Asus has issued firmware updates for two critical vulnerabilities affecting its routers. One, CVE-2026-14157 (CVSS 9.4), lets an attacker who uploads a crafted VPN client configuration file through the router's web interface execute arbitrary commands. The other, CVE-2026-13313 (CVSS 8.9), exploits leftover debug code to bypass security checks, enable Telnet, and potentially run commands with root privileges, affecting firmware series 3.0.0.6_102, 3.0.0.4_386 and 3.0.0.4_388.
tomshardware.com
· 2026-10-03
Developers have released wpd, an open-source WebP image decoder written in Rust with handwritten assembly for performance-critical routines. The project aims to avoid the memory-safety bugs common in C-based decoders like libwebp, while matching or exceeding its decoding speed. Source code is available on GitHub under halidecx/wpd.
halide.cx
· 2026-10-03
GitLab issued an advisory urging immediate patching of CVE-2026-90970, a critical vulnerability in its AI Gateway service that powers GitLab Duo. The flaw lets an authenticated user with Duo Agent Platform access escape a prompt template sandbox via a crafted flow configuration and run arbitrary commands on self-hosted AI Gateway instances. GitLab released versions 19.2.4, 19.3.2, and 19.4.1 to fix the issue, noting GitLab-hosted AI Gateway customers are already protected.
bleepingcomputer.com
· 2026-10-02
Debian's security team published advisory DSA-6528-1, addressing nearly 90 CVEs discovered in the Linux kernel. The advisory, issued by Salvatore Bonaccorso, lists vulnerabilities spanning multiple kernel subsystems and recommends users update their systems to the patched packages.
lwn.net
· 2026-10-01
Fortinet has disclosed a critical path traversal vulnerability in FortiMail's management interface, scoring 9.8 on CVSS, that attackers are already exploiting to write arbitrary files without authentication. The flaw affects FortiMail versions 7.2 through 8.0.1, and was discovered internally by Fortinet's Product Security team. Patches are not yet available for most affected branches, though fixed versions are planned.
bleepingcomputer.com
· 2026-10-01
Kiteworks released patches addressing 126 vulnerabilities across its Private Content Network platform, including a critical bug tracked as CVE-2026-54154 affecting its Email Protection Gateway. The flaw, found via Kiteworks' bug bounty program, could let an unauthenticated attacker chain path traversal, code injection, and missing authentication issues to gain root control of an appliance without user interaction. The company also patched 11 other critical flaws spanning authentication bypass, admin takeover, and XSS issues, fixing all affected EPG versions before 9.4.1.
bleepingcomputer.com
· 2026-10-01
In the latest episode of 9to5Mac's Security Bite Podcast, host Arin Waichulis interviews Ananay Arora, founder and CEO of Y Combinator startup OpenHack. The discussion covers OpenHack's 'always-on AI security engineer' tool for finding vulnerabilities on Mac and other platforms, along with Apple's Security Bounty Program and advice for researchers seeking their first CVE.
9to5mac.com
· 2026-10-01
Microsoft reports that attackers have been actively exploiting a critical unauthenticated command-injection vulnerability in the Zimbra Collaboration Suite, tracked as CVE-2026-73570, to access and exfiltrate email and credential data. Synacor patched the flaw on July 20 but did not publicly disclose it for over three weeks, and the Shadowserver Foundation found 274 compromised instances among roughly 10,000 servers still running the software. Microsoft observed attackers scanning for vulnerable servers, confirming exploitation, then deploying web shells, reverse shells, and persistence tools before accessing and archiving mailbox data for transfer.
arstechnica.com
· 2026-09-30
CISA has issued an advisory for CVE-2026-84411, a critical integer underflow bug in MikroTik RouterOS's web-management HTTP handling that can be triggered before authentication. A single crafted request could let an unauthenticated attacker execute code as root or crash the device. Versions below 7.24 are affected, and the agency says the vendor advises upgrading to 7.23 or later, though it hasn't published its own advisory yet.
bleepingcomputer.com
· 2026-09-30
Cisco has released fixes for a critical zero-day, CVE-2026-76504, in its Catalyst SD-WAN Manager software that attackers are already exploiting to gain unauthenticated admin access. The flaw stems from improper URI encoding handling that lets crafted HTTP requests bypass authentication on a specific API endpoint. Cisco says it learned of active exploitation in September 2026 and is urging customers to upgrade immediately.
bleepingcomputer.com
· 2026-09-30
TeamViewer issued an advisory urging all users to update to version 15.82 after fixing five high-severity vulnerabilities, including an access control bypass that could enable remote code execution and other flaws allowing privilege escalation to SYSTEM or root. The company says it has no evidence of public exploit code or active exploitation of the issues.
bleepingcomputer.com
· 2026-09-30
Apple has disclosed that a memory-corruption vulnerability tracked as CVE-2026-86950, an out-of-bounds write flaw, is being actively exploited. The company described the attacks as extremely sophisticated, indicating a narrowly targeted campaign rather than mass exploitation.
darkreading.com
· 2026-09-29
GoKawiil