GoKawiil
Tech News
Google released Chrome version 152.0.7977.82/.83 to fix a high-severity zero-day flaw, CVE-2026-85046, a type confusion bug in the V8 JavaScript engine that is already being exploited in the wild. The update also patches 11 other vulnerabilities, including use-after-free and out-of-bounds memory issues across several Chrome components.
Hackers are actively exploiting CVE-2026-32475, a critical vulnerability in Elementor Pro affecting version 4.2.1 and earlier, by abusing a file-upload validation flaw in the plugin's form widget to upload malicious PHP files and run commands on compromised servers. Elementor patched the bug on August 19 with version 4.2.2, but Wordfence says exploitation began the same day and has already blocked nearly 200,000 attack attempts.
Plex is urging all users to immediately update Plex Media Server to version 1.43.3 and Plex Desktop to version 1.115.0, both released earlier this year, to fix multiple unspecified security vulnerabilities. The company emailed affected customers directly and said CVE identifiers have been requested but not yet published, though the flaws are known to impact Media Server v1.43.2 and earlier.
SonicWall disclosed two vulnerabilities in its SMA 1000 series appliances: a maximum-severity SSRF flaw (CVE-2026-83548) in the user-facing Work Place portal and an OS command injection bug (CVE-2026-83549) in the admin console. SonicWall's security team confirmed active exploitation in the wild and urged customers to patch immediately, while researchers at Rapid7 noted the two bugs can be chained together for unauthenticated remote code execution.
Security firm Horizon3 says hackers are exploiting CVE-2026-9586, an unauthenticated SQL injection bug in Sangoma Switchvox's /pa endpoint that allows remote code execution. Honeypot data shows a single source IP rapidly hitting multiple exposed systems, deploying reverse shells and exfiltrating process data. Sangoma patched the flaw, one of 12 reported by Horizon3, in version 8.4.0.2 released July 14.
A critical authentication bypass, CVE-2026-82329, in self-managed JFrog Artifactory deployments is being actively exploited to mint fraudulent administrator tokens without any prior authentication. The flaw sits in Artifactory's default configuration, and watchTowr researchers say attackers are already using it in the wild. JFrog patched the issue on August 28 across several version branches, and confirmed its cloud-hosted environments were never at risk.
A critical vulnerability tracked as CVE-2026-82329 in JFrog's Artifactory repository manager allows attackers to bypass authentication and gain administrator-level access to affected systems. Security researchers report that exploitation attempts began soon after the flaw's public disclosure, putting unpatched deployments at immediate risk.
Security researchers have observed active exploitation of CVE-2026-0768, a critical flaw in Langflow, the low-code platform used for building AI applications. This marks the latest in a series of attacks targeting the platform, which has drawn increasing attention from threat actors this year.
Hackers are actively exploiting CVE-2026-0768, a critical unauthenticated remote code execution flaw in the open-source Langflow AI development platform, to steal cloud and API credentials. VulnCheck's honeypots recorded roughly 50 exploitation attempts over a weekend, mostly from Russian IP addresses, with the count climbing to 360 attacks within days. The flaw lets attackers run arbitrary Python code with root privileges by abusing improper input validation in Langflow's code validator.
Shadowserver has identified nearly 22,000 internet-exposed Microsoft Exchange servers that remain unpatched against CVE-2026-62911, a high-severity authentication bypass flaw affecting Exchange Server 2016, 2019, and Subscription Edition. Most vulnerable systems are located in the United States and Germany, where officials say roughly 85% of on-premises Exchange servers remain exposed despite Microsoft releasing a fix in August 2026.
Hackers are actively exploiting two recently disclosed PaperCut NG and MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to bypass authentication and steal data from print management servers. PaperCut issued emergency fixes last week, but researchers at Defused say attackers are using the bypass to hijack the software's user-lookup function and dump database tables rather than pursue remote code execution as earlier reports suggested. Over 800 PaperCut servers remain exposed online according to Shadowserver, and PaperCut has not yet attributed the attacks or detailed post-compromise activity.
The curl project explains that after becoming a CVE Numbering Authority (CNA) years ago, it now independently issues its own CVE identifiers for security flaws in its codebase, having assigned 57 so far. The maintainers describe a rigorous assessment process that grades each report as LOW, MEDIUM, HIGH, or CRITICAL, and note that some minor issues are deliberately left without a CVE if the risk of exploitation is deemed negligible.