132 casos · pág. 1/7
GitLab released security patches for CVE-2026-110264, a maximum-severity integer overflow flaw in its Regular Expression Compiler that can let an unauthenticated remote attacker execute arbitrary code on vulnerable servers. The researcher joaxcar reported it through GitLab's HackerOne bug bounty program; theregister.com names the reporter…
Gcore is offering its WAAP Enterprise plan free to government bodies and public agencies until December 31, 2026. The offer follows the php2shell vulnerabilities, which forced public websites offline across Europe this week. Government portals in the Netherlands, Finland, Denmark and France, along with hospitals, schools and commercial si…
Two critical PHP vulnerabilities, reportedly allowing unauthenticated attackers to take control of servers, led Anatel and several Brazilian federal courts (TRF1, TRF4, TRF6) to suspend external access to systems including the Sistema Eletrônico de Informações (SEI). The Brazilian CISC issued an alert on 21 October 2026. GSI instructed fe…
GitLab released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for GitLab CE/EE on October 21, 2026. The release fixes CVE-2026-110264, an integer overflow in the regular expression compiler that could allow an unauthenticated user to execute arbitrary code on the GitLab server (CVSS 10.0). It affects…
Amazon Web Services (AWS) research indicates that at least one actor began attempting to exploit two critical PHP vulnerabilities, collectively called PHP2Shell, on October 17. That was four days before the fixes and public disclosure on Wednesday, October 21, at 10 am ET. AWS found the activity by reviewing honeypot logs. The attempt cam…
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each fl…
Wiz Research disclosed multiple memory-safety vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, and patched by the PHP team on October 21, 2026. The flaws allow unauthenticated remote code execution or disclosure of process memory (passwords, tokens, API keys, certificates) on any site running an…
A cyber-attack that began on October 11 against refrigeration controllers in French supermarkets is larger than first reported. It now appears to affect Dixell Electronics (a Copeland brand) temperature regulation devices as well as Danfoss controllers. CERT-FR named Danfoss AK-SC and AK-SM series, Dixell xweb and Copeland xweb as affecte…
Cisco disclosed CVE-2026-20327, a blind SQL injection vulnerability in the web-based management interface of Cisco Unified Intelligence Center. An authenticated, local attacker could send a crafted request and read the contents of the device's internal database. Cisco rates the Security Impact as Medium. Software updates are available and…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-14 based on evidence of active exploitation: CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the f…
Researcher Mohan Pedhapati of Hacktron ran an AI-driven audit against vinext, Cloudflare's Next.js reimplementation reportedly built in a week with AI assistance. The scan produced 45 findings, of which 24 were manually validated, including several Critical issues. The most serious bugs allow cross-user session data leakage, shared cache …
The Yokai research team at Hakai Security disclosed CVE-2026-40083, a SQL injection vulnerability in Cacti versions up to and including 1.2.30. An authenticated user with SNMP management (agent) permissions can run arbitrary SQL queries, reading or modifying the entire database. Exposed data includes bcrypt credential hashes, API tokens, …
The Yokai Research Team at Hakai Security disclosed two Server-Side Request Forgery (SSRF) vulnerabilities in MagicMirror², an open-source smart mirror platform: CVE-2026-63642 (blind SSRF in the newsfeed module) and CVE-2026-63643 (SSRF in the calendar module). Both let a client make the MagicMirror² server send HTTP requests to attacker…
F5 Labs analyzes CVE-2025-23061 and its predecessor CVE-2024-53900, a CVSS 9.0 flaw in the Mongoose MongoDB client library that allows remote code execution on Node.js API servers. The bug abuses the populate method, which accepts a $where clause containing arbitrary JavaScript. The initial fix for CVE-2024-53900 blocked only top-level $w…
Cisco disclosed CVE-2026-20362, a server-side request forgery (SSRF) vulnerability in the web-based management interface of Cisco Finesse. An unauthenticated, remote attacker could exploit it by sending a crafted HTTP request to an affected device. Successful exploitation could expose limited sensitive information from services associated…
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. The company's disclosure notice states that attackers accessed a subset of its data. That data was later published publicly and contains about 275k unique email addresses and Discord us…
The German municipality of Tangerhütte (Saxony-Anhalt) was hit by a cyberattack that its software provider Innocon believes was carried out with artificial intelligence. Attackers exploited a previously unknown vulnerability in Innocon software behind the municipality's digital town hall, according to an MDR investigation. A municipal IT …
Unknown attackers compromised thousands of internet-exposed refrigeration controllers late on Sunday, raising temperatures to as high as 122°F (50°C), spoiling food and causing fires at nearly 700 French supermarkets. France's ANSSI warned of widespread compromises of Danfoss controllers and a day later added Copeland and its Dixell brand…
Drupal published an advisory on October 14, 2026 for CVE-2026-108097, a critical remote code execution vulnerability in the Field UI module (fieldui) of Drupal core. The advisory gives it a risk score of 19/25, with basic attack complexity, no authentication required, and full confidentiality and integrity impact. Drupal core alone is not…
Sansec warns that a maximum-severity flaw, CVE-2026-103849 (dubbed BlockStrap), in Magento Open Source and Adobe Commerce could allow attackers to execute arbitrary PHP code on store servers. No in-the-wild exploitation has been observed yet, but Sansec identified four potential attack paths in under 24 hours and expects mass exploitation…
