SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
Patched but still defaced: the Helix3 Joomla flaw that hides in your database, not your files
An unauthenticated bug in JoomShaper's Helix3 (CVE-2026-49049) is defacing Joomla sites. It hides in the database, so patching to 3.1.2 alone won't clean it.
GhostLock turns any Linux foothold into host root, and containers don't stop it
GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel flaw that turns any local foothold into host root and escapes containers. Who is exposed, how to patch.
A Google chatbot 'edit' permission was really a code-execution grant
Google's Dialogflow CX let one edit permission run code across every chatbot in a project.
GodDamn ransomware blinds EDR with a signed kernel driver. Detect the load, not the file.
GodDamn ransomware uses PoisonX, a kernel driver carrying a valid Microsoft signature, to disable EDR.
How to Use the Wazuh API: Authenticate, Query Agents, and Automate
How to use the Wazuh API: authenticate on port 55000 for a JWT token, then query your agents and automate with copy-pasteable curl commands and a worked
Five Tenda router models ship a hidden admin password. With no patch, containment is the only move.
CERT/CC flagged a hardcoded admin password in five Tenda router models (CVE-2026-11405). No fix exists yet, so here is how to detect and contain it.
A public GitHub issue made an AI agent leak a private repo. No patch closes this class.
A crafted public GitHub issue tricked an AI Agentic Workflow into posting a private repo's contents as a public comment. Why no patch closes this class.
Two pre-auth bypasses hit BeyondTrust's privileged-access appliances, found by the vendor's own AI
BeyondTrust patched four flaws in Remote Support and Privileged Remote Access, including two pre-auth CVSS 9.2 bypasses. Upgrade to 25.3.3 and hunt the window.
A low-privilege user could overreach on Dell's Data Domain backup appliances. The fix is out.
CVE-2026-56086 lets a low-privileged remote user gain unauthorized access on Dell PowerProtect Data Domain backup appliances. CVSS 8.8. Patched builds are out.
Two Joomla page builders are exploited for site takeover. The patch won't evict the intruder.
CISA flagged two CVSS-10 Joomla page-builder flaws, SP Page Builder (CVE-2026-48908) and Page Builder CK (CVE-2026-56290), as exploited.
A logged-in user can hijack the Linux graphics server, and on many systems that means root
X.Org patched two memory-corruption bugs in the X server and XWayland. A local client can reach root where Xorg runs as root. Update to 21.1.24 and 24.1.13.
Adobe ColdFusion is under active attack, but the max-severity rating overstates who is exposed
Adobe ColdFusion flaw CVE-2026-48282 (CVSS 10.0) is now exploited in the wild and in CISA KEV. Who is actually exposed, how to detect it, and what to patch.
The new Cavern C2 needs no CVE. It abuses your IT provider's own tools to get in.
Check Point ties the Iran-linked Cavern C2 to intrusions that skip vulnerabilities entirely, abusing IT providers' own deployment tools.
Django shipped three low-severity security fixes. One of them deserves a closer look.
Django 6.0.7 and 5.2.16 patch three low-severity issues: a header injection, a cache data leak, and a heap over-read.
Januscape: nested virtualization reopens a 16-year-old escape out of the KVM guest
Januscape (CVE-2026-53359) is a 16-year-old KVM use-after-free that lets a rooted guest VM crash its Linux host. Nested virtualization is the trigger.
A default in Red Hat's Linux login system lets one directory account seize root on every server
CVE-2026-14474: when SSSD's LDAP sudo provider has no explicit search base, one directory account can plant a rule that grants root on every enrolled Linux
Gitea's Docker image trusts a login header from anyone, and probing has started
A default in Gitea's Docker image trusts the X-WEBAUTH-USER header from any IP, so anyone can log in as any user.
Formie's second hidden-field flaw in five weeks lets a stranger run code on your Craft CMS site
Formie for Craft CMS has a critical flaw (CVE-2026-52889) that lets an unauthenticated visitor inject Twig template code through a hidden field.
AI reopened a 2017-audited filesystem and found seven bugs your devices can't patch
runZero found seven flaws in FatFs, the filesystem inside millions of cameras, drones and controllers. No upstream patch exists. How to detect and contain it.
SUSE Rancher patched critical flaws that turn a small foothold into full control of your Kubernetes clusters
SUSE Rancher and Fleet patched critical flaws that let a leaked token or one tenant account seize whole Kubernetes clusters.
Kairos stole 2TB, encrypted nothing, and still got $1M. Watch the login, not the file locker.
Kairos stole 2TB from a US county, encrypted nothing, and was paid $1M. Encryptionless extortion breaks file-locker alarms. Detect the login and egress.
We said a password reset wouldn't stop FortiBleed. Now it is deploying ransomware.
FortiBleed harvested 110 million Fortinet credentials. SOCRadar links that access to INC and Lynx ransomware, with 12 encryptions and a Nextcloud zero-day.
A poisoned security scanner ran on your build server and walked out with your cloud keys
The FBI's TeamPCP FLASH alert shows why a trojanized scanner steals from your servers, not the registry, and why pinning packages will not save you.
Linux Bad Epoll CVE-2026-46242: Sandbox to Root, Exploit Public
Bad Epoll (CVE-2026-46242) lets a sandboxed or unprivileged process reach root on Linux 6.4+ and Android. Fixed in April; a public 99% exploit now exists.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.