SeverityCritical briefings
Only the stories rated critical: the flaws to patch first.
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
A campaign exploiting the PHP2Shell flaws and a Check Point zero-day gave attackers root on Security Gateways, then wiped VMware ESXi hosts.…
Critical Apache HTTP/2 Flaw Allows Unauthenticated Remote Code Execution
A critical vulnerability in Apache HTTP Server's mod_http2 module, tracked as CVE-2026-119618, could let an unauthenticated remote attacker execute code on affected…
November Patch Tuesday Brings Actively Exploited Outlook Zero-Day and Wave of Critical Bugs
Microsoft's November security update includes an Outlook zero-day under active exploitation, alongside a large batch of critical flaws in Exchange, SharePoint, Windows…
QNAP warns NAS devices are being breached through Plex2Shell attacks
QNAP says attackers are compromising NAS devices by exploiting a four-flaw chain in Plex Media Server, and users running exposed vulnerable servers…
SonicWall Will Not Patch End-of-Life GMS Flaws Exposing Files and Database Records
SonicWall says two vulnerabilities in end-of-life Global Management System 9.5.2 and earlier will receive no fix, leaving file disclosure and SQL injection…
Barracuda Patches Two Critical Flaws Enabling Root Access on Appliances
Barracuda has fixed two vulnerabilities that, if chained, let an attacker with admin interface access bypass authorization and gain root control of…
Red Hat Patches Critical 9.8 Linux Kernel TCP RCE as Ubuntu Fix Lags in Testing
A use-after-free flaw in the Linux kernel's IPv4 TCP stack, rated 9.8 and remotely exploitable without authentication, has fixed builds out for…
Attackers Exploit Unpatched Max-Severity Flaw in CryptoPayment Gateway Plugin
Researchers warn that threat actors are actively targeting CVE-2026-81648, a critical unpatched WordPress plugin flaw that could expose wallet credentials and allow…
Attackers Actively Exploit Max-Severity Siemens IoT2050 Flaw
VulnCheck says a perfect-10 vulnerability in Siemens SIMATIC IoT2050 Advanced devices is being actively exploited to deploy remote command backdoors, allowing unauthenticated…
Critical Linux Kernel TCP Flaw Hits Ubuntu, RHEL; AI Wrote the Exploit
A 9.8-rated flaw in the Linux kernel's TCP stack, CVE-2026-98432, affects major distributions including Ubuntu and Red Hat, and Anthropic says its…
Critical Linux Kernel Bug Lets Attackers Get Root via MPTCP, AI Built the Exploit
A use-after-free in the Linux kernel's TCP networking code, rated 9.8 severity, can be remotely exploited for root code execution on MPTCP-enabled…
Drupal Commerce Core Flaw Under Active Exploitation, Patch Now
A highly critical access bypass in Drupal's Commerce Core module is being exploited against online stores, letting unauthenticated attackers manipulate orders on…