News archive Page 10
918 articles · sorted newest first · page 10 of 39
Looking for a specific story? Search and filter the full archive.
Arista VeloCloud CVSS 10.0 Flaw Added to CISA KEV
CISA added CVE-2026-93952, a CVSS 10.0 unauthenticated RCE flaw in Arista VeloCloud Orchestrator, to its KEV catalog September 22. Federal agencies have until September 25 to patch.
New Windows Defender Zero-Day Blocks AV Updates
Naceri released BigDiskBuster, a zero-day PoC that blocks Windows Defender from updating on all supported Windows. No patch and no CVE assigned.
WordPress Core XSS Flaw Enables RCE via Admin Sessions
Stored XSS in WordPress core lets anonymous visitors plant scripts in comments. An admin viewing the page can trigger remote code execution.
Zyxel, Veeam Flaws Confirmed Under Active Exploitation
CISA added Zyxel GS1900 CVE-2026-7273 to its KEV catalog September 21. Veeam Agent CVE-2026-32996 also actively exploited. Patches available for both.
ShinyHunters Extorts Cl0p, Victim Data at Risk
ShinyHunters set an eight-figure ransom demand against Cl0p and threatened to publish records identifying companies that paid the ransomware gang.
BigCommerce Merchants Breached via Ribon App Credentials
Attackers compromised API keys for third-party Ribon loyalty apps and used them to inject scripts into BigCommerce storefronts, exposing customer contact data from Sept 13-17.
CrowdSec Source Code Stolen in TanStack Attack
CrowdSec confirmed its source code was stolen, attributing the breach to the May 2026 TanStack JavaScript supply chain compromise. No vulnerability disclosed yet.
Red Hat Patches Four Keycloak IAM Flaws
Red Hat issued advisories for four Keycloak CVEs: admin API cache, authorization services exposure, UMA token confusion, and session enforcement bypass.
Jade Sleet Hits Indian IT Firm with Custom Backdoors
North Korea's Jade Sleet has compromised an India-based IT services provider, deploying the FLATROOF and ROOFDECK backdoors to position inside customer networks.
CVE-2026-94185: nvm Alias Path Traversal, Update Now
nvm before 0.40.8 has a path traversal in alias resolution. GHSA-8grh-q73j-ffrc rates it CVSS 5.5, but the real exposure depends on your build environment.
REDCap Patches CVSS 9.8 Unauth RCE via Survey Route
CVE-2026-90817 (CVSS 9.8): unauthenticated RCE in REDCap via the public survey endpoint. Arbitrary code execution on clinical research servers without credentials.
kcp Front-Proxy Lets Attackers Impersonate Any User
CVE-2026-61682 (CVSS 9.9): kcp front-proxy passes X-Remote-User headers through, enabling user impersonation. Fixed in 0.31.4 and 0.32.2.
Icinga 2 Patches CVSS 9.8 Auth Bypass and Stack Overflow
Icinga 2 patches CVSS 9.8 cluster node injection (CVE-2026-61550) and CVSS 8.6 stack overflow (CVE-2026-61551). Upgrade to 2.14.9, 2.15.4, or 2.16.2.
BragJack PoC Hijacks AI Browser Agents via Extensions
A PoC from security researcher Gal Weizman shows a single malicious extension can intercept and manipulate AI assistants in Chrome, Edge, and other browsers.
SolarWinds ARM Hard-Coded Key Allows Unauthenticated RCE
CVE-2026-28326 (CVSS 8.8) in SolarWinds Access Rights Manager through 2026.2 lets unauthenticated attackers execute code. Patch ARM 2026.2.1 is available now.
ShinyHunters Breaches Clop Tor Site, Steals Onion Keys
ShinyHunters defaced Clop's data leak site Friday via a Grav CMS upload flaw, claiming server data and private onion keys. A 72-hour extortion deadline is running.
Microsoft Fabric Auth Bypass Reaches CVSS 10.0
Microsoft patched CVE-2026-69843, a CVSS 10.0 authentication bypass in Fabric that let unauthenticated attackers elevate privileges over a network.
Microsoft Fixes CVSS 10.0 Flaw in Azure AI Foundry
Microsoft patched CVE-2026-85889, a CVSS 10.0 missing-authentication flaw in Azure AI Foundry that let unauthenticated attackers escalate privileges. No customer action required.
WaterPlum: North Korea Targets Job Seekers, 30K Devices Hit
FBI and four allies confirm North Korea's WaterPlum campaign infected 30,000 devices across 100 countries via fake job interviews.
CISA Adds Three Exploited Linux Kernel Flaws to KEV
CISA added CVE-2025-39682 (CVSS 9.8), CVE-2026-53266, and CVE-2025-39964 to KEV on Sept. 18. All three actively exploited. Federal deadline: Sept. 21.
Gyazo Breach Exposes 23M Records and OAuth Tokens
Helpfeel confirms 23.6 million Gyazo accounts breached September 11, exposing Google and X OAuth tokens. Revoke app access before changing passwords.
Ransomware Attacks on Manufacturers Rise 39.7% in Seven Months
Black Kite counted 1,183 publicly disclosed manufacturing ransomware victims from January through July 2026, up 39.7% from the same period in 2025.
Orkes Conductor RCE CVE-2026-58138 Exploited in Attacks
Attackers are exploiting CVE-2026-58138, a CVSS 9.8 unauthenticated RCE in Orkes Conductor triggered via crafted inline workflow definitions.
Unbound 1.26.1 Fixes Critical DNSSEC Heap Overflow
NLnet Labs patches a critical DNSSEC heap overflow in Unbound. All versions before 1.26.1 are affected; RCE is possible via attacker-controlled DNS zones.