SonicWall has released security updates addressing seven SonicOS vulnerabilities, including CVE-2026-19868, an SSL-VPN authentication bypass that lets attackers with valid alternate credentials evade SAML authentication, including SAML-enforced MFA. SonicWall confirmed it is investigating a report of active exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, directing federal agencies to patch by November 20, 2026. The fix also covers two 8.8-severity management interface bugs, pre-authentication buffer overflows in SSL-VPN and TACACS+ services, and a weak password hashing issue on virtual appliances.
bleepingcomputer.com
· 2026-11-06
QNAP has confirmed that attackers are exploiting a chain of four Plex Media Server vulnerabilities, dubbed Plex2Shell, to compromise customers' NAS devices. The company says its technical support team is assisting affected users and is urging everyone to update Plex Media Server to version 1.43.3.10861 via the QNAP App Center. QNAP clarified that the flaws affect only Plex Media Server, not its QTS, QuTS hero, or other NAS operating systems.
bleepingcomputer.com
· 2026-11-06
The FBI and the Cybersecurity and Infrastructure Security Agency issued a joint advisory stating that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems around the world. The agencies warn these intrusions could lead to food spoilage, equipment damage, and fire hazards in affected facilities.
bleepingcomputer.com
· 2026-11-05
Shadowserver reports more than 1,000 internet-facing GitLab servers remain vulnerable to CVE-2026-97229, a critical integer overflow bug in GitLab's CI/CD Regular Expression Compiler that lets unauthenticated attackers run arbitrary code via crafted regex in pipeline configs. GitLab shipped fixes on October 12 in versions 19.4.2, 19.3.5 and 19.2.8, but CISA has now confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until Sunday to patch.
bleepingcomputer.com
· 2026-11-02
CISA added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, an integer overflow in GitLab's regular expression compiler, lets unauthenticated attackers run arbitrary code via crafted CI/CD configurations; GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 earlier this month.
bleepingcomputer.com
· 2026-10-30
CISA added CVE-2026-46300, a Linux kernel privilege-escalation bug dubbed Fragnesia, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by Saturday. The flaw, found in the XFRM ESP-in-TCP subsystem, grants root access and can reportedly be chained with two critical PHP vulnerabilities known as PHP2Shell to install webshells on unpatched systems.
bleepingcomputer.com
· 2026-10-29
Eclypsium's October InfraTrust Pulse report tracked 133 new security advisories across 18 vendors between September 18 and October 14, covering 2,813 vulnerabilities, with 37 rated critical and 58 exploitable remotely without authentication. The report highlights so-called PHP2Shell flaws affecting PHP code embedded in the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances, noting that 16 advisories involved vulnerabilities already listed in CISA's Known Exploited Vulnerabilities catalog.
bleepingcomputer.com
· 2026-10-28
Researchers at Calif and Wiz, aided by OpenAI and Google models, discovered two remote code execution vulnerabilities in PHP dating back to 2012, now dubbed PHP2Shell. Amazon detected exploitation attempts days before PHP's October 21 patch, and attack traffic kept climbing afterward, prompting CISA to add both flaws to its known exploited vulnerabilities list on October 26. Industry data cited shows median fix times for known exploited bugs run 21 to 43 days, far slower than the pace at which attackers are now acting.
bleepingcomputer.com
· 2026-10-28
CISA confirmed attackers are actively exploiting a critical vulnerability in Google's Brotli compression library, dubbed Node2Shell, that can let unauthenticated attackers crash systems, leak memory, or run arbitrary code. The agency added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 10 under Binding Operational Directive 26-04. Microsoft separately issued an emergency .NET update days earlier addressing related privilege-escalation risk from the same flaw.
bleepingcomputer.com
· 2026-10-28
CISA has confirmed that hackers are actively exploiting two critical PHP vulnerabilities, dubbed PHP2Shell, and ordered U.S. civilian federal agencies to patch affected systems within three days. The flaws let attackers remotely compromise systems without credentials, and PHP powers roughly 70% of web-facing servers worldwide.
techcrunch.com
· 2026-10-27
CISA has confirmed active exploitation of two critical PHP vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to achieve remote code execution on unpatched systems. PHP issued patches on October 21, and CISA has ordered federal civilian agencies to secure their systems by Thursday under Binding Operational Directive 26-04.
bleepingcomputer.com
· 2026-10-27
On October 16, 2026, NIST, CISA and the NSA jointly released a 14-page voluntary guide titled Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. The document outlines ten practices across five stages—prepare, detect, respond, recover and report—aimed at organizations training or evaluating highly autonomous AI agents, and defines a 'control incident' as significant agent actions not directed by an operator or adversary that undermine oversight or policy.
bleepingcomputer.com
· 2026-10-26
GoKawiil