Cyber Security
Application Security
WP Duplicate Plugin Flaw CVE-2026-123751 Exploited With No Patch
WPScan reports attackers are exploiting CVE-2026-123751 in the WP Duplicate WordPress plugin, an unauthenticated upload flaw leading to remote code execution.
CVE Vulnerability Alerts
SonicWall Patches Exploited SonicOS SAML MFA Bypass, CVE-2026-19868
SonicWall patched CVE-2026-19868, a SonicOS SSL VPN flaw that bypasses SAML MFA, and CISA added it to its KEV catalog after a report of possible ...
Application Security
UnrealIRCd Warns CVE-2026-114713 Is Under Attack, Worst in 15 Years
The UnrealIRCd team says attackers are exploiting CVE-2026-114713, a labeled-response flaw it calls the most critical issue in 15 years, on linked IRC networks.
Application Security
JPCERT/CC Warns Openwave Webtop Flaw CVE-2026-111793 Is Exploited
JPCERT/CC says attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder, a flaw patched in December 2021 that exposes sensitive data.
Application Security
Public PoC Released for Hugging Face Datasets RCE CVE-2026-57845
A researcher published a working exploit for CVE-2026-57845, a CVSS 8.8 pickle deserialization flaw in Hugging Face datasets up to 5.1.0 with no fix available.
Application Security
uutils Coreutils Flaw (CVSS 9.9) Let Translation File Inject Code
A CVSS 9.9 flaw in the uucore crate of uutils coreutils let a crafted translation file inject Rust code at build time. A PoC is ...
CVE Vulnerability Alerts
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
A researcher released a working exploit for CVE-2026-97798, a Windows Error Reporting flaw that gives SYSTEM from a standard account, patched in October.
Application Security
ModSecurity Flaws Detailed: WAF Upload Bypass CVE-2026-104269
Advisories detail ModSecurity flaw CVE-2026-104269, a WAF upload-rule bypass with a public PoC, and CVE-2026-73857, an XML crash bug. Both fixed in 3.0.17.
Application Security
IBM Discloses 208 API Connect Flaws, 47 Rated Critical
IBM disclosed 208 vulnerabilities in API Connect, 47 critical and scored up to CVSS 9.9, plus a 9.8 flaw in Aspera Faspex. No exploitation has ...
Cybersecurity
Brenner Base Tunnel SE Confirms Data Access as Everest Claims 812 GB
Brenner Base Tunnel SE confirmed unauthorized access to some data after the Everest extortion group claimed 812 GB. The company says operations are unaffected.
Cybersecurity
Who Gives A Crap Customers Exposed in Marketing Provider Breach
Who Gives A Crap told customers in Australia, the UK and US that a marketing software provider was breached, exposing names, contacts and spend data.
Application Security
Apiiro Finds 1,994 GitHub Repos Leaking Secrets via Claude Code Files
Apiiro found 2,539 secrets across 1,994 public GitHub repositories, leaked through Claude Code settings files created by the 'don't ask again' option.
Cybersecurity
Fake GitHub Security Tools Infect 2,000+ PCs, Doctor Web Reports
Doctor Web says trojanized GitHub projects posing as security tools have infected more than 2,000 PCs, using an Electron-based loader that disables Defender.
Cybersecurity
Ex-FBI Agent Yaroch Pleads Guilty to Stealing $2.47M in Seized Crypto
Former FBI employee Patrick Yaroch pleaded guilty to wire fraud and money laundering over $2,474,380 in crypto stolen from wallets in 35 FBI investigations.
Cybersecurity
US and EU Agencies Warn Refrigeration Hacks Have Reached Blood Banks
FBI, CISA and EU agencies warn that attacks on refrigeration controllers have spread from European supermarkets to French blood service sites, advisories say.
Application Security
OpenSSH 10.6p2 Fixes ‘*sshole’ Password Bypass on Alpine, musl
OpenSSH 10.6p2 fixes a critical flaw that lets attackers log in to passwordless accounts on musl-based Linux such as Alpine by sending an overlong password.
Cybersecurity
Ransomware Disrupts Queens Public Library Across All 66 Branches
A ransomware attack encrypted Queens Public Library systems, knocking out Wi-Fi, computers, the website and app across 66 branches in New York City.
Cybersecurity
Norad Confirms Hackers Stole Data on All 20,614 Grants Portal Users
Norway's aid agency Norad says attackers stole names and emails of all 20,614 Grants Portal users across 12,511 organizations after abusing 27 accounts.
Cybersecurity
White House Network Addresses Found Acting as Residential Proxy Exits
Layer3 Intel says six White House network addresses relayed residential proxy traffic 236 times in a month, likely from a device running proxy software.
Application Security
Microsoft Patches Paint Remote Code Execution Flaw CVE-2026-83844
Microsoft fixed CVE-2026-83844, an out-of-bounds read in Paint on Windows 10 and 11 rated CVSS 8.1, with no exploitation or public exploit code reported.
Application Security
WP Duplicate Plugin Flaw CVE-2026-123751 Exploited With No Patch
TOP CYBERSECURITY HEADLINES
Application Security
JPCERT/CC Warns Openwave Webtop Flaw CVE-2026-111793 Is Exploited
Application Security
Public PoC Released for Hugging Face Datasets RCE CVE-2026-57845
Application Security
uutils Coreutils Flaw (CVSS 9.9) Let Translation File Inject Code
CVE Vulnerability Alerts
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
This Week’s Security Spotlight
CVE Vulnerability Alerts
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
CVE Vulnerability Alerts
Citrix Fixes CVSS 9.8 XenServer Flaw and Brotli Bug in Scout
CVE Vulnerability Alerts
ASUS Patches AiCloud Root Flaw CVE-2026-84730 in Four Alerts
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
JPCERT/CC Warns Openwave Webtop Flaw CVE-2026-111793 Is Exploited
JPCERT/CC says attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder, a flaw patched in December 2021 that exposes sensitive data.
Public PoC Released for Hugging Face Datasets RCE CVE-2026-57845
A researcher published a working exploit for CVE-2026-57845, a CVSS 8.8 pickle deserialization flaw in Hugging Face datasets up to 5.1.0 with no fix available.
uutils Coreutils Flaw (CVSS 9.9) Let Translation File Inject Code
A CVSS 9.9 flaw in the uucore crate of uutils coreutils let a crafted translation file inject Rust code at build time. A PoC is ...
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
A researcher released a working exploit for CVE-2026-97798, a Windows Error Reporting flaw that gives SYSTEM from a standard account, patched in October.
ModSecurity Flaws Detailed: WAF Upload Bypass CVE-2026-104269
Advisories detail ModSecurity flaw CVE-2026-104269, a WAF upload-rule bypass with a public PoC, and CVE-2026-73857, an XML crash bug. Both fixed in 3.0.17.
IBM Discloses 208 API Connect Flaws, 47 Rated Critical
IBM disclosed 208 vulnerabilities in API Connect, 47 critical and scored up to CVSS 9.9, plus a 9.8 flaw in Aspera Faspex. No exploitation has ...
Brenner Base Tunnel SE Confirms Data Access as Everest Claims 812 GB
Brenner Base Tunnel SE confirmed unauthorized access to some data after the Everest extortion group claimed 812 GB. The company says operations are unaffected.
Who Gives A Crap Customers Exposed in Marketing Provider Breach
Who Gives A Crap told customers in Australia, the UK and US that a marketing software provider was breached, exposing names, contacts and spend data.
Apiiro Finds 1,994 GitHub Repos Leaking Secrets via Claude Code Files
Apiiro found 2,539 secrets across 1,994 public GitHub repositories, leaked through Claude Code settings files created by the 'don't ask again' option.
Fake GitHub Security Tools Infect 2,000+ PCs, Doctor Web Reports
Doctor Web says trojanized GitHub projects posing as security tools have infected more than 2,000 PCs, using an Electron-based loader that disables Defender.
Ex-FBI Agent Yaroch Pleads Guilty to Stealing $2.47M in Seized Crypto
Former FBI employee Patrick Yaroch pleaded guilty to wire fraud and money laundering over $2,474,380 in crypto stolen from wallets in 35 FBI investigations.
US and EU Agencies Warn Refrigeration Hacks Have Reached Blood Banks
FBI, CISA and EU agencies warn that attacks on refrigeration controllers have spread from European supermarkets to French blood service sites, advisories say.
OpenSSH 10.6p2 Fixes ‘*sshole’ Password Bypass on Alpine, musl
OpenSSH 10.6p2 fixes a critical flaw that lets attackers log in to passwordless accounts on musl-based Linux such as Alpine by sending an overlong password.
Ransomware Disrupts Queens Public Library Across All 66 Branches
A ransomware attack encrypted Queens Public Library systems, knocking out Wi-Fi, computers, the website and app across 66 branches in New York City.
Norad Confirms Hackers Stole Data on All 20,614 Grants Portal Users
Norway's aid agency Norad says attackers stole names and emails of all 20,614 Grants Portal users across 12,511 organizations after abusing 27 accounts.
White House Network Addresses Found Acting as Residential Proxy Exits
Layer3 Intel says six White House network addresses relayed residential proxy traffic 236 times in a month, likely from a device running proxy software.
Microsoft Patches Paint Remote Code Execution Flaw CVE-2026-83844
Microsoft fixed CVE-2026-83844, an out-of-bounds read in Paint on Windows 10 and 11 rated CVSS 8.1, with no exploitation or public exploit code reported.
Apache OFBiz 24.09.08 Fixes 46 Flaws, Including Unauthenticated RCE
Apache OFBiz 24.09.08 fixes 46 vulnerabilities, including CVE-2026-83542, a CVSS 9.8 unauthenticated remote code execution flaw in the ERP platform.
GhostMap Android Bug Traps Phones in Boot Loop; Google Won’t Fix
Bitdefender disclosed GhostMap, an Android 10+ flaw that lets a permissionless app trap phones in an endless crash loop; Google has declined to issue a ...
Check Point: ChatGPT HTML Preview Flaw Bypassed Lockdown Mode
Check Point Research says a patched ChatGPT HTML preview flaw escaped the sandbox and bypassed Lockdown Mode, enabling silent chat theft via custom GPTs.