Malicious HEIC Images Can Chain a libheif Heap Overflow Into WordPress Code Execution — Fortbridge Demonstrated PHP-FPM RCE From a Media Library Upload
Malicious HEIC Images Can Chain a libheif Heap Overflow Into WordPress Code
Denmark's Population Registry Breach Exposed Names, Addresses and CPR Numbers of 8.8 Million People — Attackers Abused a Company's Legitimate Registry Access
Denmark's Population Registry Breach Exposed Names, Addresses and CPR Numbers
ShinyHunters Operator "Rey" Has Been Detained in Jordan Since September 29 — and Is Reportedly Helping the FBI Identify Other Members
ShinyHunters Operator "Rey" Has Been Detained in Jordan Since September
Actively Exploited FortiMail Zero-Day CVE-2026-104286 Lets Unauthenticated Attackers Write Arbitrary Files — Fixed Builds Are Not Out Yet
Actively Exploited FortiMail Zero-Day CVE-2026-104286 Lets Unauthenticated Attackers Write
GitLab Patches Critical AI Gateway Flaw CVE-2026-90970: Crafted Duo Agent Platform Flows Could Escape the Prompt Template Sandbox and Run Commands
GitLab Patches Critical AI Gateway Flaw CVE-2026-90970: Crafted Duo Agent
Microsoft Ships Out-of-Band Exchange Server Updates for CVE-2026-96940: Authenticated Attackers Can Read Other Users' Mailboxes — Patch Every Server and Management Tools Box
Microsoft Ships Out-of-Band Exchange Server Updates for CVE-2026-96940:
Critical Dell System Update Flaw CVE-2026-86360 Lets Unauthenticated Attackers Run Code as Root on PowerEdge Fleets — Upgrade DSU to 2.3.0.0
Critical Dell System Update Flaw CVE-2026-86360 Lets Unauthenticated Attackers Run
Citrix NetScaler Zero-Days CVE-2026-88771 and CVE-2026-88772 Under Active Exploitation: CISA Gives Federal Agencies Until September 30
Citrix NetScaler Zero-Days CVE-2026-88771 and CVE-2026-88772 Under
Pentagon Personnel Agency Breach Exposed Nearly 3 Million People: DMDC File-Sharing Server Was Accessible to Unauthorized Users for Nine Months
Pentagon Personnel Agency Breach Exposed Nearly 3 Million People: DMDC File-Sharing
Apple Patches CoreGraphics Zero-Day CVE-2026-86950 After Meta Reports 'Extremely Sophisticated Attack' Against Targeted Individuals
Apple Patches CoreGraphics Zero-Day CVE-2026-86950 After Meta Reports '
Over 16,000 Supabase Databases Expose PII, Passwords and Auth Tokens: UpGuard Points to Missing Row-Level Security in AI-Built Apps
Over 16,000 Supabase Databases Expose PII, Passwords and Auth Tokens: UpGuard
One URL-Encoded Character Bypasses WAF Rules: ShinyHunters-Linked UNC6240 Expands Oracle PeopleSoft Attacks and Deploys Web Shells
One URL-Encoded Character Bypasses WAF Rules: ShinyHunters-Linked UNC6240 Expands Oracle