News archive Page 9
918 articles · sorted newest first · page 9 of 39
Looking for a specific story? Search and filter the full archive.
Budibase 3.45.0 Fixes Six Security Flaws
Budibase 3.45.0 patches six CVEs including arbitrary file write (CVSS 8.8), SSO auth bypass (8.1), and SQL injection (8.0). Update now if Builder is exposed.
Citrix NetScaler: Two Unpatched RCEs Actively Exploited
Two unpatched RCEs in Citrix NetScaler ADC and Gateway are actively exploited in the wild. CVE IDs are pending assignment; Citrix expects patches by end of September 2026.
Critical File Upload Bug in WooCommerce Quote Plugin
CVE-2026-18143 is a CVSS 9.8 arbitrary file upload flaw in the Request a Quote for WooCommerce plugin through version 2.9.2. Update to 2.9.3.
SharePoint Code Injection CVE-2026-65660 Added to KEV
CISA added a SharePoint code injection flaw to its KEV catalog on September 25. CVSS 8.8, active exploitation confirmed, federal patch deadline September 28.
ShinyHunters WAF Bypass Keeps PeopleSoft Attacks Alive
ShinyHunters uses URL encoding to bypass WAF rules protecting against Oracle PeopleSoft CVE-2026-35273, continuing to deploy web shells on servers organizations thought were protected.
Elementor CSRF Flaw Lets Attackers Create Admin Accounts
A CSRF flaw in the Elementor WordPress plugin lets attackers create administrator accounts without valid credentials. Site owners should update the plugin immediately.
CISA Adds MikroTik RouterOS Chain Flaw to KEV Catalog
CISA added CVE-2026-67279 to KEV on September 25. The medium-severity flaw chains with CVE-2026-86060 to enable full unauthenticated exploitation of MikroTik RouterOS. Federal deadline is September 28.
Kiteworks Flags Potential Zero-Day, Urges Server Shutdown
Kiteworks warned customers Thursday of potential zero-day attack activity and asked them to take servers offline for a six-hour window on Saturday, September 26.
Clop Moves Leak Site After Grav CMS Attack Confirmed
Clop ransomware confirmed its Tor leak site was breached via an unpatched Grav CMS path traversal flaw. The group has migrated to a new Tor address.
U.S. Soldier Gets 70 Months for Telecom Extortion
A U.S. Army soldier sentenced to 70 months for hacking AT&T and Verizon and extorting the carriers using 100 million customers' stolen call and text metadata.
Suspected DPRK Hackers Steal $351.6M from Bitget
Bitget says suspected North Korean actors stole $351.6 million from hot and warm wallets in a backend compromise detected at 18:31 UTC on September 24.
SalesBleed: Agentforce Flaws Enable Data Exfiltration
Three SalesBleed flaws in Salesforce Agentforce allow attackers to hijack AI agents and exfiltrate data via trusted Slack channels without user interaction.
CISA KEV: WSO2 and Adobe Commerce Flaws Exploited
CISA added CVE-2026-5430 (WSO2, CVSS 10.0) and CVE-2026-71362 (Adobe Commerce, CVSS 9.1) to KEV on September 24. Federal patch deadline: September 27.
MacSync macOS Malware Abuses Public iCloud Calendars
Kaspersky found a new MacSync variant that hides C2 commands inside public iCloud calendar events, bypassing domain-based network controls on macOS.
Ryuk Member Gets 2 Years for $1.2M Ransomware Attacks
Armenian national Karen Vardanyan sentenced to 2 years in US federal prison for Ryuk ransomware attacks, ordered to pay over $1.2M in restitution to victims.
Roundcube SQL Injection Flaw Under Active Attack
Canada's CCCS confirmed active exploitation of CVE-2026-48842, a SQL injection in Roundcube Webmail patched in May. Upgrade to 1.6.16 or 1.7.1 now.
SolarWinds Fixes Two Unauth RCE Flaws in Observability
SolarWinds patches CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8), two unauthenticated RCE flaws in Observability Self-Hosted. No active exploitation reported.
CISA: Ransomware Gangs Exploiting TeamCity RCE Flaw
CISA warns federal agencies that ransomware groups are exploiting CVE-2026-63077, a CVSS 9.8 unauthenticated RCE in JetBrains TeamCity. Patch released July 28.
InfraTrust: Network Management Systems Under Attack
InfraTrust's September report finds attackers targeting network management and control infrastructure at or before patch availability. Here's what to prioritize.
WordPress Core RCE Flaw CVE-2026-87902 Under Active Exploit
WordPress core path traversal CVE-2026-87902 allows unauthenticated RCE under specific conditions. Exploitation confirmed within 24 hours. CVSS 8.1 High.
D-Link Warns CVSS 10.0 DIR-822A Flaw Has No Fix
CVE-2026-86296: CVSS 10.0 D-Link DIR-822A zero-day with public PoC exploit code and no patch. D-Link says the device is end-of-life and replacement is needed.
Check Point Patches Management Server Zero-Day
CVE-2026-93616: CVSS 9.8 Check Point Management Server flaw allows unauth script execution via path traversal. Added to CISA KEV with a Sept. 25 deadline.
F5 Patches BIG-IP APM RCE Zero-Day Under Attack
CVSS 9.8 F5 BIG-IP APM heap overflow: unauth RCE when an access policy and OAuth profile share a virtual server. Confirmed exploited; patches available.
FBI Confirms Jobs-Platform Breach, ShinyHunters Claims Data Theft
The FBI says a third-party platform supporting FBIJobs.gov was breached and has arrested a suspect. ShinyHunters' claims about the stolen data remain unverified.