Attackers Scan for Rejetto HFS Session-Forgery Flaw CVE-2026-61500
October 7, 2026
Scanning has begun for CVE-2026-61500 in Rejetto HFS, a flaw that lets attackers forge admin cookies and reach remote code
Application Security
Attackers Scan for Rejetto HFS Session-Forgery Flaw CVE-2026-61500
Scanning has begun for CVE-2026-61500 in Rejetto HFS, a flaw that lets attackers forge admin cookies and reach remote code execution on versions 3.0.0-3.2.0.
LibreOffice, OpenOffice Flaws Run Code From Spreadsheets Silently
CVE-2026-63277 in LibreOffice and CVE-2026-59265 in Apache OpenOffice let malicious spreadsheets run code through JDBC drivers with no macro warning shown.
Atlassian Fixes Critical CVE-2026-21589 in Eight Data Center Products
Atlassian disclosed CVE-2026-21589, a CVSS 9.3 path traversal flaw that lets unauthenticated attackers read web-root files in eight Data Center products.
Rejetto HFS Flaw Lets Hackers Forge Admin Sessions for RCE
A critical Rejetto HFS flaw, CVE-2026-61500, lets attackers forge admin session cookies and gain remote code execution; active exploitation began October 1.
Google Pauses Open-Source Bug Bounty Over AI Report Flood
Google stopped accepting new submissions to its open-source bug bounty program after a flood of low-quality, AI-generated vulnerability reports arrived.
Kiteworks Patches Second Max-Severity Flaw in a Week
Kiteworks patched a maximum-severity code injection flaw found through its bug bounty program, marking its second critical disclosure in roughly a week.
Self-Healing WordPress Backdoor Defies Standard Removal
Sucuri found a WordPress backdoor, SC, that persists across eight file, database, and memory locations and rebuilds itself when any one is deleted.
Chrome, Firefox Patch Over 100 Flaws in Joint Update
Chrome and Firefox fixed over 100 vulnerabilities between them, including a critical ANGLE buffer overflow in Chrome rated capable of remote code execution.
Autonomous AI Agent Breaches Cybersecurity Nonprofit DIVD
An autonomous AI agent exploited a vulnerability to breach Dutch nonprofit DIVD on its own, leaving extensive forensic evidence of its intrusion attempt.
OpenAI Discloses Self-Replicating Worm-Style Prompt Injection
OpenAI disclosed that GPT models can be manipulated into self-replicating prompt injections that spread like a worm across connected tools and channels.
LibreOffice, OpenOffice Flaws Run Code From Spreadsheets Silently
October 7, 2026
CVE-2026-63277 in LibreOffice and CVE-2026-59265 in Apache OpenOffice let malicious spreadsheets run code through JDBC drivers with no macro warning
Atlassian Fixes Critical CVE-2026-21589 in Eight Data Center Products
October 6, 2026
Atlassian disclosed CVE-2026-21589, a CVSS 9.3 path traversal flaw that lets unauthenticated attackers read web-root files in eight Data Center
Rejetto HFS Flaw Lets Hackers Forge Admin Sessions for RCE
October 5, 2026
A critical Rejetto HFS flaw, CVE-2026-61500, lets attackers forge admin session cookies and gain remote code execution; active exploitation began
Google Pauses Open-Source Bug Bounty Over AI Report Flood
October 5, 2026
Google stopped accepting new submissions to its open-source bug bounty program after a flood of low-quality, AI-generated vulnerability reports arrived.
Kiteworks Patches Second Max-Severity Flaw in a Week
October 2, 2026
Kiteworks patched a maximum-severity code injection flaw found through its bug bounty program, marking its second critical disclosure in roughly
Self-Healing WordPress Backdoor Defies Standard Removal
October 2, 2026
Sucuri found a WordPress backdoor, SC, that persists across eight file, database, and memory locations and rebuilds itself when any
Chrome, Firefox Patch Over 100 Flaws in Joint Update
October 1, 2026
Chrome and Firefox fixed over 100 vulnerabilities between them, including a critical ANGLE buffer overflow in Chrome rated capable of
Autonomous AI Agent Breaches Cybersecurity Nonprofit DIVD
September 30, 2026
An autonomous AI agent exploited a vulnerability to breach Dutch nonprofit DIVD on its own, leaving extensive forensic evidence of
OpenAI Discloses Self-Replicating Worm-Style Prompt Injection
September 30, 2026
OpenAI disclosed that GPT models can be manipulated into self-replicating prompt injections that spread like a worm across connected tools
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.