SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
LatePoint CVE-2026-110653: Account Takeover Flaw, Patch Now
LatePoint CVE-2026-110653 (CVSS 9.1): a race condition defeats the login-code lockout and lets attackers hijack a customer account. Update to 5.7.5 now.
FunnelKit CVE-2026-107746: Unauthenticated Order PII Leak, Patch Now
FunnelKit CVE-2026-107746 lets unauthenticated attackers read billing names, addresses, emails and phones from any WooCommerce order. Update to 3.17.0 now.
How to Use wazuh-logtest to Debug Wazuh Decoders and Rules
How to use wazuh-logtest to test Wazuh decoders and rules: run the CLI, read all three phases, use verbose mode, and fix a rule that will not fire as expected.
ONLYOFFICE Document Server CVE-2026-110385: Authenticated RCE, Patch to 10.0
ONLYOFFICE Document Server has a high-severity RCE (CVE-2026-110385) via the Document Builder. Upgrade to 10.0 and confirm inbound JWT validation is enabled.
A pipeline RCE is a distribution channel, not one server
GitLab and Argo CD both shipped maximum-severity RCE fixes in one week.
GitLab CVE-2026-97229: Critical Unauthenticated RCE, Patch Now
GitLab's emergency patch fixes CVE-2026-97229, a CVSS 10 unauthenticated code-execution flaw in the CI/CD regex compiler.
SonicWall SMA1000 CVE-2026-102255: CVSS 10 Pre-Auth SSRF, Exploited
SonicWall SMA1000 CVE-2026-102255 is a CVSS 10 pre-auth SSRF, exploited within a day of the October 6 patch. Affected versions, the fix, and detection.
AhsayCBS CVE-2026-105134: Unauth RCE as SYSTEM, No Patch Yet
Attackers are chaining two AhsayCBS backup-platform flaws for unauthenticated RCE as SYSTEM. CVE-2026-105134 is exploited in the wild with no fixed release yet.
Argo CD Patches Seven Flaws, Four Critical: Upgrade Now
Argo CD's October 7 release fixes seven flaws, four rated CVSS 9.9. Low-privilege users could run code or read credentials in the repo-server.
Flax Typhoon Scanners Mass-Exploit Five Legacy Server Bugs in CISA KEV
CISA added five legacy self-hosted server flaws (BIND, ProFTPD, Struts, ONLYOFFICE, Strapi) to its KEV catalog as China-linked scanners exploit them.
LatePoint CVE-2026-17538: WordPress Customer Data Tampering, Update Now
LatePoint CVE-2026-17538 lets any logged-in WordPress user edit arbitrary customer records in the booking plugin, and can enable account takeover. Update now.
Keycloak CVE-2026-107121: STARTTLS Downgrade Exposes SMTP Creds
Keycloak CVE-2026-107121 lets a network attacker force its SMTP STARTTLS connection to plaintext, exposing mail credentials and reset emails.
Rejetto HFS CVE-2026-61500: Critical Auth Bypass to RCE, Patch Now
CVE-2026-61500 lets attackers forge admin sessions in Rejetto HFS 3.0.0-3.2.0 and run code. Fixed in 3.2.1; scanning began within 48 hours of the public PoC.
LibreOffice CVE-2026-63277: High-Severity Document-Open RCE, Patch Now
LibreOffice CVE-2026-63277 lets a crafted Calc file load a remote Java driver and run code on open. One of six flaws fixed in 26.2.5 and 26.8.0. Patch now.
NetScaler CVE-2026-88779: Pre-Auth DoS in SAML Setups, Patch Now
Citrix NetScaler CVE-2026-88779 lets an unauthenticated attacker crash ADC and Gateway appliances configured for SAML sign-on. Patch to 14.1-73.41 now.
Jeg Kit for Elementor CVE-2026-100180: Stored XSS, Patch Now
Jeg Kit for Elementor CVE-2026-100180 is an unauthenticated stored XSS fixed in 3.2.20, the second comment XSS in this 300k-install plugin in three weeks.
cPanel CVE-2026-93698: Critical Command Injection, Patch Now
cPanel CVE-2026-93698 is a critical 9.9 command-injection flaw in the Multilang adminbin that lets a low-privileged account run commands on the server.
Newsletter Plugin CVE-2026-92537: Subscriber Token Leak, Patch
CVE-2026-92537 in the WordPress Newsletter plugin leaks a subscriber's login cookie to anyone holding a tracking link, exposing stored data. Update to 9.4.0.
NetScaler CVE-2026-88772: Pre-Auth RCE Zero-Day, Patch Then Hunt
CVE-2026-88771 and CVE-2026-88772 hit Citrix NetScaler as zero-days, exploited before a patch. Patching does not remove the web shell attackers left.
Eight of 4,609 vulnerabilities actually mattered this week
We triaged 4,609 vulnerabilities in a week and acted on 8. Why reachability and in-the-wild exploitation, not CVSS, decide what a self-hosted team should patch.
Apache Roller CVE-2026-82384: Pre-Auth RCE in XML-RPC, Patch Now
Apache Roller 6.1.5 has a critical pre-auth RCE flaw (CVE-2026-82384, CVSS 9.8) in its XML-RPC endpoint. Disabling the feature won't help; upgrade to 6.1.6.
WordPress Core CVE-2026-87902: Unauth File Inclusion RCE, Patch 7.1.2
CVE-2026-87902 is an unauthenticated WordPress core file-inclusion flaw that can run code, exploited in the wild and affecting every release since 4.7.0.
Request a Quote WooCommerce CVE-2026-18143: Unauth RCE, No Patch
CVE-2026-18143 is a critical unauthenticated file-upload flaw in Request a Quote for WooCommerce (through 2.9.2), with no patch yet. Act now.
containerd CVE-2026-53493: Moderate Image-Pull DoS, Update Now
containerd CVE-2026-53493 lets a crafted OCI image burn CPU and memory during image pull, before any container starts. Moderate, not yet exploited. Update.
About this blog
What does the Suriq blog cover?
How often does Suriq publish?
How can I follow new posts?
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.