Search: “PTC Windchill”

Cl0p Targets 40+ Organizations Through PTC Windchill Flaw

Cl0p claims over 40 organizations including Shell and Philips were breached by exploiting critical RCE CVE-2026-12569 in PTC Windchill and FlexPLM.

Cl0p claims more than 40 organizations were victimized via CVE-2026-12569 (CVSS 9.3), a critical deserialization-based remote code execution flaw in PTC Windchill PDMlink and FlexPLM, affecting releases prior to 11.0 M030; CISA added the flaw to its KEV catalog in June. ReliaQuest found the group deployed a custom web shell that maps vault data, decrypts all credentials in the Windchill keystore, and includes a Java class loader enabling arbitrary code execution, lateral movement, persistence, and large-scale data exfiltration without extra tooling. Named victims include Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Apple lens supplier Largan Precision, with stolen data ranging from one gigabyte to multiple terabytes per target. The campaign mirrors Cl0p's earlier mass-exploitation extortion operations against MOVEit, Cleo, GoAnywhere, and Oracle E-Business Suite.

Security Affairs·Aug 21, 07:15 UTC · 26d agoRansomware in the wildCVE-2026-12569

The long tail of Clop’s PTC hack is just beginning to emerge

Clop mass-exploited CVE-2026-12569 in PTC Windchill and FlexPLM in early June, claiming data theft from dozens of large organizations.

Clop began sending extortion emails in mid-July after exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, likely as a zero-day in early June before PTC's June 17 disclosure and patch. Confirmed victims include Toast and Zebra, while GE, Philips and Shell are among claimed victims. CISA added the flaw, which allows unauthenticated remote code execution, to its KEV catalog on June 25. ReliaQuest said the group used a custom Windchill-specific web shell for credential theft and large-scale exfiltration, echoing its past MOVEit and Oracle E-Business Suite mass-exploitation campaigns.

CyberScoop·Aug 19, 14:30 UTC · 27d agoThreat actor in the wildCVE-2026-125691

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

The Hacker News·Aug 3, 16:06 UTC · Aug 3, 2026Ransomware in the wildCVE-2026-12569

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.

The Hacker News·Aug 19, 15:27 UTC · 27d agoThreat actor in the wildCVE-2026-12569

CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks

CISA added actively exploited Fortinet CVE-2025-25249, a critical heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE, to its KEV catalog.

CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) allowing unauthorized code execution by sending specially crafted packets. CISA added it to the Known Exploited Vulnerabilities catalog on September 9, 2026, with a September 12 remediation deadline for federal agencies under BOD 26-04 and mandatory forensic triage of affected environments. Internet-facing Fortinet firewalls and SASE platforms are a likely foothold for credential theft, persistence, and lateral movement; ransomware use is currently listed as unknown.

Cyber Security News·Sep 10, 11:26 UTC · 6d agoExploit / PoC in the wild 4 sourcesCVE-2025-252492

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker News·Aug 28, 08:05 UTC · 19d agoThreat actor in the wildCVE-2026-194781

FalconFlank: CrowdStrike Falcon 0-Day PoC

A researcher published a working proof-of-concept for an alleged privilege escalation zero-day in CrowdStrike Falcon Sensor for Windows.

SOCRadar describes 'FalconFlank,' an alleged privilege escalation zero-day vulnerability in the CrowdStrike Falcon Sensor agent for Windows. The finding was published alongside working proof-of-concept code by a researcher. The available text does not state that exploitation has been observed in the wild, nor does it mention an assigned CVE.

SOCRadar·Sep 3, 14:53 UTC · 12d agoVulnerability

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 26d agoResearch2

Heap overflow in kernel driver due to missing size validation

Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.

Fortinet PSIRT advisory FG-IR-26-156, revised 2026-08-12, describes a heap-based buffer overflow (CWE-120, buffer copy without checking input size) in the FortiClient Windows kernel driver, scored CVSSv3 7.3. An unauthenticated attacker positioned to alter or craft DNS responses for a targeted host could execute arbitrary code via malicious packets. No CVE identifier or exploitation status is provided in the advisory text, so administrators should check the full bulletin for affected versions and fixed releases.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026Advisory

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded Future·Sep 8, 00:00 UTC · 8d agoVulnerability in the wildCVE-2025-62593CVE-2026-72898CVE-2026-9198+4 CVEs

SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access

Security Affairs·Aug 9, 11:05 UTC · Aug 9, 2026Threat actor1

Risky Bulletin: White House lets private companies carry out offensive cyber ops

A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.

A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.

Risky Business News·Aug 14, 04:42 UTC · Aug 14, 2026Policy & legal

Schneider Electric SCADAPack x70 Products

CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.

CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.

CISA Advisories·Sep 15, 12:00 UTC · 1d agoAdvisoryCVE-2026-81861

July 2026 CVE Landscape

Recorded Future·Aug 7, 00:00 UTC · Aug 7, 2026Ransomware in the wildCVE-2025-3248CVE-2008-4128CVE-2017-17215+78 CVEs1

CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT

Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.

SOCRadar reports that exploitation of CVE-2025-25249 is being used to deploy PivotC2, a purpose-built post-exploitation RAT, on FortiGate firewall appliances. The attack follows the common pattern of compromising public-facing edge devices such as VPNs, routers, and firewalls as the initial entry point. Defenders running FortiGate appliances should prioritize patching and watch for post-exploitation activity indicating RAT deployment.

SOCRadar·Sep 8, 10:00 UTC · 8d agoExploit / PoC in the wildCVE-2025-25249

The VMs Powering Mobile Agents (Instinct, Claude Code)

A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.

The author inspects the virtual machines hosting cloud agents: Claude Code runs in a Firecracker microVM with a custom Rust init (process_api) as PID 1, a 324 MB Bun harness on a read-only disk, and 443-only MITM'd SSE egress to api.anthropic.com with host-rotated OAuth tokens and no inbound access. Instinct rents E2B sandbox-as-a-service Firecracker microVMs (Ubuntu 22.04, 2 vCPU, 1.9 GB RAM) where agent memory is a git repo of Markdown committed by the agent and pushed to S3 as a single bundle, using short-lived STS credentials. Both platforms rely on Firecracker, differing mainly in fleet operator and guest boot configuration.

Hacker News · AI·Sep 8, 04:36 UTC · 8d agoAI tools & infraHN 58↑ · 19 comments1

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

The Hacker News·Aug 4, 10:36 UTC · Aug 4, 2026VulnerabilityCVE-2026-58048CVE-2026-58047

Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon

Researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation PoC abusing CrowdStrike Falcon's Office macro remediation; CrowdStrike is investigating and issued a tech alert.

Researcher Chaotic Eclipse published FalconFlank, a proof-of-concept zero-day local privilege escalation in CrowdStrike Falcon Sensor that abuses the Microsoft Office malicious macros remediation feature, tested on fully updated Windows 11 25H2 and Windows Server 2025. CrowdStrike said it is investigating, advised disabling the Microsoft Office File Suspicious Macro Removal policy, and pointed customers to a FalconFlank tech alert, noting cloud anti-malware protection remains active. The article also covers related PoCs from the same researcher: HardBreacher against Kaspersky (fixed via update), ShieldBreak (CVE-2026-69414) against Microsoft Defender, an unpatched patch bypass of CVE-2026-50656, GreenSection against NVIDIA, and PrettyPrague against Avast, which Gen Digital patched in versions 26.7.11086 and 26.8.11125.

The Hacker News·Sep 3, 06:26 UTC · 13d agoExploit / PoCCVE-2026-69414CVE-2026-50656

Rockwell Automation security advisory (AV26-869)

Canada's Cyber Centre flags vulnerabilities across multiple Rockwell Automation ICS products including ControlLogix 5580 and RSLinx Classic.

Canadian Centre for Cyber Security advisory AV26-869, dated September 1, 2026, lists vulnerabilities in Rockwell Automation products: 1756-ENBT Module (all versions), ArmorStart LT (v2.001 and earlier), CompactLogix 5380 / ControlLogix 5580 (V33 and earlier plus several V34-V36 releases), and RSLinx Classic (V4.50 and earlier). It references Rockwell advisories SD1792, SD1794, SD1797, and SD1798 and urges users to apply updates as available.

Canadian Centre for Cyber Security·Sep 1, 18:45 UTC · 14d agoAdvisory

Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

Researcher Nightmare Eclipse released a PoC for FalconFlank, a privilege escalation zero-day in CrowdStrike Falcon's Office macro remediation feature.

Researcher Nightmare Eclipse published a zero-day PoC dubbed FalconFlank targeting CrowdStrike Falcon's Microsoft Office malicious macro removal feature, achieving privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 with Optimal Protection and macro removal enabled. Kevin Beaumont independently confirmed the exploit works. The same researcher also released HardBreacher, an elevation-of-privilege bug in Kaspersky Endpoint (since fixed via update), PrettyPrague, an Avast Sandbox flaw that dumps the SAM database for a SYSTEM shell (Gen Digital is developing a patch), and GreenSection, an Nvidia memory corruption bug that crashes systems. CrowdStrike advises customers to disable the Suspicious Macro Removal Windows policy while it investigates.

The Register · Security·Sep 3, 18:08 UTC · 12d agoExploit / PoC

WebPros security advisory (AV26-861)

Canada's Cyber Centre relayed a cPanel advisory for CVE-2026-65643, a domain parking vulnerability fixed in multiple cPanel/WHM releases; admins should update.

Canada's Cyber Centre issued advisory AV26-861 relaying cPanel's disclosure of CVE-2026-65643, a vulnerability in cPanel's Domain Parking functionality. Affected cPanel & WebHost Manager (WHM) builds include all releases prior to 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and WP2 11.138.1.7. Administrators are urged to review vendor guidance and apply updates. No exploitation details were provided in the advisory.

Canadian Centre for Cyber Security·Aug 28, 15:10 UTC · 18d agoAdvisoryCVE-2026-65643

Mitsubishi Electric CNC Series (Update A)

CISA's updated ICS advisory details CVE-2025-2399, an out-of-bounds read in Mitsubishi Electric CNC series that lets a remote attacker cause a denial-of-service condition.

CISA released Update A of ICS advisory ICSA-26-078-05 covering Mitsubishi Electric CNC series controllers. The vulnerability CVE-2025-2399 is an out-of-bounds read that a remote attacker can exploit to trigger a denial-of-service condition. Affected products include M800VW, M800VS, M80V, M80VW, M800W, M800S and M80 series controllers up to specified firmware revisions. No exploitation is reported in the advisory.

CISA Advisories·Aug 27, 12:00 UTC · 20d agoAdvisoryCVE-2025-2399

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

cPanel patched CVE-2026-67401, an SQL injection in EmailTrack letting an account with mail privileges run code as root on the server.

cPanel released an advisory on September 8 for CVE-2026-67401, an SQL injection in EmailTrack that allows an authenticated account holder with mail-related privileges to create files and execute code as root. All supported cPanel and WHM release lines (11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9) are affected, with fixed builds published for each. No public exploit or exploitation has been reported and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog. The advisory carries no CVSS score, and the CVE record had not been published as of September 9.

The Hacker News·Sep 9, 08:19 UTC · 7d agoVulnerabilityCVE-2026-67401

New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server

cPanel disclosed critical SQL injection CVE-2026-67401 in EmailTrack, letting authenticated users with mail privileges gain root code execution; patched builds available.

cPanel disclosed CVE-2026-67401 on September 8, 2026, a critical SQL injection in the EmailTrack feature that monitors email delivery and routing. An authenticated attacker holding a valid cPanel account with mail-related privileges can create arbitrary files and achieve code execution as root, enabling full compromise of hosting servers and exposure of co-tenant customers. All supported cPanel/WHM versions before specific patched builds (11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and 11.138.1.9 WP2) are affected; upgrading is the primary mitigation. No exploitation was reported at disclosure.

Cyber Security News·Sep 9, 08:37 UTC · 7d agoVulnerabilityCVE-2026-67401

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.

Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).

Security Affairs·Aug 12, 08:08 UTC · Aug 12, 2026Exploit / PoCCVE-2026-50656

What Fal.Con 2026 Reinforced: AI Makes Proving Exposure More Important Than Ever

Horizon3's Fal.Con 2026 recap argues AI-accelerated vulnerability discovery makes continuous attacker-based exposure validation essential for defenders.

In a Fal.Con 2026 recap, Horizon3 argues that AI is compressing the time between vulnerability discovery and exploitation, making attacker-derived evidence about real exploitability the key prioritization signal. Horizon3 announced it joined CrowdStrike's Project QuiltWorks, with NodeZero exploitability intelligence flowing into Falcon Next-Gen SIEM and Falcon Fusion SOAR workflows able to trigger NodeZero 1-Click Verify for remediation testing. The company reported running over 1,200 NodeZero demos during the show, and CrowdStrike CEO George Kurtz's keynote framed AI red teaming and offense-informing-defense as central themes.

Horizon3.ai·Sep 4, 17:46 UTC · 11d agoIndustry

CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

Apache fixed CVE-2026-41870, a critical unauthenticated RCE via JEXL injection in Nutch Server's REST API affecting versions 1.11-1.22.

CVE-2026-41870 describes a critical Missing Authorization and Code Injection vulnerability in Apache Nutch Server (the Nutch REST API), enabling unauthenticated remote code execution via JEXL injection. Affected versions are Apache Nutch 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.

oss-security·Sep 8, 15:31 UTC · 7d agoVulnerability 3 sourcesCVE-2026-418701

[Control Systems] Siemens security advisory (AV26-890)

Canada's Cyber Centre relayed a Siemens advisory affecting Reyrolle 7SR5, Teamcenter, Siveillance Control, Desigo CC and other products.

Advisory AV26-890, dated September 8, 2026, flags Siemens vulnerabilities in Reyrolle 7SR5 (versions prior to V2.70), Teamcenter, Siveillance Control, SIMATIC AX Runtime, Desigo CC, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT across multiple versions and models. The Cyber Centre encourages users and administrators to review the Siemens advisory and apply available updates. No specific CVEs or exploitation details are provided in the relayed advisory.

Canadian Centre for Cyber Security·Sep 8, 17:27 UTC · 7d agoAdvisory

Researcher Publishes CrowdStrike Privilege Escalation Zero Day

Researcher NightmareEclipse published FalconFlank, a zero-day local privilege escalation in CrowdStrike Falcon Sensor abusing its Office malicious macro remediation feature.

A researcher known as Nightmare Eclipse published details of FalconFlank, a zero-day privilege escalation that abuses the Microsoft Office malicious macro removal feature in CrowdStrike Falcon Sensor, verified working on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike urged customers to disable the Office File Suspicious Macro Removal policy while it investigates, noting customers remain protected via Cloud Anti-malware for Microsoft Office Files; no CVE has been assigned. The same researcher previously released the Exploitarium dump of over 30 PoC exploits, and researcher Kevin Beaumont confirmed FalconFlank works.

Infosecurity Magazine·Sep 7, 08:28 UTC · 9d agoExploit / PoC

Arbitrary process termination from exposed minifilter communication port

Fortinet FortiClient Windows fortimon3 driver flaw (CVSS 4.7) lets authenticated attackers terminate arbitrary processes via exposed minifilter communication port.

Fortinet advisory FG-IR-26-165 discloses an unverified ownership vulnerability (CWE-283, CVSSv3 4.7) in the FortiClient Windows fortimon3 minifilter driver. An authenticated attacker can terminate arbitrary processes through an exposed minifilter communication port. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory1

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.

CVE-2026-65638 in ConfigServer Security & Firewall (CSF) 14.00–16.29 allows unauthenticated remote attackers to execute arbitrary commands via the MESSENGER service, which is exposed only when MESSENGER is enabled and a reCAPTCHA secret has been configured. Exploitation yields command execution under the unprivileged CSF service account, providing a foothold for reconnaissance, data access, or lateral movement on internet-facing cPanel/WHM hosting infrastructure. CSF 16.30 or later fixes the issue; disabling MESSENGER in /etc/csf/csf.conf and restarting csf and lfd is a temporary mitigation.

GBHackers·Sep 11, 11:20 UTC · 5d agoVulnerability 3 sourcesCVE-2026-65638

Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root

JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.

JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.

Cyber Security News·updated 13:14 UTC · 1h ago·first 09:24 UTC · 4h agoVulnerability 4 sourcesCVE-2026-90894

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.

cPanel issued patches on August 27, 2026 for CVE-2026-65643, a flaw in domain parking and addon domain functionality in cPanel & WHM that lets an authenticated account holder create arbitrary files and execute code as root, yielding full server control. Fixed builds cover the 11.110, 11.134, 11.136 and 11.138 branches, including WP Squared 11.138.1.7, and auto-update servers receive the fix automatically. No CVSS score, published CVE record, or evidence of exploitation has appeared, and the flaw is absent from CISA's KEV catalog as of August 27. The article also recaps related 2026 cPanel-ecosystem issues, including KEV-listed LiteSpeed plugin flaws and the in-the-wild-exploited Phusion Passenger problem.

The Hacker News·Aug 28, 09:45 UTC · 19d agoVulnerabilityCVE-2026-65643CVE-2026-58048CVE-2026-58047+3 CVEs

Docker security advisory (AV26-925)

Canadian Cyber Centre advisory AV26-925 flags a vulnerability in Docker Sandboxes versions prior to 0.43.0 and urges users to apply updates.

The Canadian Centre for Cyber Security issued advisory AV26-925 on September 15, 2026, stating Docker is affected by a vulnerability in Docker Sandships prior to version 0.43.0. The advisory directs users and administrators to review Docker sbx-releases and security announcements and apply updates as they become available. No exploitation or technical details are provided.

Canadian Centre for Cyber Security·Sep 15, 18:59 UTC · 19h agoAdvisory