Research
A critical flaw in the Storybook development server could let a malicious website change files in a developer's project while the server runs. Upgrade to a patched version before running the dev server again.
Attackers used stolen remote-management keys to install malicious plugins and create administrator accounts. Updating UpdraftPlus blocks the stolen keys but does not remove malware already installed. ([teamupdraft.com](
CISA says attackers are exploiting a flaw in Plex Media Server (CVE-2026-96656) that lets an admin user write files that may run when loaded. Apply the vendor's fixes and check your exposure.
CISA says attackers are exploiting a flaw in Plex Media Server (CVE-2026-96655) that lets a logged-in user make the server send requests to addresses of their choosing. Plex users should follow the vendor's instructions to fix or mitigate it.
CISA says attackers are exploiting a flaw in Plex Media Server (CVE-2026-96654). Apply the vendor's fixes or mitigations as soon as you can.
CISA says attackers are exploiting a server-side request forgery flaw (CVE-2026-96652) in Plex Media Server. Plex users should apply the vendor's mitigations and check whether their server is exposed to the internet.
CISA says attackers are exploiting CVE-2026-110936, a flaw in Siemens Software Center that can let a local user run code. Check Siemens' advisory and apply its mitigations now.
CISA says attackers are exploiting CVE-2026-106931, a command injection flaw in EG Secure Solutions SiteGuard Server Edition. It could let an attacker run commands with full control of the system, so apply the vendor's fixes now.
CISA says attackers are exploiting CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support. A remote attacker could perform file operations on the appliance, so apply the vendor's mitigations now.
CISA says attackers are exploiting CVE-2025-61624, a path traversal flaw in several Fortinet products. Affected organizations should apply Fortinet's mitigations and check their systems for signs of misuse.
A critical-severity flaw in @tanstack/start-server-core, published by GitHub on 15 October 2026. Update to 1.169.39 or later.
A high-severity flaw in leantime/leantime, published by GitHub on 15 October 2026. Update to 3.10.0 or later.
A high-severity flaw in react/http, published by GitHub on 15 October 2026. Update to 1.11.1 or later.
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
9 new posts in the last 24 hours, 6 rated critical.
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix PHP2Shell, two critical flaws that let attackers take over servers. Upgrade PHP on your server now.
The grade is a quick, passive look at how a website or GitHub repo is set up, from A+ to F. It points at real problems, but a good grade is not a guarantee.
AI tools are surfacing serious flaws faster than ever, and attackers use AI too. The answer is not exciting, but it works: patch faster and expose less.
Many crypto project sites run on WordPress. If an attacker takes over the server, they can quietly swap a real claim button for a wallet drainer.
Find out which PHP version your server runs, then compare it with the fixed versions. It takes a few minutes and one message to your host.
Two critical flaws in PHP itself let an attacker run code on a web server with no login. Updating WordPress or plugins does not fix it: only upgrading PHP on the server does.
