Source: BleepingComputer

6 stories in the last 7d

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 15 Data breach 9 Vulnerability 6 Phishing & fraud 5 Malware 5 Policy & legal 3 Advisory 3 Threat actor 2 Industry 1 Research 1 AI safety & security 1 Tools 1

SeverityAll critical 8 high 21 medium 12 low 3 info 8 source: BleepingComputer ✕

September Windows Server updates break Remote Desktop Services

September 2026 Windows Server cumulative updates cause Remote Desktop Services failures on Server 2019, 2022 and 2025, forcing some admins to roll back.

Admins report Remote Desktop Services failures after installing September 2026 Patch Tuesday updates KB5122876 (Server 2019), KB5122882 (Server 2022), and KB5122871 (Server 2025), with connections hanging, sessions failing after logout, and some systems requiring hard resets. One administrator debugging Server 2022 observed an apparent deadlock between RDP and the Local Session Manager, though Microsoft has not confirmed a root cause. Rolling back the updates restores RDS functionality but removes this month's security fixes. Microsoft had not responded to inquiries at publication time.

BleepingComputerupdated 10:17 UTC · 12h agofirst Sep 10, 20:34 UTC · 5d agoVulnerability 20 sources1

Microsoft Excel KB5002914 update breaks copy and paste for some users

Microsoft's September Patch Tuesday update KB5002914 breaks copy-and-paste and formula dragging in Excel 2016 through 2024; uninstalling the update restores functionality.

Users on Reddit and Microsoft Q&A report that the KB5002914 security update shipped in the September 2026 Patch Tuesday breaks copy-and-paste, autofill, and formula dragging in Excel. The problem spans Office 2016 through 2024 across MSI and Click-to-Run installations, including Office LTSC Standard 2021, with some teams blocked after widespread patching. Uninstalling KB5002914 or downgrading the Office build restores functionality, though replacing the excel.exe binary is not recommended. BleepingComputer could not reproduce the issue on Excel 2019 Version 2508 Build 19127.20302 and contacted Microsoft for comment.

BleepingComputerupdated 09:25 UTC · 13h agofirst Sep 10, 19:07 UTC · 5d agoVulnerability 3 sources

GitLab urges users to patch max severity path traversal flaw

GitLab urges self-managed users to immediately patch a maximum-severity path traversal flaw (CVE-2023-2825) enabling unauthenticated arbitrary file reads.

GitLab released patches in CE/EE versions 19.3.2, 19.2.6, and 19.1 for CVE-2023-2825, a maximum-severity path traversal vulnerability that lets unauthenticated attackers read arbitrary files from vulnerable servers under certain conditions. The flaw, reported by researcher s3ntago via HackerOne, stems from improper path confinement and missing authentication enforcement in the repository commits API. GitLab also patched CVE-2026-87719, an insecure deserialization flaw in the GraphQL subscription serializer affecting Enterprise Edition users with Duo Chat access, which could expose credentials and Advanced Search configurations. GitLab.com and Dedicated customers are already protected; the platform has over 30 million registered users and is used by more than 50% of Fortune 100 companies.

BleepingComputerupdated 00:52 UTC · 22h agofirst Sep 11, 11:15 UTC · 4d agoVulnerability 17 sources CVE-2023-2825 CVE-2026-87719 CVE-2021-22175+1 CVEs1

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Dutch NCSC warns exploitation is imminent for critical Check Point VPN RCE flaws CVE-2026-85102 and CVE-2026-85103, urging immediate patching of Security Gateways.

The Dutch NCSC assesses the likelihood and impact of exploitation as high for two critical Check Point VPN flaws, though no public PoC exploit has been reported. CVE-2026-85102 is improper validation of certificate data during VPN negotiation, and CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder; both enable remote code execution on Security Gateways, the latter also on Security Management Servers. Affected releases span R81.20, R82, R82.10, R81.10.x, R82.00.x and EoS versions R80 through R81.10, while R82.20 is unaffected. Check Point shipped fixes on September 9 via LivePatch Take 24 and Jumbo Hotfix Accumulator takes, and NCSC advises restricting Site-to-Site VPN rules to trusted IPs.

BleepingComputerupdated Sep 14, 09:43 UTC · 1d agofirst Sep 12, 14:14 UTC · 3d agoVulnerability 9 sources CVE-2026-85102 CVE-2026-851032

Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking

CERT/CC warns Skullcandy Dime 3 earbuds accept silent Bluetooth pairings via CVE-2025-20701, letting nearby attackers hijack audio and microphone.

CERT/CC reports the Skullcandy Dime 3 (model S2DCW) running firmware 1.0.0.28 is affected by CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK. An attacker in close range can pair without user interaction, then hijack audio playback, access the headset profile, and capture live microphone audio. Skullcandy fixed the issue in firmware 1.0.0.30, but existing units have no consumer-accessible update path via the app. The flaw was discovered by ERNW researchers and affects earbud and headphone products from multiple vendors; Apple patched it for Beats Studio Buds in June.

BleepingComputerupdated Sep 11, 04:16 UTC · 4d agofirst Sep 9, 21:02 UTC · 6d agoVulnerability 3 sources CVE-2025-20701

Over 36,000 exposed Plex servers vulnerable to recent flaws

Over 36,000 internet-exposed Plex Media Server instances remain unpatched against recently disclosed vulnerabilities, leaving them open to attack.

BleepingComputer reports that more than 36,000 Plex Media Server instances exposed to the internet have not yet applied patches for multiple recently disclosed security vulnerabilities. These unpatched, publicly reachable servers remain vulnerable to attacks until administrators install the available updates. The report underscores slow patch adoption for internet-facing media server software.

BleepingComputerSep 9, 10:11 UTC · 6d agoVulnerability