Search: “ExpressVPN”

NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected

Dutch NCSC warns of two critical CVSS 9.8 Check Point VPN flaws enabling unauthenticated remote code execution, urging immediate patching before mass exploitation.

The Dutch NCSC warned that CVE-2026-85102 and CVE-2026-85103, both rated 9.8 CVSS, allow unauthenticated remote attackers to execute arbitrary code on Check Point Quantum Security Gateway, Spark Firewall, and Security Management Server deployments when VPN is enabled. CVE-2026-85102 stems from improper certificate trust validation during VPN negotiation, while CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding. Check Point shipped emergency updates on September 9, 2026, including R82.10 Take 44, R82 Take 126, and R81.20 Take 166 or later, plus LivePatch for eligible systems. No public exploit code exists yet, but the NCSC rates exploitation likelihood high and recommends restricting UDP ports 500 and 4500 to known peers as a stopgap.

Cyber Security News·updated 17:14 UTC · 34m ago·first Sep 14, 05:11 UTC · 2d agoVulnerability 10 sourcesCVE-2026-85102CVE-2026-85103

USN-8571-2: Apache HTTP Server regression

Ubuntu issues USN-8571-2 fixing an Apache HTTP Server regression that prevented startup when HTTP/2 proxying was enabled.

Ubuntu released USN-8571-2 to fix a regression introduced by USN-8571-1 in Apache HTTP Server. The earlier fix was incomplete due to a missing library symbol, causing Apache to fail to start when HTTP/2 proxying was enabled. The original advisory addressed CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, and an HTTP response splitting vulnerability affecting multiple modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab, and Dawit Jeong.

Ubuntu Security Notices·updated 11:33 UTC · 6h ago·first Sep 10, 19:36 UTC · 5d agoAdvisory 12 sourcesCVE-2026-33007

"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)

CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.

On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sourcesCVE-2026-63030CVE-2026-601371· 1 read

Exposed SISVISA Database Leaks 102,000 Brazilian Health Surveillance Records

Security Affairs·Aug 6, 16:44 UTC · Aug 6, 2026Data breach

OpenVPN security advisory (AV26-889)

Canada's Cyber Centre advisory AV26-889 flags CVE-2026-84732 in OpenVPN 2.6.22 and earlier and 2.7.6 and earlier, urging administrators to apply updates.

The Canadian Centre for Cyber Security issued advisory AV26-889 noting that OpenVPN versions up to and including 2.6.22 and 2.7.6 are affected by CVE-2026-84732. The flaw involves unbounded TLS timeouts and acknowledgements for non-outstanding packets in the reliability layer. Administrators are encouraged to review the linked OpenVPN guidance and apply updates as they become available. No exploitation is reported.

Canadian Centre for Cyber Security·Sep 8, 15:19 UTC · 8d agoAdvisoryCVE-2026-84732

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 26d agoResearch2

USN-8736-1: Perl vulnerabilities

Ubuntu issued USN-8736-1 fixing two Perl regex flaws that could cause denial of service, code execution, or security-restriction bypass.

Ubuntu released a security notice addressing two Perl vulnerabilities in regular expression handling. CVE-2026-15534 involves mishandling of large inputs during regex matching, enabling out-of-bounds heap reads or writes that could lead to denial of service or arbitrary code execution. CVE-2026-19487 involves incorrect matching for regexes with alternative branches, allowing security restrictions to be bypassed. Users are advised to apply the updated packages.

Ubuntu Security Notices·Sep 8, 14:25 UTC · 8d agoAdvisoryCVE-2026-15534CVE-2026-19487

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

The Hacker News·Aug 4, 13:18 UTC · Aug 4, 2026Malware1

737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One

Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.

Socket and researcher Kush Pandya identified 737 Chrome VPN and proxy extensions, published across at least 40 developer accounts with 75,486 installs, that route entire browser sessions through one provider's SOCKS5 proxies on port 1082. Of these, 274 impersonate 66 established brands including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare 1.1.1.1. The proxy bypass list only excludes loopback addresses, exposing visited destinations, source IPs, TLS SNI values, and plain-HTTP request bodies to the operator. 221 extensions have been removed from the Chrome Web Store while 516 remain listed as active.

The Hacker News·Aug 12, 14:09 UTC · Aug 12, 2026Malware

IXON VPN Client

CISA warns CVE-2026-75925 (CVSS 9.6) in IXON VPN Client <1.4.7 lets attackers inject config directives for root/SYSTEM remote code execution.

IXON's CRLF injection flaw (CVE-2026-75925, CWE-93) in VPN Client before 1.4.7 lets the unauthenticated local configuration service inject additional directives into a file consumed by a privileged subprocess. Injected configuration persists across client and OS restarts, enabling code execution as root or SYSTEM while the VPN connection keeps functioning normally. Deployments span energy, manufacturing, water, and IT sectors; no public exploitation has been reported to CISA.

CISA Advisories·Sep 3, 12:00 UTC · 13d agoAdvisoryCVE-2026-75925

USN-8738-1: FFmpeg vulnerabilities

Ubuntu's USN-8738-1 fixes multiple FFmpeg vulnerabilities allowing denial of service, arbitrary code execution, and sensitive information exposure.

Ubuntu Security Notice USN-8738-1 addresses several FFmpeg flaws. CVE-2026-66036 involves mishandled video frames in the hqdn3d filter, allowing denial of service or arbitrary code execution. CVE-2026-66038, found by Adrian Junge, leaks sensitive information via compressed video files, and CVE-2026-66039 allows denial of service or code execution through crafted audio files. Additional subtitle-file handling flaws were also fixed.

Ubuntu Security Notices·updated Sep 8, 17:12 UTC · 8d ago·first Sep 8, 17:01 UTC · 8d agoAdvisory 2 sourcesCVE-2026-66036CVE-2026-66038CVE-2026-66039

CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

Apache OpenNLP CVE-2026-82617: built-in EMAIL and URL regex name-finder patterns enable regular expression denial-of-service and stack exhaustion in affected releases.

CVE-2026-82617 affects Apache OpenNLP opennlp-core 3.0.0-M1 before 3.0.0-M6 and opennlp-tools 2.0.0 before 2.5.12. The DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL patterns in RegexNameFinderFactory contain ambiguous nested quantifiers. Applications using these built-in finders on attacker-controlled input can be forced into regular expression denial of service or stack exhaustion. Fixes shipped in opennlp-tools 2.5.12 and 3.0.0-M6.

oss-security·Sep 11, 19:24 UTC · 4d agoVulnerability 2 sourcesCVE-2026-826171

CVE-2026-89775: Guest-to-Host Escape in KVM/arm64

Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.

Researcher Hyunwoo Kim disclosed CVE-2026-89775, a guest-to-host escape in KVM/arm64, after the embargo agreed with linux-distros maintainers expired. The root cause is a type truncation of the stage-1 walk level that makes a size computation return 0, the value meaning 'size unknown'. The VNCR pseudo-TLB invalidation path then interprets that 0 as a valid value on ARM64 hosts where nested virtualization is enabled.

oss-security·16:04 UTC · 1h agoVulnerabilityCVE-2026-89775

FlyWP Adds Proactive Vulnerability Protection with Patchstack

FlyWP integrated Patchstack into its managed WordPress hosting platform via a new FlySecurity Pro add-on for proactive vulnerability protection.

FlyWP, a managed WordPress cloud hosting and server management provider, has integrated Patchstack vulnerability intelligence into its platform. The new FlySecurity Pro add-on gives customers proactive protection against WordPress vulnerabilities from a single dashboard. The announcement is a vendor partnership rather than a new flaw or incident.

Patchstack·Aug 17, 15:16 UTC · Aug 17, 2026Tools1

USN-8675-2: Perl vulnerabilities

Ubuntu issued USN-8675-2 fixing two Perl flaws (CVE-2026-12087, CVE-2026-13221) enabling information disclosure and regex-based security bypass on 26.04 LTS.

Ubuntu released USN-8675-2, extending the fixes from USN-8675-1 to Perl packages on Ubuntu 26.04 LTS. The update addresses CVE-2026-12087, an out-of-bounds heap read in the Socket module when handling short source addresses, which could lead to information disclosure. It also fixes CVE-2026-13221, where regular expressions containing many fixed string alternatives could produce incorrect matches and bypass security restrictions. No exploitation is reported in the notice.

Ubuntu Security Notices·Sep 9, 14:10 UTC · 7d agoAdvisoryCVE-2026-12087CVE-2026-13221

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

Broadcom patched two VMware Workstation and Fusion flaws, including critical integer overflow CVE-2026-59346 (CVSS 9.3), letting guest admins execute host code; no exploitation seen.

Broadcom released updates fixing CVE-2026-59346 (CVSS 9.3), an integer-overflow vulnerability allowing a malicious actor with local administrative privileges on a VM with a VMXNET3 adapter to execute code on the host, and CVE-2026-59347 (CVSS 8.1), a stack-based buffer overflow in HGFS allowing code execution as the host's VMX process. Both flaws affect VMware Workstation and Fusion 25H2 and 26H1, have no workarounds, and are fixed in Workstation 26H1u1 and Fusion 26H1u1. No in-the-wild exploitation has been observed, though VMware vCenter flaws CVE-2026-59309 and CVE-2026-59310, the latter suspected of China-nexus APT use, have recently breached 361 unique victim IPs across 47 countries.

The Hacker News·Sep 5, 16:05 UTC · 11d agoVulnerabilityCVE-2026-59346CVE-2026-59347CVE-2026-59309+1 CVEs

WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...

Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.

CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 14:13 UTC · 9d agoExploit / PoC in the wildCVE-2026-63030CVE-2026-60137

$20 per zero-day is already the WordPress plugin reality

TrendAI and CHT Security used an AI pipeline to find over 300 verified WordPress plugin zero-days at roughly $20 per vulnerability.

A pipeline built in three days by TrendAI and CHT Security, presented at Ekoparty Miami, paired AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP dynamic verification to surface more than 300 critical zero-days in WordPress plugins within 72 hours. The run consumed about 222 million tokens across 95 tasks, averaging roughly $20 per verified vulnerability, with findings including pre-auth RCE, SQL injection, privilege escalation, SSRF, and an AI-assembled downgrade attack chain. Dynamic verification eliminated over 80% of false positives, but manual review at 30-60 minutes per finding remains the bottleneck, straining ZDI and NIST triage backlogs.

Help Net Security·Aug 24, 04:21 UTC · 23d agoResearch1

USN-8716-2: FFmpeg vulnerabilities

Ubuntu issued USN-8716-2 fixing FFmpeg VobSub, Vulkan HEVC, and NVDEC decoder flaws that could allow denial of service or code execution.

USN-8716-2 provides the Ubuntu 26.04 LTS counterpart to the FFmpeg fixes in USN-8716-1. Crafted media files could cause denial of service or arbitrary code execution through the VobSub subtitle demuxer (CVE-2026-64830), the Vulkan HEVC hardware decoder (CVE-2026-64831), and the NVDEC video decoder path.

Ubuntu Security Notices·Sep 9, 17:27 UTC · 7d agoAdvisoryCVE-2026-64830CVE-2026-64831

Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)

Citrix patched a critical authentication bypass, CVE-2026-19490, in NetScaler Gateway and NetScaler ADC, urging customers to upgrade immediately.

Citrix has patched two flaws in NetScaler ADC and NetScaler Gateway. CVE-2026-19490 is a critical authentication bypass (CVSS v4.0 9.3) that works when the appliance is configured as an SSL VPN, ICA Proxy, CVPN, RDP Proxy Gateway or AAA virtual server, with additional conditions depending on firmware and SAML configuration. A second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow that can cause denial of service when SIP ALG is enabled on LSN setups. Rapid7 had not observed exploitation as of August 19, 2026, but urged emergency patching; a signature-based mitigation is available via NetScaler Console.

Help Net Security·Aug 21, 00:00 UTC · 26d agoVulnerabilityCVE-2026-19490CVE-2026-19489

Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022

Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.

Volexity identified exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Data Center, during Memorial Day weekend 2022, with Atlassian issuing a patch. Cortex Xpanse found 19,707 potentially affected Confluence instances, concentrated in the US, Germany, China, and Russia, plus 1,251 end-of-life versions exposed. Unit 42 and Cortex Managed Threat Hunting observed successful exploitation leading to reconnaissance commands and a Cerber ransomware deployment that was blocked by Cortex XDR. A public PoC has increased exploitation risk.

Palo Alto Unit 42·Aug 17, 12:19 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2022-26134

USN-8754-1: Freeciv vulnerability

Ubuntu patches Freeciv stack overflow where remote attackers crash clients or servers using crafted network packets.

USN-8754-1 fixes a Freeciv vulnerability where certain network packets trigger a stack overflow. A remote attacker could use this to crash Freeciv clients or servers, resulting in denial of service. Ubuntu released updated packages.

Ubuntu Security Notices·Sep 14, 12:40 UTC · 2d agoAdvisory1

USN-8734-1: PHP vulnerabilities

Ubuntu issued USN-8734-1 fixing three PHP denial-of-service flaws in SOAP, metaphone() and phar handling, including CVE-2026-7262 and CVE-2026-7568.

Ubuntu security notice USN-8734-1 addresses multiple PHP vulnerabilities. CVE-2026-7262 is a NULL pointer dereference in Apache map decoding in SOAP servers with a typemap configured; CVE-2026-7568 is a signed integer overflow in metaphone() causing an out-of-bounds read; and CVE-2026-7260 involves unbounded recursion from circular symbolic links in phar archives. All issues could allow remote attackers to cause denial-of-service conditions.

Ubuntu Security Notices·Sep 7, 13:56 UTC · 9d agoAdvisoryCVE-2026-7262CVE-2026-7568CVE-2026-7260

CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0-2.11.0 flow update REST methods lack authorization checks for referenced components, permitting unauthorized Process Group flow replacement (CVE-2026-82561).

Apache NiFi 1.5.0 through 2.11.0 expose REST API methods that replace the entire contents of a Process Group with a client-supplied flow definition, including versioned flow update and rebase operations. Framework authorization for these methods was limited to read and write privileges on the target Process Group, without checking components referenced in the flow (CVE-2026-82561). No severity rating was provided in the disclosure; the affected version range is broad.

oss-security·15:17 UTC · 2h agoVulnerability 3 sourcesCVE-2026-82561

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker News·Sep 2, 07:47 UTC · 14d agoResearchCVE-2021-318862