Viettel Cyber Security (Organization): news timeline & CVEs

Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws

Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.

Google released Chrome 154 to the Stable channel, fixing 108 security vulnerabilities including 11 critical flaws. The critical bugs involve memory-safety issues in the ANGLE, GPU, and WebGL components, which could allow code execution or sandbox escapes. Organizations should prioritize deployment as exploit details may remain restricted until patches are widely adopted.

GBHackersSep 23, 09:02 UTC · 4d agoVulnerability CVE-2026-95350 CVE-2026-95357 CVE-2026-95339+8 CVEs

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.

WordPress released version 7.1.2 to address a critical unauthenticated path traversal vulnerability (CVE-2026-87902). The flaw allows an attacker to load and execute arbitrary PHP files from outside the site's active theme folders, potentially leading to remote code execution. All WordPress versions from 4.7.0 through 7.1.1 are affected, and users should update immediately.

Help Net Securityupdated Sep 26, 07:42 UTC · 1d agofirst Sep 23, 09:01 UTC · 4d agoVulnerability 16 sources CVE-2026-87902

Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code

CVE-2026-65660 allows authenticated low-privilege users to execute arbitrary code on vulnerable on-premises Microsoft SharePoint servers via a SafeControls bypass.

CVE-2026-65660 is an authenticated remote code execution vulnerability in Microsoft SharePoint Server 2016, 2019, and Subscription Edition. It allows low-privileged users to bypass SafeControls protections via a parsing flaw in the ToolPane logic, enabling the deployment of fileless webshells through .NET deserialization. Microsoft released patches on August 11, 2026, and while no exploitation has been confirmed, the detailed research warrants immediate remediation.

GBHackersupdated Sep 24, 17:12 UTC · 2d agofirst Sep 23, 08:53 UTC · 4d agoVulnerability 4 sources CVE-2026-65660

Microsoft SharePoint Flaw Lets Attackers Execute Code Remotely With Low Privileges

Microsoft patched CVE-2026-65660, an authenticated SharePoint Server remote code execution flaw scored 8.8.

Microsoft confirmed CVE-2026-65660, a CVSS 8.8 code-injection flaw in on-premises SharePoint Server 2016, 2019, and Subscription Edition. An authenticated, low-privileged attacker can run arbitrary code over the network without user interaction. Viettel Cyber Security described a SafeControls bypass in ToolPane Register-directive handling that can reach in-memory code execution, and public research includes working exploit markup. Fixes were released on August 11, 2026; Microsoft said the vulnerability had not been exploited, while a separate anonymous-access chain was closed in a June update.

Cyber Security Newsupdated Sep 24, 17:12 UTC · 2d agofirst Sep 22, 13:59 UTC · 4d agoVulnerability 4 sources CVE-2026-65660

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

Researchers show SharePoint CVE-2026-65660 enables authenticated RCE, despite Microsoft first listing it as spoofing.

Viettel Cyber Security researcher Dinh Ho Anh Khoa published details showing CVE-2026-65660, which Microsoft's advisory called a spoofing issue scored 6.5, is authenticated remote code execution; NVD scores it 8.8 and both records cite CWE-94. SharePoint ToolPane rebuilds Register directives without escaping quotes, so an authorized attacker can register arbitrary .NET classes after the SafeControls check and execute code through XamlServices.Parse(), including an in-memory webshell. The bug affects SharePoint Server 2016, 2019, and Subscription Edition and was patched in the August 11 updates, which also disable the vulnerable function by default. No exploitation of CVE-2026-65660 is reported and it is not in CISA's KEV catalog; a separate authentication bypass, CVE-2026-55040, was fixed on June 9.

The Hacker Newsupdated Sep 24, 17:12 UTC · 2d agofirst Sep 22, 11:17 UTC · 4d agoExploit / PoC 4 sources CVE-2026-65660 CVE-2026-55040

Viettel Cyber Security

Timeline5 articles

Related CVEsby mentions

Appears with

Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code

Microsoft SharePoint Flaw Lets Attackers Execute Code Remotely With Low Privileges

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE