SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Stadler Rail Refuses $12.3M Everest Ransom After Supplier Data Breach
Swiss rail manufacturer Stadler says a breach at a third-party file-sharing platform exposed technical supplier documents, but the company is refusing Everest's…
Check Point Zero-Day Under Active Attack, CISA Sets July 25 Deadline
A critical authentication bypass in Check Point's Security Management and Multi-Domain Management products is being exploited against internet-exposed environments, prompting an emergency…
House Defense Bill Passes With Decade-Long Extension of CISA 2015 Info-Sharing Law
The House approved its version of the 2027 NDAA, which includes a provision to reauthorize the 2015 Cybersecurity Information Sharing Act for…
Attackers Mass-Exploit wp2shell WordPress Flaws to Plant Webshells
Threat actors are chaining two critical WordPress Core vulnerabilities dubbed wp2shell to deploy PHP webshells, install malicious plugins, and harvest credentials on…
Critical SharePoint RCE Flaw Under Active Exploitation, Attackers Stealing Machine Keys
Hackers began exploiting CVE-2026-50522 within hours of a public PoC release, stealing SharePoint machine keys to maintain persistent access even after servers…
ServiceNow Sandbox Escape Bug Exploited Days After Patch, Details Disputed
A critical unauthenticated remote code execution flaw in ServiceNow's AI platform, patched on July 14, is reportedly under active exploitation, though the…
Microsoft Issues Manual Fix for WSUS Sync Delays and Timeouts
A metadata buildup issue was causing Windows Update scans to fail or time out on WSUS servers. Microsoft has now published manual…
Critical ServiceNow RCE Flaw (CVE-2026-6875) Now Under Active Exploitation
Threat intelligence firm Defused says attackers are exploiting a critical unauthenticated sandbox-escape vulnerability in the ServiceNow AI Platform, days after patches were…
Critical NGINX Flaw Lets Attackers Crash Worker Processes, Possibly Worse
F5 has patched a critical heap buffer overflow in nginx that lets unauthenticated attackers crash worker processes with crafted HTTP requests, with…
7-Zip 26.02 Patches Heap Overflow RCE Flaw in XZ Archive Handling
7-Zip has fixed a remote code execution vulnerability in its XZ decompression code that can be triggered by opening a maliciously crafted…
WordPress Core wp2shell RCE Chain Gets Public Exploits, Patch Immediately
Two chained flaws in WordPress Core allow unauthenticated remote code execution against stock installs, and public proof-of-concept exploits are now circulating with…
Unauthenticated RCE Flaw in WordPress Core Patched via Forced Updates
A critical WordPress core vulnerability, dubbed wp2shell, allowed unauthenticated attackers to execute code on any 6.9 or 7.0 site with a single…