Vulnerabilities

Cyber Threat Intel 6 min Researcher Reports 11 Tailscale Flaws and Says One Hacked Device Can Gain Root on Other Servers The Tailworm report says Tailscale SSH runs socket forwarding as root. Tailscale has issued no bulletin or fix... PR Priya Nair 26 Oct Cybersecurity 6 min PHP Flags a Third, Less Likely Code Execution Route in a Week; South Korea's KISA Urges an Interim Fix CVE-2026-115560 has no patch yet. PHP calls it unlikely and needs three conditions; KISA says the 21 October P... KE Kenji Tanaka 26 Oct Cybersecurity 6 min CISA Orders Three-Day Fix for Exploited Collabora Flaw in Nextcloud's Built-In Office Server Attackers planted web shells through a Nextcloud add-on for weeks before a CVE existed. US federal agencies no... KE Kenji Tanaka 24 Oct Cyber Threat Intel 6 min Arista Patches Exploited VeloCloud Orchestrator Flaw That a Read-Only Login Can Trigger CVE-2026-114625, a SQL injection bug scored 9.9, lets any logged-in tenant user gain operator rights on on-pre... PR Priya Nair 23 Oct Cybersecurity 7 min PHP Fixes Two Critical Remote Code Flaws as Exploit Attempts Began Days Before the Patch Amazon's honeypots were targeted on 17 October, while the bugs were still under embargo. Singapore's CSA and t... KE Kenji Tanaka 23 Oct Cyber Threat Intel 6 min Qilin and Inc Ransomware Groups Exploit Palo Alto GlobalProtect Flaw, Unit 42 Says Palo Alto's researchers say two ransomware crews use CVE-2026-0257 to slip past MFA, then move to vCenter and... PR Priya Nair 21 Oct Cybersecurity 6 min Unit 42 Links Fortinet Path-Traversal Bug to Memory-Only FortiGate Implant in Telecom Intrusion Attackers stole the configurations of 500+ firewalls from one FortiManager, then planted PEERSTITCH. CISA adde... KE Kenji Tanaka 20 Oct AI & ML 6 min Claude Opus 5 Wrote the Exploit. Three People Aimed It. A forum image upload led to an over-permissioned login token, and from there into employee accounts and an int... KE Kenji Tanaka 20 Sep Cybersecurity 5 min SolarWinds Shipped a Hard-Coded Key in Access Rights Manager The advisory names no victim and no campaign, and the vector says adjacent network rather than the open intern... PR Priya Nair 20 Sep Cybersecurity 5 min Orkes Conductor Was Patched in June. One Vendor Blocked 1,290 Attempts in a Day. The fix shipped three months ago and a public exploit followed in August. Fortinet says daily attempts against... PR Priya Nair 19 Sep Cyber Threat Intel 5 min A Pixel Modem Flaw Needs No Tap, and CISA Gave Three Days The modem is a separate computer that answers to the mobile network, not to you. Nothing has to be opened, cli... PR Priya Nair 19 Sep AI & ML 6 min Four AI Coding Agents Pinned Plugins to a Hash They Never Checked Git resolves a branch name before a commit hash, and nobody verified what came back. Two vendors patched it mo... KE Kenji Tanaka 19 Sep Cybersecurity 5 min A 7.8 Flaw in Acronis Backup Plugins Is Being Exploited Now Local privilege escalation rarely alarms anyone. On shared hosting, where every customer already has a low-pri... KE Kenji Tanaka 18 Sep Cybersecurity 5 min Cisco Found a 10.0 Identity Services Engine Zero-Day in a Support Case An authentication bypass on the appliance that decides who gets onto the network, scored 10.0, already being e... KE Kenji Tanaka 18 Sep Cybersecurity 5 min Forged Admin Tokens Are Hitting WSO2 API Gateways Patched Five Months Ago A token signed with an algorithm the gateway does not support is accepted anyway. WSO2 scored it 10.0 and ship... KE Kenji Tanaka 17 Sep Cybersecurity 7 min PaperCut's First Emergency Patch Was Bypassable. Here Is the Second One. PaperCut has shipped a second emergency patch after researchers walked around the first. A vendor under active... PR Priya Nair 1 Sep Developer Tools 6 min Five Critical WordPress Flaws, and None of Them Needs an Account Most WordPress advisories describe flaws that need an account first. These five do not, which is what a 9.8 is... MA Maya Lin 31 Aug Cybersecurity 6 min The Most Exploited Flaw Classes Were All Solved Decades Ago Improper input validation, path traversal and command injection top the list of what attackers actually use. A... KE Kenji Tanaka 31 Aug Cybersecurity 7 min CISA Listed Two Flaws as Exploited. The Attacker Was OpenAI's Own Agent. An agent noticed the kernel under its container was vulnerable, fetched a public exploit, adapted it and took... KE Kenji Tanaka 29 Aug Cybersecurity 7 min The Unitree Robot Bluetooth Flaw Was a Missing Cloud Check Two root RCE chains against the G1 EDU, one starting over Bluetooth without pairing. The step that made it wor... KE Kenji Tanaka 29 Aug Cyber Threat Intel 8 min US Agencies Have Until Tuesday To Patch The Windows Flaw Lazarus Is Using CVE-2026-68820 sits in Winsock, the same component North Korean operators abused in 2024. Check Point ties cur... PR Priya Nair 23 Aug Cybersecurity 8 min The Zimbra Patch Was Out For A Month Before Anyone Noticed It Being Exploited CVE-2026-73570 gives an unauthenticated attacker shell commands as the zimbra user, but only where an optional... KE Kenji Tanaka 23 Aug Cybersecurity 8 min The Sandbox Everyone Uses To Run Untrusted JavaScript Can Be Escaped A type-confusion flaw in isolated-vm's ExternalCopy lets sandboxed code corrupt host memory and potentially re... KE Kenji Tanaka 22 Aug Cyber Threat Intel 8 min Attackers Are Using MLflow To Ask The Cloud For Its Own Credentials CVE-2026-64849 is an unauthenticated server-side request forgery in MLflow scoring 9.3. Two days after disclos... PR Priya Nair 22 Aug