-
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, …
-
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers …
-
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other …
-
Japan’s GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach
Japan’s GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop …
-
Dell expands cyber recovery tools to protect identity
Restoring data after a cyberattack isn’t enough if the identity systems that control access are compromised. Dell Technologies …
-
Bellini Capital CISO on AI security governance and the limits of patching faster
In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while …
-
Phishers now want you to type the malware in yourself
For years, the anti-phishing playbook has been drilled into office workers like a fire-safety briefing: check the sender, hover before you …
-
AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records
AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from …
-
NIST starts the countdown to retire quantum-vulnerable encryption
The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with …
-
Breach victims discover their data was held by companies they’ve never heard of
Nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier, according to its Data …
-
Introducing Route 53 Resolved IP Validation for AWS Network Firewall
Your workloads reach most destinations by domain name, but a firewall can only act on what it sees in the traffic. For HTTP and HTTPS, AWS …
-
CVE-2026-15323 – The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is …
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, …
●●●
NVD
- CVE-2026-104016 – ProtobufParser parses length-prefixed protobuf string and bytes fields by checking …
- CVE-2026-104895 – The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length …
- CVE-2026-15323 – The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is …
- CVE-2026-110747 – ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry’s string …
- CVE-2026-118129 – A vulnerability was found in jeremyckahn Chitchatter up to …
EXPLOITS
- PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infras
- Deploying AI agents securely: how Kaspersky products mitigate AI threats
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asi
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Operation FlashHole: Lazarus breaks security, defies control