-
Bluesky Is Blocking Links to a Major Leak of DHS Employee Records
Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains …
-
Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to …
-
Smashing Security podcast #490: How Jared Kushner’s iPhone was allegedly hacked twice
All right, well, we won’t keep you for too much longer than we need you, but we are gonna need you for the next 45 minutes or so as we look …
-
What would happen if the internet went down?
For many, the internet is feeling less secure these days, thanks to generative artificial intelligence (AI) tools making it easier than …
-
Transferring Unused IPv4 Addresses in Asia Pacific: The Complete APNIC Playbook
If your network needs more IPv4 space in the Asia Pacific region, the transfer market is now the main way to get it. Asia Pacific Network …
-
CVE-2026-66092 – In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the …
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or …
-
CVE-2026-66091 – In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no …
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An …
-
CVE-2026-66090 – In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable …
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create …
-
CVE-2026-66089 – In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation …
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. …
-
CVE-2026-66088 – In openEQUELLA before 2026.1, the system.execute() function available to the scripting …
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands …
-
CVE-2026-16889 – In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT …
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type …
-
CVE-2026-114173 – The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data …
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An …
●●●
NVD
- CVE-2026-118589 – A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown …
- CVE-2026-113957 – An attacker who controls the registry, a mirror, or the network path to it may be able to …
- CVE-2026-118585 – A vulnerability was identified in configuroweb inventariobasico …
- CVE-2026-66092 – In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the …
- CVE-2026-118586 – A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects …
EXPLOITS
- PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- Millions of security cameras at risk: DoS vulnerability in Intelbras devices
- An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infras
- Deploying AI agents securely: how Kaspersky products mitigate AI threats
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asi
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)