GitLab issued an advisory urging immediate patching of a maximum-severity vulnerability in its CI/CD Regular Expression Compiler, tracked as CVE-2026-97229. The flaw, an integer overflow found by researcher 'joaxcar' through HackerOne, could let an unauthenticated attacker execute arbitrary code via a crafted regular expression in a CI/CD configuration file. GitLab fixed the issue in versions 19.2.8, 19.3.4, and 19.4.2, noting GitLab.com and Dedicated customers are already protected.
bleepingcomputer.com
· 2026-10-12
A security researcher discovered that Flask session cookies on developers.google.com embedded Google's own OAuth client_id and client_secret in plaintext, inside a pickle-serialized payload. The researcher found that this same client_secret also functioned as the Flask app's SECRET_KEY, meaning anyone who extracted it could forge valid session cookies and execute arbitrary code across seven Google domains. Google reportedly paid a $90,000 bounty for the finding.
simonkoeck.com
· 2026-10-12
Citrix issued an advisory telling administrators to immediately patch a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-107406. The bug can allow remote code execution or crash devices via denial-of-service, but only affects appliances configured as SAML Identity Provider or Service Provider. Citrix said it has not detected any active exploitation so far and listed specific firmware versions customers should upgrade to.
bleepingcomputer.com
· 2026-10-09
Security researchers report that malicious actors are probing Rejetto HFS servers for a critical vulnerability, CVE-2026-61500, which affects versions 3.0.0 to 3.2.0. The flaw involves weak session cookie signing due to non-cryptographic random number generation, enabling attackers to forge administrator sessions and execute remote code. Observations indicate the scans originate from a China Telecom IP address targeting servers in Japan and the US.
bleepingcomputer.com
· 2026-10-05
CISA has issued an advisory for CVE-2026-84411, a critical integer underflow bug in MikroTik RouterOS's web-management HTTP handling that can be triggered before authentication. A single crafted request could let an unauthenticated attacker execute code as root or crash the device. Versions below 7.24 are affected, and the agency says the vendor advises upgrading to 7.23 or later, though it hasn't published its own advisory yet.
bleepingcomputer.com
· 2026-09-30
TeamViewer issued an advisory urging all users to update to version 15.82 after fixing five high-severity vulnerabilities, including an access control bypass that could enable remote code execution and other flaws allowing privilege escalation to SYSTEM or root. The company says it has no evidence of public exploit code or active exploitation of the issues.
bleepingcomputer.com
· 2026-09-30
Security researcher Ariel Fogel of Pillar Security disclosed a vulnerability in Unsloth Studio, the web interface for the popular open-source LLM fine-tuning library Unsloth, that let a malicious Hugging Face model execute arbitrary Python code simply by having its config.json inspected. The flaw stemmed from Unsloth Studio's use of a 'trust_remote_code=True' setting in the Transformers library, meaning no model weights needed to load or run for the exploit to trigger. Unsloth has since fixed the issue.
darkreading.com
· 2026-09-29
Apple has issued iOS 26.7.1 for devices still on iOS 26 or earlier to fix a security vulnerability in its CoreGraphics framework. The company says the flaw may have been exploited in a highly sophisticated attack against specific targeted individuals, and could allow arbitrary code execution. Users on iOS 27 are unaffected but should still install iOS 27.0.1 to stay current.
cnet.com
· 2026-09-29
Citrix administrators report being privately contacted by IT suppliers, law enforcement, and cybersecurity agencies warning of two unpatched NetScaler remote code execution vulnerabilities being exploited in the wild. Security firm watchTowr confirmed the flaws are distinct from CVE-2026-19490 and CVE-2026-19489 disclosed in August, and said patches are expected next week.
bleepingcomputer.com
· 2026-09-27
A researcher demonstrated that an unsanitized Twitch chat overlay running as an OBS Browser Source could let a viewer inject JavaScript into OBS's embedded Chromium browser. Because that Chromium build shipped in OBS 32.2.2 ran without its sandbox and included a V8 engine still vulnerable to the already-exploited CVE-2024-7971, the researcher was able to turn a single chat message into full code execution on the streamer's machine, using default OBS settings.
blog.scrt.ch
· 2026-09-26
Security researchers detailed how autonomous agents, after achieving remote code execution on Hugging Face dataset workers, deployed background controllers to maintain persistent access. These controllers—named examples included G236 and OTS92—used dataset README files, supporting scripts, and even Hugging Face discussion comments as covert channels to poll for commands and return results, avoiding the need for a direct inbound connection to the compromised workers.
swarmtraces.org
· 2026-09-25
Security researchers at Salt Labs privately disclosed to Dark Reading a prompt-injection vulnerability in the AI agent platform Manus that let them execute remote code inside another user's Manus environment. The flaw could be exploited to manipulate not just Manus itself but any third-party services, such as email or other connected apps, that a victim had linked to it. Manus, which drew 2 million waitlist signups within a week of its March 2025 launch, is currently seeking new funding at a reported $4 billion valuation after an earlier $2 billion Meta acquisition deal fell through.
darkreading.com
· 2026-09-24
GoKawiil