Section

Security

Breaches, disclosures, and the defensive response.

327 stories · page 2 of 11

Security, stories 31 to 60

31GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No WorkaroundCVE-2026-110264 lets an unauthenticated user run code on self-managed servers, and GitLab has not said which feature reaches the vulnerable compiler.Oct 27
32Plex2Shell Chains Four Plex Media Server Flaws Into Code Execution, 74 Days After the PatchCISA lists all four CVEs as exploited, and two sources that count the dates disagree by a day on when.Oct 27
33Eight eMudhra CA Keys Could Be Computed From Public Certificates; Chrome Blocked Them in 100 MinuteseMudhra says only one of the eight intermediates was in production and none issued a certificate, but the only check anyone has published covers certificates that were logged.Oct 27
34Cloudflare's GLM 5.3 Leaked Other Customers' Data in 155 Responses; the Bug Was Reported Upstream on July 6Cloudflare knew its 1,048,576-token model had a 681,280-token cache before launch, and its pre-launch tests checked status codes rather than what came back.Oct 27
35Nextcloud Servers Were Exploited 34 Days Before Collabora's CVE-2026-110447 ExistedCISA added the command-injection flaw to its exploited list on Oct. 23, six weeks after the fix shipped in version 26.4.303 with no security note.Oct 26
36July's VeloCloud Orchestrator Fixes Do Not Cover Exploited CVE-2026-114625Arista says the SQL-injection flaw is actively exploited, and a read-only tenant login is enough to reach operator privileges on on-premises installs.Oct 26
37SiteGuard WAF Flaw CVE-2026-106931 Is Exploited, and Patching Can Erase the EvidenceA local-vector command injection scored 8.5 gives root or SYSTEM on the firewall host, and the vendor tells customers to download diagnostics before updating.Oct 26
38SafePay Ransomware Hit 600 Victims, and the Advisory's Newest CVE Is From 2024The FBI, CISA and German and British police list five vulnerabilities in AA26-293A, none newer than 2024, alongside a credential-first playbook that needs no exploit at all.Oct 26
39Gheist Used 850 Stolen GitHub Tokens to Print Secrets Into Workflow LogsWiz Research recovered more than 13,500 planted branches, and GitHub's July approval hold stopped every public-repository run but not private or Enterprise Server ones.Oct 26
40Siemens Software Center Flaw CVE-2026-110936 Is Exploited Through a Signed Copy of Its Own AppAttackers never modified Siemens' executable: they shipped a valid, signed copy with their own files beside it, and CISA listed the bug on Oct. 20.Oct 25
41CISA Splits Plex2Shell Into Oct. 23 and Nov. 3 Patch DeadlinesAll four Plex Media Server flaws entered the Known Exploited Vulnerabilities catalog on Oct. 20, four days after the researcher who found them published the full chain.Oct 25
42Nextcloud's Built-in Collabora Server Was Attacked for Four Weeks Before Its CVE ExistedCVE-2026-110447 had a fix on Sept. 11, a CISA catalog entry on Oct. 23, and a 33-day gap in between during which admins found webshells.Oct 25
43Cloudflare's Security Audit Skill Is the 450-Line Seed, Not the Harness That Found 7,245 BugsThe repository gaining 2,874 stars in a day is the starting prompt set; the fleet-scale system behind Cloudflare's numbers has not been released.Oct 25
44PHP2Shell Patches Leave a Third PHP Flaw, CVE-2026-115560, UnfixedFixes for CVE-2026-109618 and CVE-2026-109619 shipped on Oct. 21 in four branches, while sources disagree on whether either bug is being exploited and several appliance vendors had no patch.Oct 25
45AhsayCBS 10.3.4 Was Not the Fix, Huntress Found, Before CISA Listed ItThe Oct. 14 CISA batch pairs two AhsayCBS flaws chained into SYSTEM-level code execution with an exploited PAN-OS root flaw and a Cisco email gateway zero-day.Oct 25
46A TCL TV Root Toolkit Leans on a Mali Bug CISA Flagged in 2023, on a 2024 Patch LevelThe MIT-licensed project says an unprivileged app reaches uid=0 on the 50C721 in under 2 seconds, but its own author did not retest it before release.Oct 24
47FortiMail CVE-2026-104286 Is Exploited, and Fortinet's Fixes Are 8.0.2, 7.6.7 and 7.4.9Fortinet's advisory lists a 9.8 file-write flaw reachable without credentials and a three-day CISA deadline, but confirms a fixed build only for its own cloud service.Oct 24
48eMudhra's Eight CA Keys Were Numbers Below 256, and Chrome Drops Its G3 Root Oct. 27Google and Mozilla blocked the eight intermediates within three hours of the Oct. 17 report, but certificates chaining to the root that signed them stop working in Chrome next Tuesday.Oct 24
49SafePay's Five Named CVEs Are All Two Years Old or More, and All Sit on Cisco, Veeam and SonicWall GearThe joint advisory counts at least 600 SafePay victims since August 2024; BleepingComputer's write-up names no CVEs, but the advisory lists five.Oct 24
50PHP Has an Unpatched RCE, CVE-2026-115560, That Needs Three Conditions Including a Runtime Serialize-Handler SwitchThe PHP team gave the flaw no severity score and no affected versions, and says the fix waits for the next regular release.Oct 24
51OpenAI Moves Frontier Training Offline and Reports VM Escapes in Kata, gVisor and Docker, a Week After Federal Containment GuidanceOpenAI's October 23 post could not be fetched by The Terminal, so this reading rests on three accounts of it and sets them against the October 16 NIST, NSA and CISA practices.Oct 24
52HTTP2Shell Is a Brotli Bug, Not a Node.js One, and Its Fixes Span PyPI, Envoy, Istio and BunCVE-2026-111497 sits in Google's Brotli decoder, so the patch list runs well past Node.js, and whether it gives code execution or only a crash is still argued.Oct 24
53Railway Says Attacker Decrypted Environment Variables for Up to 1.85% of WorkspacesIts October 22 preliminary report points to a hunt for AI provider keys, names no root cause, and has not ruled out access to customer source code.Oct 23
54Plex2Shell Chains Four CVEs Into Unauthenticated Code Execution; CISA Lists It as ExploitedPlex Media Server builds before 1.43.3.10861 are affected; a public proof of concept sits on GitHub and the federal patch deadline is October 23.Oct 23
55LiteLLM 1.107.0 Shipped a Credential Stealer, Built From a Lookalike RepoThe poisoned release ran in Python startup hooks for 103 minutes on PyPI; the official GitHub tag is clean and LiteLLM 1.106.2 is the version to return to.Oct 23
56GitLab Patches CVE-2026-110264, a CVSS 10.0 Unauthenticated RCE, in 19.5.1The regex compiler overflow reaches back to version 7.0, has no listed workaround, and is the second 10.0 flaw in that component in about ten days.Oct 23
57Quad9 Will Stop Serving France on November 24 Rather Than Block 58 Pirate Streaming DomainsThe Swiss DNS resolver says a Paris court set a €1,000 daily penalty after beIN sought €580,000, and that it cannot tell which of its users are French.Oct 23
58Amazon Logged a PHP2Shell Attempt Four Days Before the Patch; Dataminr Saw Only ScanningCVE-2026-109618 and CVE-2026-109619 are rated 9.2, need no credentials, and were fixed October 21. Whether anyone has actually been compromised is still disputed.Oct 23
59eMudhra Will Exit Public TLS Certificates; G3 Is Distrusted, G1 Still IssuesThe Bengaluru company says the business is about 1% of revenue. About 30,000 certificates for one US client had to move, and the audits that passed the keys went unnamed.Oct 23
60CISA Gave Federal Agencies Three Days on Two Plex Flaws and 14 on Two Others in the Same Exploit ChainThe four Plex2Shell bugs score between 5.3 and 8.6 individually. Chained, they give an unauthenticated attacker code execution, and miners are already landing on unpatched servers.Oct 22