News archive Page 4
918 articles · sorted newest first · page 4 of 39
Looking for a specific story? Search and filter the full archive.
PHP Warns of New Unpatched RCE, No Patch Available
PHP's security team disclosed a new RCE flaw affecting non-default server configurations. No patch is out; mitigation guidance has been published.
Atlassian October Bulletin Covers 75 Flaws, 14 Critical
Atlassian patches 75 flaws in its October bulletin, 14 rated critical, all in third-party components shipped with Data Center and Server products.
Quest Diagnostics Discloses Patient Data Breach
Quest Diagnostics filed a regulatory notice confirming unauthorized access to its Quanum Lab Services Manager, with certain patient records among the data exposed.
Cisco Patches 34 CVEs, Six Critical Across Products
Cisco released patches for 34 CVEs across Expressway, Unified Communications, and Snort 3. Six are critical-severity; no exploitation confirmed.
Two CVSS 9.0 RCEs Hit KSMBD, No Kernel Patch Ready
Trend Micro ZDI disclosed two CVSS 9.0 RCEs in Linux's KSMBD SMB server before kernel patches exist. The more severe flaw requires no authentication.
Arista VeloCloud Zero-Day CVE-2026-114625 Exploited
A CVSS 9.9 SQL injection flaw in Arista VeloCloud Orchestrator on-prem is under active attack. Patches are out. Hosted instances are already fixed.
QPACK Flaws Let Attackers Crash HTTP/3 Servers
FoxIO disclosed QPACK header decompression bugs in multiple HTTP/3 stacks. Attackers can trigger up to 4,000x memory amplification from a single connection. Patches are available for quic-go, Cloudflare quiche, and lsquic.
Interpol Arrests 1,462 in Operation Serengeti III
Interpol and 21 African nations disrupted nearly 11,000 malicious networks and arrested 1,462 suspects in a two-month cybercrime sweep targeting BEC, ransomware, and fraud.
Storm-0940 Hits ConnectWise Cloud Backup with AI Attacks
Microsoft linked Storm-0940 to a ConnectWise supply chain compromise using ARTEX, an AI attack tool that ran automated intrusion at machine speed.
GitLab CVSS 10.0 Regex Flaw Hits 12 Years of Releases
CVE-2026-110264 enables unauthenticated RCE on self-managed GitLab servers back to version 7.0. Emergency patches are out; update to a fixed release now.
PHP2Shell Exploits Begin as Patches Hit Servers
Emergency patches for CVE-2026-109618 and CVE-2026-109619 are deployed, but exploitation attempts are already hitting sensors as organizations race to update.
CISA Adds Plex2Shell, Siemens, SiteGuard to KEV
CISA added exploited flaws from Plex Media Server, Siemens Software Center, and SiteGuard to its KEV catalog. The Plex2Shell chain is under mass attack now.
FBI, CISA: SafePay Hit 600+ Critical Infra Orgs
A joint FBI, CISA, and allied agency advisory confirms SafePay ransomware has compromised over 600 critical infrastructure organizations worldwide since 2024, targeting via credential stuffing, phishing, and unpatched vulnerabilities.
PoC Released for Critical FortiSIEM RCE Flaw
Horizon3.ai released a PoC for CVE-2026-106173, a CVSS 9.8 unauthenticated RCE in Fortinet FortiSIEM. Patches have been available since October 14.
PHP Issues Emergency Patches for Two Critical RCEs
PHP announced emergency patches for two critical RCE flaws on October 21. The fixes are now available for PHP 8.2 through 8.5; see our follow-up for current guidance.
Browsers Block eMudhra After Eight CA Keys Exposed
Eight eMudhra CA certificates were revoked after researchers found the private keys trivially recoverable. All major browsers have pushed revocation updates.
Archibus Patches Triple Flaw: Auth Bypass, File Upload RCE
Rapid7 disclosed three Archibus vulnerabilities including a CVSS 9.6 unrestricted file upload. All three are patched in Archibus 2025.02.
Plex2Shell Exploited to Deploy Miners, Linux Backdoor
Attackers exploited a five-CVE chain in Plex Media Server within 24 hours of a public PoC, loading unpatched servers with XMRig miners and a Linux proxy backdoor.
Siemens Software Center Flaw Abused in ClickFix Campaign
A CVSS 6.7 DLL sideloading flaw in Siemens Software Center is being exploited through ClickFix lures that bundle the legitimate signed binary with attacker DLLs.
Apache Answer CVSS 9.8 Bug Exposes Restricted Content
CVE-2026-90910: Apache Answer's reaction API skips auth checks, giving unauthenticated users access to restricted content. All versions through 2.0.2 affected.
F5 Patches Three NGINX Flaws Out of Band
F5 shipped out-of-band fixes for three NGINX flaws in the HTTP/3 module and map directive, covering NGINX Plus, Open Source, and Ingress Controller.
Drupal Core RCE Flaws: Patch Now, Exploits Coming
Drupal patches two critical RCEs in Field UI and Entity List. No exploitation confirmed yet, but exploits expected within hours of disclosure. Patch core to 11.4.10 or later.
Feds Allege Ransom Negotiator Ran ShinyHunters Site
FBI arrested Cypfer exec Edward Dubrovsky October 9 on extortion charges. Signal intercepts link him and a second unnamed executive to operating shinywire.com, the group's data leak site.
F5 Out-of-Band Patches Fix Three High-Sev NGINX Flaws
F5 patched three CVSS 8.1 flaws in NGINX Plus and Open Source on October 14, covering HTTP/3, AIO+SSI processing, and map directive handling. No exploitation confirmed.