Search: “code execution”

195 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 89 Exploit / PoC 72 Advisory 46 Malware 29 Threat actor 25 Research 16 Industry 13 Phishing & fraud 9 Tools 6 Policy & legal 4 Data breach 4

SeverityAll critical 39 high 131 medium 93 low 14 info 36

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackersSep 15, 11:44 UTC · 1d agoIndustry in the wild

Emacs arbitrary code execution: incomplete fix for CVE-2024-53920

Incomplete fix for Emacs CVE-2024-53920 allows arbitrary code execution when viewing or editing untrusted files in non-Lisp modes like Perl flymake.

Bas Alberts of GitHub Security Lab discovered that the patch for CVE-2024-53920, an arbitrary code execution flaw in Emacs, was incomplete. Code execution remains possible when viewing or editing untrusted text files in modes other than Emacs Lisp mode, for example Perl files with flymake mode enabled. All Emacs versions affected by the original CVE remain affected by the incomplete fix.

oss-securitySep 14, 14:36 UTC · 2d agoVulnerability CVE-2024-53920

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

GBHackersSep 11, 10:13 UTC · 5d agoVulnerability CVE-2026-85706 CVE-2026-87719 CVE-2026-88765+15 CVEs1

Palo Alto PAN-OS Buffer Overflow Lets Attackers Execute Arbitrary Code as Root

Palo Alto Networks fixed CVE-2026-0310, a CVSS 9.2 unauthenticated PAN-OS buffer overflow enabling root code execution on PA-Series firewalls.

Palo Alto Networks published an advisory on September 9, 2026 for CVE-2026-0310, a CWE-787 out-of-bounds write in PAN-OS XML processing with a CVSS v4.0 base score of 9.2, affecting the management and dataplane interfaces. Unauthenticated attackers could execute arbitrary code as root on PA-Series hardware firewalls, while VM-Series faces denial-of-service impact and Prisma Access and Cloud NGFW have reduced, authenticated exposure. Affected releases include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 before fixed maintenance releases such as 12.2.3, 12.1.4-h10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround is available. Palo Alto is not aware of malicious exploitation but classifies remediation urgency as highest.

GBHackersupdated Sep 10, 12:10 UTC · 6d agofirst Sep 10, 11:39 UTC · 6d agoVulnerability 3 sources CVE-2026-0310

LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials

Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.

Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.

Cyber Security Newsupdated Sep 10, 12:56 UTC · 6d agofirst Sep 10, 12:26 UTC · 6d agoExploit / PoC in the wild 3 sources CVE-2026-59821 CVE-2026-59822 CVE-2026-35029

Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution

China-linked UNC3569 actively exploited critical Sogou Input Method flaw CVE-2026-51990 for one-click system-level code execution, deploying the GrayRabbit backdoor.

Gen Threat Labs reports that China-linked threat actor UNC3569, possibly tied to contractor i-SOON, exploited critical CVE-2026-51990 in Tencent's Sogou Input Method, a Windows IME used by hundreds of millions, via crafted sgbiz URLs. The chain combines unvalidated command-line argument injection, unrestricted URL navigation, and an un-sandboxed Chromium 80 engine missing roughly six years of security patches. The exploit gives system-level code execution and was used to deploy the GrayRabbit backdoor, which provides a reverse shell, plugin loading, file upload to C2, and system info collection, and has appeared in UNC3569 intrusions since at least 2021. Tencent patched the issue in version 16.3.0.3498 via automatic update, but the outdated Chromium configuration reportedly remained unchanged as of September 10.

SecurityWeekSep 14, 11:51 UTC · 2d agoExploit / PoC in the wild 2 sources CVE-2026-519901· 1 read

ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability

ZDI-26-696: Linux Kernel NTFS3 journal heap-based buffer overflow (CVE-2026-72196, CVSS 8.8) enables local arbitrary code execution.

ZDI advisory ZDI-26-696 describes a heap-based buffer overflow in the Linux Kernel NTFS3 journal handling, tracked as CVE-2026-72196 with a CVSS score of 8.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to execute arbitrary code. No in-the-wild exploitation is mentioned.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-721961

Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root

JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.

JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.

Cyber Security Newsupdated 13:14 UTC · 9h agofirst 09:24 UTC · 13h agoVulnerability 4 sources CVE-2026-90894

ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow remote code execution flaw (CVE-2026-75862) in Adobe Photoshop DCM JPEG image parsing.

The Zero Day Initiative published advisory ZDI-26-679 describing an integer overflow remote code execution vulnerability in Adobe Photoshop, tracked as CVE-2026-75862 with a CVSS 7.8 score. The flaw occurs while parsing JPEG data in DCM images. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. No in-the-wild exploitation is reported.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 3 sources CVE-2026-75862

Metasploit Wrap Up: This One Goes to Sixteen!

Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.

Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.

Rapid7 BlogSep 11, 13:35 UTC · 5d agoTools in the wildCVE-2025-66516 CVE-2025-54988 CVE-2026-20929+8 CVEs1

ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

ZDI discloses CVE-2026-64397, a CVSS 9.0 unauthenticated remote code execution race condition in Linux Kernel KSMBD.

ZDI-26-684 describes a race condition in the Linux Kernel KSMBD subsystem's Query Directory Request handling that allows unauthenticated remote attackers to execute arbitrary code. Only systems with KSMBD enabled are vulnerable. ZDI assigned a CVSS rating of 9.0 and CVE-2026-64397.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoAdvisory CVE-2026-64397

ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 use-after-free remote code execution flaw (CVE-2026-81976) in Adobe Acrobat Reader DC triggered via malicious PDFs.

The Zero Day Initiative published advisory ZDI-26-675 describing a use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC, tracked as CVE-2026-81976 with a CVSS 7.8 score. The flaw resides in the annotation feature. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. The advisory reports no evidence of in-the-wild exploitation.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 19 sources CVE-2026-819761

ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.

Zero Day Initiative advisory ZDI-26-648 documents an External Control of System or Configuration Setting vulnerability in OpenAI Codex, demonstrated at Pwn2Own. A remote attacker could achieve arbitrary code execution, with user interaction required such as opening malicious content. The flaw is tracked as CVE-2026-19590 with a CVSS rating of 7.8. No exploitation in the wild is reported.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 4 sources CVE-2026-195901

ZDI-26-657: ASUS Control Center Express Agent Missing Authentication Remote Code Execution Vulnerability

ZDI-26-657: ASUS Control Center Express Agent has an unauthenticated remote code execution flaw, CVE-2026-19397, rated CVSS 9.8.

The Zero Day Initiative published advisory ZDI-26-657 for ASUS Control Center Express Agent. The flaw, tracked as CVE-2026-19397, lets remote attackers execute arbitrary code without authentication. ZDI assigned a CVSS 9.8 rating. The advisory accompanies a vendor patch for affected installations.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoAdvisory CVE-2026-19397

ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability

ZDI-26-693: authenticated race condition in Linux kernel ksmbd share configuration allows remote code execution on ksmbd-enabled systems; CVSS 8.5.

ZDI advisory ZDI-26-693 discloses a race condition in the Linux kernel's ksmbd share configuration that allows remote attackers to execute arbitrary code on affected installations. Exploitation requires authentication, and only systems with ksmbd enabled are vulnerable. ZDI assigned a CVSS rating of 8.5; no CVE is listed in the advisory text.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability1

ZDI-26-656: PAPPL Job Processing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-656: Unauthenticated heap-based buffer overflow in PAPPL job processing allows remote code execution, rated CVSS 9.8.

The Zero Day Initiative published advisory ZDI-26-656 for PAPPL, the open-source printer application framework. A heap-based buffer overflow in job processing allows remote attackers to execute arbitrary code with no authentication required. ZDI assigned a CVSS 9.8 rating. No CVE identifier was listed in the advisory text.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoAdvisory 2 sources

ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability

ZDI-26-695: Linux Kernel NFSv4 server race condition (CVE-2026-89688, CVSS 8.5) enables remote code execution on nfsd systems with authentication.

ZDI advisory ZDI-26-695 describes a race condition in the Linux Kernel NFSv4 server tracked as CVE-2026-89688 with a CVSS score of 8.5. Remote attackers can execute arbitrary code, but authentication is required and only systems with nfsd enabled are vulnerable. No in-the-wild exploitation is mentioned in the advisory.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-896881

ZDI-26-692: Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability

ZDI-26-692: race condition in Linux kernel eMPIA USB driver (CVE-2026-31583) lets physically present attackers execute code without authentication; CVSS 7.1.

ZDI advisory ZDI-26-692 discloses a race condition in the Linux kernel's eMPIA USB device driver that allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required, but physical access to the target system is necessary. ZDI assigned a CVSS rating of 7.1 and CVE-2026-31583.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-31583

Forgejo 16.0.4 has a critical security bug fix (RCE - Remote Code Execution)

Forgejo 16.0.4 fixes a critical remote code execution vulnerability in the self-hosted Git forge; administrators should update promptly.

The Forgejo project released version 16.0.4 of its self-hosted Git forge with a fix for a critical remote code execution vulnerability, as stated in the published release notes. The announcement provides no CVE identifier or technical exploitation details in the indexed text. Administrators running Forgejo instances should upgrade to 16.0.4 to apply the security fix.

Lobsters · securitySep 10, 17:40 UTC · 6d agoVulnerability1

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

WordfenceSep 14, 16:53 UTC · 2d agoVulnerability

The Apple Security Update Review for September 2026

Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.

ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.

Zero Day Initiative Blog19:58 UTC · 2h agoVulnerability in the wildCVE-2026-65400 CVE-2026-65414 CVE-2026-43692+27 CVEs

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security NewsSep 14, 03:10 UTC · 2d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2025-25249+3 CVEs3

ZDI-26-707: (0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability

ZDI disclosed an unpatched code injection RCE (CVE-2026-92207, CVSS 8.8) in MindsDB's OpenBBtable feature, exploitable by authenticated remote users.

ZDI-26-708 describes a code injection remote code execution vulnerability in MindsDB's OpenBBtable functionality. A remote attacker with valid authentication can execute arbitrary code on affected installations. The flaw is rated CVSS 8.8, tracked as CVE-2026-92207, and published as a 0day advisory without a referenced vendor patch.

ZDI Published Advisories05:00 UTC · 17h agoVulnerability CVE-2026-92207

ZDI-26-706: (0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability

ZDI discloses unpatched unsafe reflection RCE vulnerability CVE-2026-92206 (CVSS 8.8) in the CrewAI agent framework.

Zero Day Initiative published ZDI-26-706, an unsafe reflection remote code execution vulnerability in the CrewAI framework, tracked as CVE-2026-92206 with a CVSS score of 8.8. Exploitation requires user interaction: the target must load a malicious agent configuration from the repository. As a 0day advisory, no patch is indicated at publication.

ZDI Published Advisories05:00 UTC · 17h agoVulnerability CVE-2026-922061

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.

Cyber Security NewsSep 15, 15:51 UTC · 1d agoVulnerability CVE-2026-65414 CVE-2026-84607 CVE-2026-64752+7 CVEs1

VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

CERT/CC details CVE-2026-90999: attacker-controlled Sentry telemetry can steer the Seer coding agent into executing attacker code with repository access.

CERT/CC published VU#212479 for CVE-2026-90999 in Sentry Seer: attacker-submitted events through public DSN endpoints flow into Seer's root-cause analysis, which is embedded directly into the coding agent's initial prompt. In the documented chain, the privileged coding agent downloads and executes an attacker-controlled package before any human review, yielding arbitrary code execution with access to connected source repositories. No vendor patch is available yet; mitigations include disabling automated remediation, restricting coding-agent package installation, and filtering telemetry before Seer analysis.

CERT/CC Vulnerability Notes15:18 UTC · 7h agoVulnerability CVE-2026-90999

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

Cisco fixed an unauthenticated Java deserialization RCE in FMC's External Database Access feature allowing root command execution via a TCP port.

Insecure deserialization of a user-supplied Java byte stream in Cisco Secure Firewall Management Center's External Database Access feature lets an unauthenticated remote attacker execute arbitrary commands and elevate to root. Exploitation requires sending a crafted serialized stream to a specific TCP port from a host configured in the external database access list. Cisco has released software updates.

Cisco Security Advisories16:00 UTC · 6h agoAdvisory 6 sources

CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.

CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.

oss-securitySep 15, 20:04 UTC · 1d agoVulnerability CVE-2026-867921

Apple Updates Everything, (Mon, Sep 14th)

Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.

Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.

SANS Internet Storm CenterSep 14, 18:33 UTC · 2d agoVulnerability CVE-2022-3437 CVE-2026-20683 CVE-2026-28899+27 CVEs

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.

Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.

The Register · SecuritySep 15, 21:38 UTC · 1d agoVulnerability CVE-2026-65410 CVE-2026-65409 CVE-2026-43689+10 CVEs

Microsoft Offers Up to $30,000 for Critical AI Flaws in Dynamics 365 and Power Platform

Microsoft expands AI bug bounty to Dynamics 365 and Power Platform, paying up to $30,000 for critical inference manipulation flaws.

Microsoft's bug bounty program offers up to $30,000 for critical 'Inference Manipulation' or 'Inferential Information Disclosure' bugs in Dynamics 365 and Power Platform, including Copilot Studio, AI Builder, Power Apps, Power Automate, and Dataverse. Payouts scale by report quality ($30,000/$20,000/$12,000 for critical) with important-severity AI flaws earning $6,000-$20,000, plus 20% multipliers for Dataverse privilege escalation and Plugin Sandbox escapes. Prompt injection affecting only the attacker, hallucinated execution, and system-prompt disclosure are excluded from scope.

Cyber Security NewsSep 14, 16:11 UTC · 2d agoIndustry

IBM security advisory (AV26-922)

Canadian Cyber Centre relays IBM advisory for Langflow, MQ, and Sterling File Gateway flaws including MQ remote code execution (CVE-2026-13293).

Canadian Cyber Centre advisory AV26-922 relays IBM fixes for Langflow OSS (versions through 1.11.5 across release lines), IBM MQ (10.0.0.0 and 9.x LTS/CD through 9.4.5.1), and Sterling File Gateway (through 6.2.2.1). CVE-2026-13293 is a remote code execution flaw in IBM MQ Java messaging caused by an incomplete security scanner blocklist enabling network-based code execution. CVE-2026-19290 is an improper access control vulnerability in IBM Sterling File Gateway. Administrators are urged to review and apply the necessary updates.

Canadian Centre for Cyber SecuritySep 15, 14:29 UTC · 1d agoAdvisory CVE-2026-13293 CVE-2026-19290

Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls

Apache Syncope fixed three flaws enabling SQL injection, Groovy sandbox escape, and JWT token theft to impersonate higher-privileged users.

Apache Syncope, an open-source identity management and access governance platform, disclosed CVE-2026-82232, a stacked-query SQL injection in the Task search sort parameter; CVE-2026-77147, a Groovy sandbox escape via malicious Command classes; and CVE-2026-73178, retrieval of signed JWT access tokens via REST enabling impersonation of more privileged users. All three flaws require administrator-level entitlements to exploit and affect Syncope 3.0, 4.0, and 4.1 releases. Fixes shipped in versions 4.0.8 and 4.1.3, with researchers Alon Galili and n0mi1k credited.

Cyber Security News13:21 UTC · 9h agoVulnerability 3 sources CVE-2026-82232 CVE-2026-77147 CVE-2026-73178

GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pipeline

GitHub paid Saif Ghani $100,000 for CVE-2026-3854, a critical unauthenticated RCE in its Git push pipeline allowing command execution on backend infrastructure.

GitHub awarded researcher Saif Ghani $100,000, its largest publicly disclosed bug bounty, for CVE-2026-3854, a critical unauthenticated remote code execution flaw in its Git push processing pipeline. A crafted repository URL could trigger arbitrary command execution on backend infrastructure, threatening source code integrity, repository secrets, and software supply chains. GitHub deployed mitigations and completed a patch rollout through coordinated disclosure before technical details became public.

Cyber Security NewsSep 14, 08:50 UTC · 2d agoVulnerability CVE-2026-38542

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.

GBHackersupdated 11:32 UTC · 11h agofirst Sep 15, 11:24 UTC · 1d agoVulnerability 3 sources CVE-2026-78006 CVE-2026-78159

Nintendo Switch Vulnerability Allows Attackers to Run Unauthorized Code on Your Console

Nintendo patched CVE-2026-82079, a CVSS 7.0 stack buffer overflow in original Switch local wireless allowing nearby code execution via QR-code workflows.

Nintendo patched CVE-2026-82079 (CVSS 4.0 base score 7.0, High), a stack-based buffer overflow in the original Switch's local wireless networking affecting firmware earlier than 23.0.0. An adjacent attacker must scan a QR code displayed by the console, via the Album "Send to Smartphone" feature or Mario Kart Live: Home Circuit, before crafted packets can corrupt memory and enable return-oriented programming for arbitrary code execution. EPSS is approximately 0.16%, Switch 2 is not affected, and Nintendo's advisory was published September 10, 2026.

Cyber Security Newsupdated Sep 15, 06:19 UTC · 1d agofirst Sep 14, 16:23 UTC · 2d agoVulnerability 2 sources CVE-2026-82079

USN-8772-1: AOM vulnerabilities

Ubuntu USN-8772-1 patches four libaom flaws (CVE-2026-56208 to CVE-2026-56211) that could cause heap overflow, arbitrary memory writes, or code execution.

Ubuntu Security Notice USN-8772-1 fixes a heap buffer overflow in libaom's first-pass statistics buffer handling in Look-Ahead Processing mode (CVE-2026-56208), potentially causing denial of service or arbitrary code execution. Three additional flaws in spatial and temporal layer ID validation in the SVC encoder controls (CVE-2026-56209, CVE-2026-56210, CVE-2026-56211) allow arbitrary memory writes, out-of-bounds heap reads, or code execution. Users should apply the updated packages.

Ubuntu Security Notices09:29 UTC · 13h agoAdvisory CVE-2026-56208 CVE-2026-56209 CVE-2026-56210+1 CVEs

Cisco Identity Services Engine Vulnerabilities

Cisco patched ISE and ISE-PIC flaws enabling REST API authentication bypass, remote code execution, SQL injection, and XXE attacks.

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks. Cisco has released software updates; no workarounds address these vulnerabilities.

Cisco Security Advisories16:00 UTC · 6h agoAdvisory 15 sources

USN-8741-1: Flatpak vulnerabilities

Ubuntu patched two Flatpak flaws, including a sandbox escape via app-controlled symlinks allowing host code execution (CVE-2026-34078).

Ubuntu security notice USN-8741-1 fixes two Flatpak vulnerabilities in Ubuntu 20.04 LTS, 22.04 LTS, and 24.04 LTS. CVE-2026-34078 stems from improper path validation in sandbox-expose options, letting a malicious or compromised Flatpak app use app-controlled symlinks to access arbitrary host files and gain code execution in the host context. CVE-2026-34079 involves improper path validation when removing outdated ld.so cache files, allowing a compromised app to delete arbitrary files on the host.

Ubuntu Security NoticesSep 10, 08:44 UTC · 6d agoAdvisory CVE-2026-34078 CVE-2026-34079

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

Attackers are actively exploiting an unauthenticated arbitrary file upload flaw in the WooCommerce Wholesale Lead Capture plugin, enabling PHP backdoors and remote code execution.

A critical unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000 active installations, was publicly disclosed on February 20, 2026. Wordfence reports attackers are now actively exploiting the flaw to upload arbitrary files, including PHP backdoors, and achieve remote code execution. No CVE ID was cited in the report.

WordfenceSep 14, 18:49 UTC · 2d agoExploit / PoC in the wild1