Ransomwarecritical
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
- CVEs
- CVE-2026-50746CVE-2026-50747CVE-2026-50748CVE-2026-54400CVE-2026-55115CVE-2026-54402CVE-2026-55116CVE-2026-40138CVE-2026-40139CVE-2026-40140CVE-2026-40141CVE-2026-11405CVE-2026-43499CVE-2026-46215CVE-2026-53359CVE-2026-52830CVE-2026-57992CVE-2026-11712CVE-2026-11708CVE-2026-11595CVE-2026-12184CVE-2026-14355CVE-2026-52761CVE-2026-52747CVE-2026-14898CVE-2026-13753CVE-2026-10706CVE-2026-10708CVE-2026-15112CVE-2026-15129CVE-2026-12116CVE-2026-14261CVE-2026-13461CVE-2026-13462CVE-2026-0288CVE-2026-47291CVE-2026-15146CVE-2026-31694CVE-2026-54432CVE-2026-14544CVE-2026-13126CVE-2026-57260CVE-2026-57248CVE-2026-57246CVE-2026-6896CVE-2026-13320CVE-2025-14179CVE-2025-14180
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-14179 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes… | 7.4 | <1% | ||
| CVE-2025-14180 | In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver… | 8.2 | <1% | PoC | |
| CVE-2026-0288 | Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated… | 7.2 | <1% | ||
| CVE-2026-10706 | In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via… | 7.5 | <1% | ||
| CVE-2026-10708 | This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets | 7.5 | <1% | ||
| CVE-2026-11405 | The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8 | 9.8 | <1% | ||
CVE-2026-11708+2 related CVEs | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system | 9.3 group max | <1% | ||
| CVE-2026-12116 | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP… | 9.8 | <1% | ||
CVE-2026-13126+3 related CVEs | The embedded JavaScript in the PDF deleted the pages, making the object invalid | 7.8 | <1% | ||
CVE-2026-6896+1 related CVE | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain… | 5.4 | <1% | ||
| CVE-2026-13461 | When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app | 9.6 | <1% | ||
| CVE-2026-13462 | PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews | 7.5 | <1% | ||
| CVE-2026-13753 | Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive… | 7.5 | <1% | ||
| CVE-2026-14261 | A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling… | 9.1 | 1% | ||
| CVE-2026-14355 | In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL… | 5.3 | <1% | ||
| CVE-2026-14544 | HPLIP (HP Linux Imaging and Printing Software): This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary… | 9.8 | <1% | ||
| CVE-2026-14898 | The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses | 6.5 | <1% | ||
CVE-2026-15112+1 related CVE | Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 8.8 | <1% | ||
| CVE-2026-15146 | GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode | 5.9 | <1% | ||
| CVE-2026-31694 | Linux kernel: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size… | 7.8 | <1% | PoC | |
CVE-2026-40139+3 related CVEs | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support | 9.2 group max | <1% | ||
| CVE-2026-43499 | Linux kernel: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock… | 7.8 | <1% | PoC ×19 | |
| CVE-2026-46215 | Linux kernel: drm: Set old handle to NULL before prime swap in change_handle | 7.8 | <1% | ||
| CVE-2026-47291 | Unauthenticated RCE via Integer Overflow in Windows HTTP.sys | 9.8 | 23% | ||
| CVE-2026-50746 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command… | 10.0 | 2% | ||
| CVE-2026-50747 | A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk… | 9.9 | <1% | ||
CVE-2026-50748+1 related CVE | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to… | 9.9 group max | 2% | ||
CVE-2026-52747+1 related CVE | ModSecurity: The multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field… | 8.6 group max | <1% | PoC | |
| CVE-2026-52830 | fast-mcp-telegram is a Telegram MCP Server | 9.4 | <1% | ||
| CVE-2026-53359 | Linux kernel: KVM: x86 | 8.8 | <1% | ||
| CVE-2026-54402 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command… | 8.8 | 2% | ||
| CVE-2026-54432 | Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS) | 4.7 | <1% | ||
| CVE-2026-55115 | A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate… | 9.9 | <1% | ||
| CVE-2026-55116 | A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain… | 9.8 | <1% | ||
| CVE-2026-57992 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network | 7.5 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | braintree.net | t Package Delivers Skimmer — A malicious .NET package named Braintree.Net has been found to impersonate Braintree's legitimate Braint |
From the original article
11 min read at thehackernews.com
Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.