SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
The free plugin was clean. The paid update is what backdoored these WordPress sites.
Backdoored ShapedPlugin Pro updates stole admin logins and 2FA seeds from WordPress sites between April and June 2026. A password reset alone will not clear it.
On 200,000 WordPress sites, a low-level user can quietly steal the admin's login
A contributor-level user can make Ultimate Member leak every user's password reset link, admins included. Affects versions through 2.11.4; fixed in 2.12.0.
Cisco Unified CM's flaw is being exploited. Whether it touches you depends on one default setting.
CVE-2026-20230 in Cisco Unified CM can reach root, but only where WebDialer is enabled, and it ships off. Check that before you panic-patch.
A guest virtual machine can read its host's memory through a flaw in QEMU's built-in networking
A patched flaw in libslirp, QEMU's usermode networking, lets a privileged guest virtual machine read gigabytes of host memory. Update to libslirp 4.9.2 now.
Mistype the password and this Lantronix box runs attacker commands as root. CISA says it is happening now.
CISA flagged CVE-2025-67038 as exploited on June 23. A failed login on a Lantronix EDS5000 serial server runs attacker commands as root.
Crawl4AI shipped its server unlocked by default. It took three patches to close the door.
Crawl4AI's Docker API shipped unauthenticated by default, exposing 51,000+ deployments to remote code execution and cloud-metadata SSRF. Upgrade to 0.9.0 now.
Add-ons for the OpenClaw AI assistant are stealing logins and running crypto scams
Malicious OpenClaw skills on the ClawHub marketplace steal credentials and hijack AI agents for crypto fraud, and some slip past the store's own scanner.
A new Mac backdoor is built to fool the AI that inspects it
macOS.Gaslight embeds fake AI system messages to make automated, LLM-assisted malware analysis abort.
jackson-databind CVE-2026-54513: Type Allowlist Bypass via Arrays
CVE-2026-54513 lets attackers bypass jackson-databind's polymorphic type validator by wrapping a banned class in an array. Patch to 2.18.8, 2.21.4 or 3.1.4.
Attackers can take over your self-hosted UniFi controller with no password. CISA says it is happening now.
Three chained UniFi OS Server flaws give unauthenticated root. CISA added all three to its exploited list on June 23. Patch to 5.0.8 and check who can reach it.
PixelSmash: a video your server opens by itself can run an attacker's code
PixelSmash (CVE-2026-8461) lets a crafted video run code on FFmpeg-based media servers like Jellyfin and Nextcloud. Update to FFmpeg 8.1.2, then hunt.
Fake WhatsApp Invoice Installs ManageEngine RMM to Hijack PCs
A fake invoice on WhatsApp silently installs ManageEngine Endpoint Central, a legitimate remote-management tool, to hijack PCs.
Your self-hosted Gogs server lets any logged-in user read repos that aren't theirs
A validation gap in Gogs Mirror Settings (CVE-2026-52801) lets any authenticated user import local repositories and reach internal systems. Patch to 0.14.3 now.
scim-patch CVE-2026-48170: One Request Poisons Object.prototype
CVE-2026-48170 lets one SCIM PATCH request poison Object.prototype across a Node.js app using scim-patch, risking admin forgery. Update to 0.9.1 now.
A single Budibase app builder can read your server's secrets and take over every workspace
CVE-2026-54352 lets a Budibase workspace builder read the server's secret file via a crafted PWA zip and take over every workspace. Patch self-hosted to 3.39.9.
Washington export-controlled an AI for finding bugs. Your oldest code is the soft target.
The US used export-control powers to pull a frontier AI model that finds software bugs at scale.
usbliter8: Unpatchable Boot Exploit on Apple A12 and A13 Devices
usbliter8 is an unpatchable boot-chain exploit for Apple A12 and A13 devices. Here is the real enterprise risk, why remote wipe will not help, and what to do.
PaperCut's Windows print client can be tricked into giving a local attacker total control
CVE-2026-6645 lets a local attacker plant a file that PaperCut's Print Deploy client runs with full system rights on Windows. Update to version 1.10.4178.
Central Dogma: Public Default Secret Lets Nearby Attackers In
Central Dogma before 0.84.0 silently uses a public default secret when ZooKeeper replication runs without one set, letting nearby attackers seize the cluster.
Squid Squidbleed CVE-2026-47729: Credential Leak, 7.6 Is No Fix
Squidbleed (CVE-2026-47729) leaks memory from Squid proxies in default config, including login credentials. A public exploit is out, and 7.6 does not patch it.
That decade-old router you forgot is now scanning networks for attackers
A botnet called AryStinger hijacked over 4,300 end-of-life D-Link and Linksys routers into a distributed scanning grid for reconnaissance, not DDoS. What to do.
Popa Botnet: 2 Million Hacked TV Boxes Sell Trusted Home IPs
Researchers linked the Popa botnet of 2 million hacked TV boxes to a residential proxy service. Here is why IP reputation no longer stops account takeovers.
Prinz Eugen Ransomware Encrypts Newest Files First, No Note
Prinz Eugen ransomware encrypts your most recently changed files first and drops no ransom note, defeating canary traps and note-based SOC alerts. What to do.
EaseUS Partition Master CVE-2026-12781: Any User Reaches SYSTEM
A signed driver in EaseUS Partition Master (CVE-2026-12781) lets any standard Windows user read and overwrite the whole disk to reach SYSTEM.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.