gemini CLI RCE and Cursor Flaws Enable
Google has patched a maximum severity vulnerability in its Gemini CLI npm package and GitHub Actions workflow that allowed unprivileged attackers to...
- News
cPanel & WHM Emergency Update Fixes Critical Auth Bypass Bug
cPanel and WebHost Manager have released an emergency patch for a critical authentication bypass vulnerability that allows attackers to gain control panel...
- News
GitHub Fixes RCE Flaw That Gave Access to Millions of Private Repos
GitHub has patched CVE-2026-3854, a critical remote code execution vulnerability exploitable via a single HTTP request that could have granted attackers...
- News
Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE
Cybersecurity researchers have disclosed CVE-2026-25874, a critical unauthenticated remote code execution vulnerability (CVSS 9.3) in Hugging Face's...
- News
Firefox Vulnerability Allows Tor User Fingerprinting Across
A high-severity Firefox vulnerability (CVE-2026-6770) exploits the internal ordering of IndexedDB database names to generate a stable 44-bit fingerprint...
- News
Incomplete Windows Patch Opens Door to Zero-Click Attacks
A Microsoft Windows vulnerability originally patched in a prior Patch Tuesday was incompletely remediated, leaving a residual attack surface that...
- News
Microsoft Now Lets Admins Uninstall Copilot on Enterprise
Following the April 2026 Patch Tuesday, Microsoft has made broadly available a new MDM policy setting that enables IT administrators to fully uninstall...
- News
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse
This week's ThreatsDay Bulletin covers the $290M KelpDAO DeFi hack tied to Lazarus Group, new macOS living-off-the-land attack techniques, ProxySmart SIM...
- News
Windows Update Gets New Controls to Reduce Forced Restarts
Microsoft is rolling out Windows Update improvements that give users more control over how updates are installed while reducing disruption from frequent...
- News
Microsoft Releases Emergency Updates to Fix Windows Server
Microsoft released out-of-band updates to address critical issues affecting Windows Server systems that emerged after the installation of April 2026 Patch...
- News
Microsoft Teams Right-Click Paste Broken by Edge Update Bug
Microsoft has acknowledged that a recent Microsoft Edge browser update introduced a regression that breaks right-click paste functionality in the...
- News
CISA Flags Apache ActiveMQ Flaw as Actively Exploited in Attacks
CISA has added a high-severity Apache ActiveMQ vulnerability to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the...
- News
Google Blocks 8.3B Policy-Violating Ads in 2025, Launches
Google removed over 8.3 billion policy-violating ads and suspended 24.9 million accounts in 2025, while simultaneously rolling out sweeping Android 17...
- Security
CVE-2026-34578: OPNsense LDAP Injection Enables Auth Bypass
A high-severity LDAP injection vulnerability in OPNsense's authentication connector allows unauthenticated attackers to bypass login controls by injecting...
- News
Microsoft Suspends Dev Accounts for High-Profile Open
Microsoft has suspended developer accounts used to maintain several prominent open-source projects without prior notice or a quick reinstatement path,...
- Security
CVE-2026-39860: Nix Symlink Attack Allows Root File
A bypass of the CVE-2024-27297 patch in the Nix package manager allows attackers to follow symlinks during fixed-output derivation builds, enabling...
- Security
CVE-2026-35392: Critical Path Traversal in goshs Go HTTP
A critical CVSS 9.8 path traversal vulnerability in goshs, a SimpleHTTPServer written in Go, allows unauthenticated attackers to write arbitrary files via...
- News
Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS
Fortinet has released emergency out-of-band patches for CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS that enables...
- News
New FortiClient EMS Flaw Exploited in Attacks, Emergency
Fortinet has released an emergency weekend security update for CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS that is...
- Security
CVE-2026-33615: Critical Unauthenticated SQL Injection in setinfo Endpoint
A critical unauthenticated SQL injection vulnerability (CVSS 9.1) in the setinfo endpoint allows remote attackers to corrupt data and cause denial of...
- News
Cisco Patches Critical and High-Severity Vulnerabilities
Cisco has released security advisories addressing a batch of critical and high-severity vulnerabilities across multiple products, covering flaws that...
- News
Apple Expands iOS 18 Updates to More iPhones to Block
Apple has extended security update eligibility to additional iPhone models still running iOS 18, enabling more devices to receive protections against the...
- News
CISA Orders Feds to Patch Actively Exploited Citrix Flaw by Thursday
CISA has issued a mandatory patching directive ordering all U.S. federal agencies to apply Citrix NetScaler security updates by Thursday, March 5, 2026,...
- News
Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
A newly observed ClickFix campaign impersonates Cloudflare's CAPTCHA verification pages to deliver the Python-based Infiniti Stealer to macOS users via a...
- Security
CVE-2026-33875: Gematik Authenticator Authentication Flow
A critical vulnerability in Gematik Authenticator prior to version 4.16.0 allows attackers to hijack authentication sessions via malicious deep links,...
- News
Critical Unpatched GNU Telnetd Flaw (CVE-2026-32746)
Researchers have disclosed a critical unauthenticated remote code execution vulnerability in the GNU InetUtils telnet daemon (telnetd). CVE-2026-32746...
- News
Windows 11 February Update Breaks C:\ Drive Access on Samsung PCs
Microsoft is investigating a new bug affecting Samsung laptops after the February 2026 security update — some users are unable to access their C: drive...
- News
Microsoft Releases Windows 11 OOB Hotpatch to Fix Three
Microsoft has pushed an out-of-band hotpatch (KB5084597) to Windows 11 Enterprise devices to address three integer-overflow RCE flaws in RRAS, one rated...
- News
Veeam Patches Five Critical RCE Vulnerabilities Exposing
Veeam Software has released a critical security update for Backup & Replication, patching five remote code execution vulnerabilities with CVSS scores...
- News
CISA Orders Federal Agencies to Patch n8n RCE Flaw
CISA mandated all federal civilian agencies patch CVE-2025-68613, a CVSS 9.9 remote code execution flaw in the n8n workflow automation platform, after...
- News
Researchers Disclose Critical n8n Flaws Enabling RCE and Credential Theft
Security researchers have published details of two newly patched critical vulnerabilities in n8n — CVE-2026-27577 (CVSS 9.4), an expression sandbox escape...
- Security
CVE-2026-29067: ZITADEL Password Reset Poisoned by Host Header Injection
A high-severity host header injection vulnerability in ZITADEL's login V2 password reset flow allows attackers to redirect reset links to...
- Security
CVE-2026-29192: ZITADEL Stored XSS via Default Redirect URI
A stored cross-site scripting vulnerability in ZITADEL's login V2 interface allows organization administrators to inject malicious JavaScript via a...
- News
Tirith: New Open-Source Tool Blocks Homoglyph Attacks
A new cross-platform tool called Tirith hooks into terminal shells to detect and block Unicode homoglyph attacks, pipe-to-shell exploits, and supply chain...