Cyber CrimeNewChina-Linked Chain Roots 25 PAN Firewalls
A suspected Chinese state actor chained PHP2Shell with a Linux kernel flaw to gain root on 25 Palo Alto servers, including a US government domain.
> Search
30 results for “cve”
Cyber CrimeNew
Cyber CrimeDarkSword Kit Grows a Wallet-Stealing Arm
A new P7 DarkSword variant trims its on-device footprint while adding keychain theft, crypto-wallet extraction, and two-way command control.
Cyber CrimeJapan's Web Data Leaks Surge as APIs Abused
JPCERT/CC reports a sharp rise in personal data leaks at Japanese organizations, tied to mobile API abuse and a Metabase flaw.
SecurityNew SonicWall Flaw Hits VPN Gateways
SonicWall issued hotfixes for a maximum-severity SSRF bug in SMA1000 appliances, urging customers to upgrade before attackers take note.
SecurityAtlassian's unpatched datacenter flaw
Atlassian warns datacenter users to patch a 9.3-rated arbitrary file access flaw or pull instances off the internet.
SecurityDell's 18 Flaws Open Storage to Attackers
Dell has patched 18 CVEs in its storage and update tools, including two maximum-severity flaws with no workarounds.
SecurityExchange Flaw Opens Mailboxes to Insiders
Microsoft pushed out-of-band fixes for CVE-2026-96940, a high-severity Exchange Server authorization flaw rated 8.8.
Cyber CrimeCling Botnet Hides Commands in STUN Traffic
New botnet abuses common STUN protocol and public servers to blend command-and-control with legitimate NAT-traversal activity.
Cyber CrimeRCE flaw in Rejetto HFS now exploited
Attackers are exploiting CVE-2026-61500 in Rejetto HFS to bypass authentication and gain remote code execution, according to VulnCheck.
SecurityGitLab's 9.9 Gateway Flaw: Self-Hosters First
GitLab patched a critical AI Gateway flaw scoring 9.9, but the fix only reaches organizations running their own gateway.
Cyber CrimeFortinet Zero-Day Hits FortiMail Gateways
Fortinet reports active exploitation of a critical FortiMail flaw, with patches still pending and CISA ordering federal fixes by October 4th.
SecurityCisco WAN Manager Flaw Opens Admin Door
A critical authentication bypass in Cisco Catalyst SD-WAN Manager let attackers reach an admin API, and the fix requires an upgrade.
SecurityZimbra Flaw Exploited Before Disclosure
Microsoft says attackers probed and exploited a Zimbra command injection flaw in the window between patch release and public disclosure.
Cyber CrimeZimbra Bug Exploited for Mailbox Theft
Microsoft says attackers chained a patched Zimbra command-injection flaw into web shells, credential theft and cloud exfiltration.
SecurityF5 zero-day hits BIG-IP APM deployments
F5 patched a critical BIG-IP APM zero-day exploited in remote code execution attacks, as CISA ordered federal agencies to secure networks by Friday.
SecurityWordPress 7.1.2 Patches Critical LFI-to-RCE Flaw
WordPress fixed a critical flaw in versions 4.7.0 through 7.1.1 that can lead to code execution on servers lacking a page-prefixed theme folder and register_argc_argv off.
SecurityArista VeloCloud Flaw Exploited, Scores 10.0
Arista says attackers are actively exploiting CVE-2026-93952, a maximum-severity flaw in on-premises VeloCloud Orchestrator setups using certificate authentication.
SecurityCheck Point's Fifth Critical Flaw Since July
A new 9.8-severity stack overflow lets unauthenticated attackers hit Security Management Servers as root, and it's not the first this summer.
SecurityDocker Fixes macOS Sandbox Escape Flaws
Two Docker Sandboxes vulnerabilities let malicious guest code read or modify macOS host files, with fixes shipped in version 0.42.0.
SecurityUnbound DNSSEC Flaw Opens RCE Path
A heap overflow in Unbound's DNSSEC validator lets attackers who control a malicious DNS zone trigger remote code execution on vulnerable resolvers.
SecurityAcronis Backup Plugin Flaw Exploited
Acronis has disclosed CVE-2026-87886, a high-severity Linux privilege-escalation flaw in its cPanel and Plesk backup plugins, citing limited in-the-wild attacks.
SecurityLiteSpeed Enterprise Flaw Risks Root on Shared Hosts
cPanel warns a LiteSpeed Web Server Enterprise bug could let one hosting account gain root on shared servers, with no CVE assigned.
Cyber CrimeCisco Email Gateway Flaw Under Attack
Cisco warns CVE-2026-76461, a CVSS 9.8 flaw in Secure Email Gateway, is being exploited to run commands as root, with a federal patch deadline of September 17.
SecurityGitLab's Perfect 10 Flaw Exposes Secrets
A maximum-severity path traversal bug in GitLab's repository commits API lets unauthenticated attackers read arbitrary files, and probes are already underway.
Cyber CrimeMeshCentral Backdoor Hid Inside 3BB Network
Hunt.io says an attacker used a legitimate remote-management tool to hold root access inside Thailand's 3BB and target subscriber credentials.
SecurityMarimo RCE Hit by Human at Machine Speed
Sysdig says a hand-built toolkit let a human operator exploit a Marimo flaw in eight seconds, without any sign of LLM use.
SecurityDutch NCSC warns Check Point VPN flaws
Dutch NCSC warns two critical Check Point VPN flaws could be exploited soon, after fixes shipped on September 9.
Cyber CrimeTencent Patch Leaves Sogou Browser Exposed
A one-click flaw in Sogou Input Method allowed UNC3569 to deploy GrayRabbit malware, but the underlying Chromium engine remains outdated and unsandboxed.
SecurityGitLab's Patch Race Against Active Exploits
GitLab patches a maximum-severity path traversal flaw and a critical EE deserialization bug as researchers report in-the-wild probing within hours.
Cyber CrimeArtifactory Flaws Chained Into Admin Backdoors
Wiz reports attackers chained two Artifactory token flaws to seize admin control and plant backdoors, while a third flaw was exploited separately.