SeverityCritical briefings
Only the stories rated critical: the flaws to patch first.
Check Point Zero-Day Under Active Attack, CISA Sets July 25 Deadline
A critical authentication bypass in Check Point's Security Management and Multi-Domain Management products is being exploited against internet-exposed environments, prompting an emergency…
Attackers Mass-Exploit wp2shell WordPress Flaws to Plant Webshells
Threat actors are chaining two critical WordPress Core vulnerabilities dubbed wp2shell to deploy PHP webshells, install malicious plugins, and harvest credentials on…
Critical SharePoint RCE Flaw Under Active Exploitation, Attackers Stealing Machine Keys
Hackers began exploiting CVE-2026-50522 within hours of a public PoC release, stealing SharePoint machine keys to maintain persistent access even after servers…
ServiceNow Sandbox Escape Bug Exploited Days After Patch, Details Disputed
A critical unauthenticated remote code execution flaw in ServiceNow's AI platform, patched on July 14, is reportedly under active exploitation, though the…
Critical ServiceNow RCE Flaw (CVE-2026-6875) Now Under Active Exploitation
Threat intelligence firm Defused says attackers are exploiting a critical unauthenticated sandbox-escape vulnerability in the ServiceNow AI Platform, days after patches were…
Critical NGINX Flaw Lets Attackers Crash Worker Processes, Possibly Worse
F5 has patched a critical heap buffer overflow in nginx that lets unauthenticated attackers crash worker processes with crafted HTTP requests, with…
WordPress Core wp2shell RCE Chain Gets Public Exploits, Patch Immediately
Two chained flaws in WordPress Core allow unauthenticated remote code execution against stock installs, and public proof-of-concept exploits are now circulating with…
Inc Ransomware Chains SonicWall SMA Zero-Days for Root Access
The Inc ransomware group is exploiting two previously unknown vulnerabilities in SonicWall's Secure Mobile Access appliances, chaining the flaws to achieve root-level…
Unauthenticated RCE Flaw in WordPress Core Patched via Forced Updates
A critical WordPress core vulnerability, dubbed wp2shell, allowed unauthenticated attackers to execute code on any 6.9 or 7.0 site with a single…
CISA Adds Actively Exploited SharePoint RCE Flaw CVE-2026-58644 to KEV Catalog
A critical deserialization bug in on-premises SharePoint Server has joined at least three other actively exploited flaws under active attack, with CISA…
F5 Issues Emergency Patches for Critical NGINX Flaw, Seven Other Bugs
F5 has released an out-of-band update fixing eight vulnerabilities across NGINX and BIG-IP, including a critical, unauthenticated heap buffer overflow rated 9.2…
Zoom Patches Critical Windows Flaw That Allows Unauthenticated Account Takeover
Zoom has disclosed a critical, internally discovered vulnerability in its Windows desktop client, VDI client, and Meeting SDK that could let an…