vulnerability
Hackers exploit SiteGuard WAF flaw to run commands as admins
Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines. The security issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default. SiteGuard is a leading Japanese […]
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. The security issues impact the software core’s Field UI module and the contributed Entity List module. Drupal issued an advance warning at the beginning of the week, urging administrators to […]
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. According to e-commerce security firm Sansec, attacks leveraging the vulnerability, dubbed BlockStrap, have not yet been observed, but threat actors are expected to find a way to exploit […]
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud. Multiple administrator reports indicate that attacks began in mid-September, roughly a month before the formal security bulletin, the GitHub advisory, and CVE publication. CVE-2026-110447 impacts richdocumentscode versions before 26.4.303 and […]
Ghostscript flaw lets hackers hijack servers via PDF uploads
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. The flaw was discovered on August 23 by researchers at Defiant’s platform Wordfence using their Argus AI-powered system. Ghostscript is a PostScript and PDF interpreter that can render PDFs as images, generate […]
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Today is Microsoft’s October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday addresses 70 “Critical” vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing. The approximate number of bugs in each […]
Microsoft releases Windows 10 KB5126657 extended security update
Microsoft released the Windows 10 KB5126657 extended security update, which includes this month’s record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update like normal by going into Settings, clicking on Windows […]
Docker Hub flaw let attackers impersonate users, tamper with images
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user’s container repositories using a personal access token (PAT). Docker Hub is an online registry for storing, sharing, and downloading container images – templates that package everything needed for an application to run in an isolated environment. In Docker Hub, […]
SAP warns of maximum severity OAuth2 SSRF security flaw
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company’s SAP Business Technology Platform (BTP) services. Tracked as CVE-2026-89111, the maximum-severity […]
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the ‘joaxcar‘ handle and reported via GitLab’s HackerOne bug bounty program. CVE-2026-97229 stems from […]