Browsers block 8 compromised eMudhra intermediate CA keys
A researcher proved possession of the private keys for eight eMudhra intermediate CAs. Chrome, Firefox, Apple and Microsoft have blocked them; Go shipped a fix.
Stories tagged: #advisory
PHP ships emergency release for two critical flaws (CVSS 9.2)
PHP will publish an out-of-cycle security release at 14:00 UTC on Oct 21 for two flaws it rates CVSS 9.2. Only branches 8.2–8.5 get the fix. Prepare to patch.
FBI, CISA detail SafePay ransomware: 600+ victims since 2024
Joint advisory AA26-293A documents SafePay ransomware: 600+ victims since Aug 2024, five exploited CVEs, and a full IOC set. The .SafePay extension and LockBit code overlap.
Go blocks eight CA keys in emergency 1.27.3/1.26.10 update
Go 1.27.3 and 1.26.10 hard-block eight intermediate CA keys over undisclosed 'security concerns.' Chains through them now fail with x509: no valid chains built. Rebuild.
Plex2Shell chain exploited within a day of public PoC
Four Plex Media Server bugs (CVE-2026-96652 to -96656) chain to unauthenticated RCE. A honeypot saw in-the-wild exploitation the day after the PoC dropped. Fixes shipped September 1.
Siemens Software Center flaw abused in ClickFix attacks
Siemens says CVE-2026-110936, a DLL search-order flaw in Software Center, is being abused in the Romulus ClickFix campaign. The fix is in 4.0.9.8; hunt behaviorally.
SiteGuard WAF command injection CVE-2026-106931 exploited for root
JPCERT/CC and vendor EG Secure confirm active exploitation of CVE-2026-106931, an OS command injection in SiteGuard Server Edition WAF that runs commands as root/SYSTEM. Fixes shipped.
Collabora CODE RCE hits Nextcloud: CVE-2026-110447 exploited
CVE-2026-110447 (CVSS 9.2) is an unauthenticated command injection in Nextcloud's built-in Collabora CODE server, exploited since September to plant PHP webshells. Update to 26.4.303.
Adobe patches CVSS 10 Magento RCE (CVE-2026-103849)
CVE-2026-103849 is an unauthenticated, CVSS 10.0 template-engine injection in Adobe Commerce and Magento Open Source through 2.4.9. Patch APSB26-153 shipped; no exploitation seen yet.
AOMEI Backupper update servers hijacked to push a backdoor
GTIG and ManageEngine say attackers tampered with AOMEI Backupper's update files in minutes-long windows from May to July 2026, delivering the SHINYROAD backdoor. No fixed version yet.
BeyondTrust patches Remote Support zero-day exploited since August
CVE-2026-102764 (CVSS 9.3) let a China-nexus actor Mandiant calls Armory Castle take over self-hosted BeyondTrust Remote Support appliances from August 29. Patch now.
Drupal patches critical Field UI RCE reachable via modules
Drupal core flaw CVE-2026-108097 (SA-CORE-2026-014, 19/25) runs arbitrary PHP via an unchecked #region_callback in Field UI; contributed modules expose an unauthenticated RCE path.
Next.js ships out-of-band fix for two critical RCE flaws
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCE flaws — one in use cache, one via SVG image optimization (CVE-2026-96889) — plus a Server Actions DoS.
NGINX fixes five flaws, including a TLS client-cert bypass
NGINX 1.30.6 and 1.31.7 fix five CVEs: three heap bugs that can crash workers, an HTTP/3 request-smuggling bug, and a TLS session-ticket forgery that can skip client-cert checks.
Cisco patches exploited Secure Email Gateway root RCE
CVE-2026-76519 (CVSS 9.8) lets an unauthenticated sender write files and run commands as root on Cisco Secure Email Gateway via a crafted attachment. Exploited in the wild.
curl patches HTTP/2 use-after-free that a PoC turned into RCE
curl 8.23.0 fixes CVE-2026-92392, a use-after-free a malicious HTTP/2 server can trigger during an upload. A PoC reached code execution; curl rates it High.
Microsoft, Health-ISAC seize domains behind 1B phishing messages
Microsoft's DCU and Health-ISAC seized domains for YAM Store, CoGUI and Iron Man — a Chinese-language phishing marketplace Microsoft ties to over 1 billion messages since January.
Docker Hub CVE-2026-105445 let tokens impersonate repo owners
A Docker Hub flaw (CVE-2026-105445) transferred personal access tokens during account-to-org conversions, letting an attacker push or delete images as another user. Fixed; no abuse found.
GitHub hardens npm trusted publishing after SlugFest flaw
GitHub tightened npm's trusted publishing after Bloom Security's 'SlugFest' showed claiming an abandoned repo slug could hijack 1,500+ packages. Unvalidated configs now expire in 48 hours.
Ivanti Connect Secure zero-days chained for root on patched VPN
Volexity found attackers chaining three Ivanti Connect Secure zero-days (incl. CVE-2026-104935) for root on a fully patched VPN. Two are patched; the root-escalation bug is not.
LG webOS TVs: pre-auth root chain from the local network, no CVE yet
A three-bug webOS chain disclosed by SSD gives root on LG smart TVs from the same LAN, with no PIN or owner action. LG has shipped a firmware fix; no CVEs assigned.
MarkLogic patches 31 flaws, 5 critical: privileged users can seize admin
Progress disclosed 31 MarkLogic flaws on Oct 12, five critical (CVSS up to 9.9). Each escalates an already-privileged user to persistent admin or code execution. Fixed in 11.3.7 and 12.1.0.
Microsoft's October Patch Tuesday fixes 1,411 flaws, one exploited
Microsoft's October 2026 Patch Tuesday fixed over 1,400 flaws, including an exploited Windows Shell bypass (CVE-2026-96951) and a disclosed .NET bug (CVE-2026-108398).
SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111, CVSS 10.0)
An unauthenticated SSRF in SAP Cloud SDK for Python lets an attacker who controls tenant_subdomain redirect OAuth2 token requests and steal client credentials. Fixed in 0.45.2.
GitLab patches CVSS 10.0 unauthenticated RCE in CI/CD regex compiler (CVE-2026-97229)
CVE-2026-97229 lets an unauthenticated user run arbitrary code on a GitLab server via a crafted CI/CD regular expression. Fixes are in 19.4.2, 19.3.4, and 19.2.8.
Let's Encrypt moves to 64-day certificates by default in 2027
Let's Encrypt cuts its default certificate lifetime from 90 to 64 days on February 10, 2027, with 45-day certs following in 2028. If renewals aren't ARI-aware, fix that now.
AhsayCBS unauth RCE (CVE-2026-105134) exploited, no patch yet
Attackers chain two AhsayCBS flaws into unauthenticated SYSTEM RCE and drop XMRig miners. Huntress confirms active exploitation; every version through 10.3.4 is affected and no fix exists.
Citrix patches critical NetScaler SAML flaw CVE-2026-107406
Citrix patched CVE-2026-107406, a CVSS 9.5 memory-overflow flaw in NetScaler ADC and Gateway SAML deployments that can lead to RCE or DoS. No exploitation reported yet.
SonicWall SMA1000 pre-auth SSRF CVE-2026-102255 scores 10.0
SonicWall patched CVE-2026-102255, a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace. Exploitation attempts are now being observed in the wild, two days after the October 6 patch.
US seizes Flax Typhoon tools, adds five flaws to CISA KEV
DOJ and FBI seized Flax Typhoon tools Microscan and FishHub tied to Integrity Technology Group, and CISA added five exploited flaws to its KEV catalog with an October 11 federal deadline.
Atlassian patches critical file-read flaw CVE-2026-21589
CVE-2026-21589 lets unauthenticated attackers read files from eight Atlassian Data Center products. CVSS 9.3. Patch now; cloud instances are not affected.
ClickFix campaign hits 100+ Ukrainian sites with Lunex stealer
CERT-UA, tracking the activity as UAC-0277, says more than 100 compromised websites push fake Cloudflare checks that trick users into running PowerShell and installing Lunex Stealer.
LibreOffice RCE via JDBC runs code with no macro warning
CVE-2026-63277 lets a crafted LibreOffice Calc document load a remote Java driver and run code on open — no macro prompt. Fixed in 26.2.5 and 26.8.0.
Citrix patches exploited NetScaler SAML zero-day (CVE-2026-88779)
Citrix patched CVE-2026-88779, a SAML memory-overflow zero-day in NetScaler ADC/Gateway hitting already-patched appliances. Fix is in 14.1-73.41/13.1-64.28; CISA KEV deadline Oct 7.
Dell System Update CVE-2026-86360: root RCE on PowerEdge
CVE-2026-86360, a CVSS 9.6 path-traversal flaw in Dell System Update, lets an unauthenticated remote attacker run code as root. Fix is DSU 2.3.0.0; four more CVEs patched alongside.
Exchange flaw CVE-2026-96940 lets users read colleagues' mail
CVE-2026-96940, a CVSS 8.8 weak-authorization flaw in on-prem Exchange, lets an authenticated user read other mailboxes in the same org. Fix ships in the September V2 security updates.
Rejetto HFS session-forgery flaw (CVE-2026-61500) under attack
Attackers are forging admin sessions on Rejetto HFS via CVE-2026-61500, a weak-PRNG flaw scored 9.3. Fix is in 3.2.1; VulnCheck reports exploitation and a PoC is public.
MI5 names CGTRI as MSS front, warns 100+ UK academics
MI5's first self-published espionage alert says the China General Technology Research Institute funds UK academic research to boost MSS espionage capability. Review CGTRI funding ties now.
Dell CSM: two CVSS 10 auth-bypass flaws, patch to 1.18.0
Dell's DSA-2026-448 fixes two maximum-severity authentication-bypass bugs in Container Storage Modules that hand attackers full admin control of storage backends. Fixed in CSM 1.18.0.
Cisco patches exploited SD-WAN Manager auth bypass (CVE-2026-76504)
Cisco fixed CVE-2026-76504 (CVSS 9.8), an unauthenticated API auth bypass in Catalyst SD-WAN Manager already exploited in the wild. CISA added it to KEV the same day.
Kiteworks patches critical Advanced Forms flaw in release 9.5.1
Kiteworks took systems offline for a weekend on federal threat intel, then found and patched a critical flaw in its Advanced Forms feature. Fix is in release 9.5.1; no CVE assigned yet.
Microsoft Entra ID to enforce CSP, blocking sign-in script injection
From mid-October 2026, Entra ID enforces a Content Security Policy on login.microsoftonline.com, allowing only Microsoft-trusted scripts. Extensions and tools that inject code into sign-in will break.
CISA flags pre-auth root RCE in MikroTik RouterOS (CVE-2026-84411)
CISA warns of CVE-2026-84411, a CVSS 9.8 pre-auth integer underflow in RouterOS web management that yields root code execution. Fixed in 7.24 and 7.23.7 LTS; no known exploitation yet.
OpenSSL patches DTLS heap-disclosure flaw CVE-2026-84782
OpenSSL fixed CVE-2026-84782, a high-severity DTLS flaw that can leak unencrypted heap memory or crash DTLS apps; WolfSSL 5.9.4 separately patched three high-severity auth-bypass flaws.
TeamViewer patches CVE-2026-92370 access-control bypass (CVSS 8.8)
TeamViewer's 15.82 release fixes five high-severity flaws, led by CVE-2026-92370 (CVSS 8.8), a session access-control bypass that can lead to code execution. No exploitation reported yet.
WatchGuard patches critical Fireware OS RCE (CVE-2026-86131)
WatchGuard fixed CVE-2026-86131 (CVSS 9.2), a code-injection flaw letting a malicious BOVPN-over-TLS server run root commands on a connecting Firebox, plus 13 more high-severity Fireware OS bugs.
Apple patches exploited CoreGraphics zero-day (CVE-2026-86950)
Apple shipped iOS/iPadOS 26.7.1 and macOS 15.8.1/26.7.1 for CVE-2026-86950, a CoreGraphics out-of-bounds write used in targeted attacks and reported by Meta.
Citrix patches exploited NetScaler zero-days (CVE-2026-88771, CVSS 9.5)
Citrix patched eight NetScaler ADC/Gateway flaws, two exploited as zero-days. CVE-2026-88771 hits default configs; a public PoC exists and web shells are being dropped.
ServiceNow CVE-2026-6875: pre-auth sandbox escape RCE now exploited
ServiceNow's July 13 patch closes CVE-2026-6875 — a pre-auth sandbox escape in the AI Platform that yields unauthenticated RCE. Defused observed in-the-wild exploitation five days later.
Zimbra 10.1.20 patches critical command injection plus three CVEs
Zimbra shipped Daffodil 10.1.20 with a critical command injection in the SNMP monitor, four Classic UI XSS bugs, an SSRF in Nextcloud, and CVE-2026-50055 / CVE-2026-10631 / CVE-2026-50054.
SonicWall SMA1000 zero-days chained: CISA adds CVE-2026-15409 and 15410 to KEV
CISA added SonicWall SMA1000 zero-days CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 to KEV on July 14, chained by Rapid7 MDR. Federal deadline July 17.
SAP patches NetWeaver ABAP memory corruption (CVE-2026-44747, CVSS 9.9)
SAP's July 14 Patch Day ships 16 notes: a NetWeaver ABAP memory-corruption bug at CVSS 9.9, an Approuter request-smuggling flaw and Commerce Cloud default credentials both at 9.1.
Zimbra 10.1.19 patches Classic Web Client stored XSS, TAG-reported
Zimbra shipped Daffodil 10.1.19 on July 7 to fix a stored XSS in the Classic Web Client where a crafted email runs JavaScript in the recipient's mailbox session. Reporter: Google TAG. No CVE assigned.
Tenda routers ship a hidden backdoor password — CVE-2026-11405 unpatched
CERT/CC disclosed CVE-2026-11405 on July 6: five Tenda firmware images ship a plaintext strcmp() backdoor in /bin/httpd. Tenda didn't respond and no patch is available.
Ubiquiti UniFi Connect CVE-2026-50746 (10.0): SAB-066 lands 25 flaws
Ubiquiti's SAB-066 patches 25 UniFi flaws led by CVE-2026-50746 — an unauthenticated command injection in Connect ≤3.4.16 (CVSS 10.0). Fix ships in Connect 3.4.20.
JetBrains Hub ships 2026.1.13757 patching two critical auth-bypass CVEs
JetBrains Hub 2026.1.13757 fixes CVE-2026-50242 (CVSS 10.0 auth bypass) and CVE-2026-56141 (CVSS 9.8 account takeover via predictable restore codes). LTS backports available.
runZero drops seven FatFs CVEs; only CVE-2026-6684 fixed in R0.16
Seven FatFs bugs disclosed July 1 by runZero — FAT32, exFAT and long-filename paths across ESP-IDF, STM32Cube, Zephyr, MicroPython. Only CVE-2026-6684 has an upstream fix.
Oracle EBS Payments CVE-2026-46817 exploited before any public PoC existed
Defused honeypots caught in-the-wild exploitation of CVE-2026-46817 (CVSS 9.8) on June 27, six weeks after Oracle's May patch. ~950 EBS instances are internet-exposed.
Progress LoadMaster CVE-2026-8037: pre-auth root RCE, PoC-ready diff
Progress patches an unauth pre-auth command-injection RCE in Kemp LoadMaster. CVSS 9.8. GA 7.2.63.2 and LTSF 7.2.54.18 ship the fix; watchTowr posted the full chain on June 29.
OpenAM 16.1.1 patches 10+ CVEs as wodzen coordinated disclosure rolls out
OpenAM 16.1.1 shipped June 17 with fixes for 17 CVEs. Public advisories began June 22 and continued through June 29: pre-auth RADIUS spoof, MSISDN LDAP injection, OAuth2 takeover, Groovy sandbox RCE.
FBI: Russian intel now phishes Signal Backup Recovery Keys
FBI PSA I-062626-PSA names UNC5792 and UNC4221, attributes the activity to Russian Intelligence Services, and adds a new Signal Backup Recovery Key phishing tactic to the March warning.
Ubiquiti UniFi OS: three chained CVSS 10.0 flaws hit CISA KEV (CVE-2026-34908/34909/34910)
CISA gave federal agencies three days to patch the Bulletin 064 UniFi OS triple — access control bypass, path traversal, command injection — all CVSS 10.0, all exploited.
Lantronix EDS5000 CVE-2025-67038 in CISA KEV — patch deadline is today
CISA added the CVSS 9.8 command-injection bug — plus three perfect-10 UniFi OS flaws — to KEV on June 23. BOD 26-04 forces federal patching by June 26.
PTC Windchill CVE-2026-12569 in CISA KEV — federal patch deadline June 28
CISA added the CVSS 10 deserialization RCE in Windchill PDMLink and FlexPLM to KEV on June 25. PTC ships patches, BSI repeats the alarm. Three days to act.
Squidbleed: 29-year-old Squid FTP gateway leaks heap memory (CVE-2026-47729)
Squid project published SQUID-2026:4 on June 23 — a heap over-read in the FTP gateway that leaks raw memory to a malicious FTP server. Fix in Squid 7.6.
Splunk Enterprise CVE-2026-20253: KEV-listed unauthenticated RCE via PostgreSQL sidecar
CVE-2026-20253 is a CVSS 9.8 missing-authentication flaw in Splunk Enterprise 10. CISA added it to KEV on June 18 with a three-day patch deadline. WatchTowr published a working RCE exploit.
Node.js ships June 18 security release — 12 CVEs across v22, v24, v26
Node.js v22.23.0, v24.17.0 and v26.3.1 fix 12 CVEs including a TLS wildcard hostname bypass (CVE-2026-48618) and a WebCrypto integer overflow DoS (CVE-2026-48933).
Gravity SMTP CVE-2026-4020: API keys leaked, 17M exploit attempts
Wordfence blocked 17M attempts at the unauth REST endpoint that dumps Gravity SMTP's full System Report — live API keys and OAuth tokens included. Patch is 2.1.5.
JetBrains pulls 15 plugins exfiltrating AI API keys, 70K installs
Aikido Security found 15 JetBrains Marketplace plugins under 7 vendor accounts that exfiltrated OpenAI, DeepSeek, and SiliconFlow keys over plaintext HTTP. JetBrains pulled them on June 16, 2026.
SurrealDB 3.1.5 patches five flaws; lead is a HIGH file read
SurrealDB shipped 3.1.5 on June 19, closing five same-day GitHub advisories — including arbitrary file read via DEFINE ANALYZER mapper at CVSS 7.7. No CVE IDs assigned yet.
FortiBleed dumps 73,932 Fortinet firewall creds; CISA orders resets
Researcher Bob Diachenko found an open attacker server holding plaintext admin and SSL VPN credentials for 73,932 FortiGate appliances across 194 countries. CISA issued reset guidance June 18.
NGINX 1.31.2 / 1.30.3 patches HTTP/3 UAF (CVE-2026-42530) and two more
F5 shipped NGINX 1.31.2 and 1.30.3 on June 17 fixing a use-after-free in the HTTP/3 module, a heap overflow in proxy_v2/grpc, and a buffer overread in charset.
Cisco SD-WAN Manager CVE-2026-20262 exploited, KEV-added
Second Cisco Catalyst SD-WAN Manager zero-day in two weeks. CVE-2026-20262 is an arbitrary file write under exploitation; CISA gave agencies until June 29 to patch.
CISA adds JCE Joomla CVE-2026-48907 to KEV — pre-auth RCE, CVSS 10
CISA added CVE-2026-48907 to KEV on June 16 — an unauth profile-import chain in the JCE Joomla extension that lets attackers upload and execute PHP. Patch in JCE 2.9.99.5.
LiteSpeed cPanel CVE-2026-54420 in KEV: symlink path to root, second LiteSpeed cPanel KEV in 3 weeks
CISA added CVE-2026-54420 — a CVSS 8.5 symlink-following bug in the LiteSpeed cPanel plugin — to KEV on June 15. Federal patch deadline: June 18.
Fortinet patches unauth command injection in FortiSandbox (CVE-2026-25089)
Crafted HTTP requests against the FortiSandbox web UI yield OS command execution. CVSS 9.1. No active exploitation reported. Fixed in 5.0.6 and 4.4.9.
Langflow CVE-2026-5027 exploited; fix shipped but unlabelled
VulnCheck added CVE-2026-5027 to its KEV on June 8 after detecting in-the-wild exploitation. Path traversal in /api/v2/files yields unauth RCE; ~7,000 instances are publicly exposed.
Everest Forms Pro CVE-2026-3300 exploited since April 13 to plant rogue admins
Wordfence's firewall blocked 29,300+ exploit attempts against a CVSS 9.8 PHP-eval RCE in Everest Forms Pro. Sites pre-1.9.13 should hunt for the rogue admin diksimarina.
Arista EOS CVE-2026-7473 added to CISA KEV — vendor says no patch coming
Tunnel-decap logic flaw in Arista EOS lets crafted VXLAN/GRE/decap-group packets reach configured decap IPs. Exploited in the wild. Arista will not patch — mitigate with ACLs.
Microsoft June 2026 Patch Tuesday: 3 publicly disclosed zero-days
Microsoft's June 9 Patch Tuesday fixes around 200 CVEs and 33 Critical flaws, including publicly disclosed zero-days in BitLocker, HTTP.sys (HTTP/2 Bomb) and CTFMON.
Veeam patches critical RCE in Backup & Replication (CVE-2026-44963)
An authenticated domain user can run code on a domain-joined VBR backup server. CVSS 9.4. Fixed in 12.3.2.4854; v13 is not affected.
Check Point patches IKEv1 VPN bypass CVE-2026-50751, exploited since May
Check Point hotfixes a CVSS 9.3 cert-validation bypass on Remote Access and Mobile Access VPN. Exploitation since May 7, 2026 — one case linked to a Qilin affiliate.
CISA adds SolarWinds Serv-U CVE-2026-28318 to KEV, DoS in the wild
CISA added CVE-2026-28318 — an unauthenticated DoS in SolarWinds Serv-U — to KEV on June 5. CVSS 7.5. Fix is 15.5.4 Hotfix 1. FCEB deadline June 19.
Anthropic patches Claude Code GitHub Action repo-takeover chain
GMO Flatt Security's RyotaK chained a checkWritePermissions bot bypass with prompt injection to hijack any public repo running claude-code-action. Fix shipped in v1.0.94.
Cisco SD-WAN Manager CVE-2026-20245 exploited, no patch yet
Cisco disclosed a command-injection zero-day in Catalyst SD-WAN Manager on June 5. Mandiant credited as reporter. CVSS 7.8, exploitation observed, no fix available.
VS Code github.dev zero-day exposed full GitHub OAuth tokens in one click
Researcher Ammar Askar dropped a webview-postMessage exploit on June 2 that steals github.dev OAuth tokens via a single click. Microsoft shipped a stopgap fix the next day.
Red Hat npm packages backdoored: Miasma worm hits @redhat-cloud-services
Red Hat security bulletin RHSB-2026-006 confirms 32 @redhat-cloud-services npm packages were trojaned on June 1, 2026 with a self-spreading credential-stealing worm derived from Shai-Hulud.
npm supply-chain campaign: 14 typosquats target AWS, Vault, npm tokens
Microsoft says a single maintainer 'vpmdhaj' pushed 14 typosquatted npm packages on May 28 that exfiltrate AWS, ECS, HashiCorp Vault and npm tokens via a Bun-runtime payload.
Palo Alto GlobalProtect auth bypass (CVE-2026-0257) added to CISA KEV after weeks of exploitation
PAN-OS portals with authentication-override cookies on a shared certificate let attackers forge a valid session. Rapid7 observed exploitation since May 17. Federal patch deadline June 19.
CISA links GitHub repo exfiltration to malicious Nx Console 18.95.0
CISA's May 28 alert ties the 3,800-repo GitHub breach to a poisoned Nx Console VS Code extension. CVE-2026-48027 is in KEV. Federal deadline June 10.
Gitea CVE-2026-27771: anyone could pull your private container images, no login
An access-control flaw in Gitea's container registry let anonymous clients pull images marked private. Patched in 1.26.2. Forgejo affected too.
Starlette BadHost (CVE-2026-48710): one Host header bypasses auth in FastAPI, vLLM, MCP
X41 D-Sec discloses CVE-2026-48710 in Starlette <1.0.1: a Host-header re-parse desync that lets attackers forge request.url.path. Upgrade to 1.0.1.
Ghost CMS SQLi (CVE-2026-26980) hijacks 700+ sites — Harvard, Oxford, DuckDuckGo serve ClickFix
An unauthenticated SQL injection in Ghost's Content API leaks admin API keys. Attackers chain it into stored XSS and a fake Cloudflare ClickFix lure. Upgrade to 6.19.1.
Drupal patches highly critical SQL injection (CVE-2026-9082) — exploited in the wild within 48h
An unauthenticated SQL injection in Drupal core's database abstraction API affects every PostgreSQL-backed site. Drupal scored it 23/25. Attacks started two days after the patch dropped.
Laravel-Lang Composer packages hijacked — 700+ versions ship a credential stealer
Attackers rewrote Git tags across four Laravel-Lang repos to point at a malicious fork, planting a Composer-autoloaded stealer that runs on every request. Packagist has unlisted the packages.
LiteSpeed cPanel plugin RCE (CVE-2026-48172, CVSS 10.0) actively exploited — any cPanel user can run code as root
A privilege-escalation flaw in the LiteSpeed User-End cPanel plugin lets any cPanel account execute arbitrary scripts as root. Mass scanning began within 72 hours of disclosure.