SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
A rogue member cluster can run code as root on Red Hat's cross-cluster gateway (CVE-2026-66786)
CVE-2026-66786 (CVSS 9.1): in cert-auth mode a malicious member cluster can inject IPsec config into Red Hat Submariner and run code as root on the gateway.
Switchvox flaw (CVE-2026-9586) lets an unauthenticated attacker run code. Patch now.
Attackers are exploiting CVE-2026-9586, an unauthenticated flaw in Sangoma Switchvox that leads to remote code execution. Patch to 8.4.0.2 and hunt now.
SonicWall SMA1000 zero-days chain a pre-login SSRF into remote code execution, exploited now
SonicWall SMA1000 zero-days CVE-2026-83548 and CVE-2026-83549 chain a pre-login SSRF into admin command injection for RCE. Exploited now. Patch and hunt.
The Sality botnet is disrupted after 23 years, but infected machines stay compromised
Police and CrowdStrike disrupted the 23-year-old Sality botnet across 15,000+ machines. The takedown breaks its control, not the infections. What to do now.
Critical Predis flaw lets attacker-controlled data smuggle extra Redis commands (CVE-2026-84372)
CVE-2026-84372 is a CVSS 9.8 command-injection flaw in the Predis PHP client. It hits 3.0 to 3.2 on cluster and replication connections. Upgrade to 3.3.0.
Microsoft Exchange auth-bypass CVE-2026-62911 gives attackers a SYSTEM webshell, and a public exploit is out
CVE-2026-62911 lets attackers relay an Exchange server's own machine account into a SYSTEM webshell.
A BGP hijack pushed a malicious Virtualizor update that ran as root. Check for one systemd service.
A 33-hour BGP hijack redirected Softaculous update traffic and pushed a malicious Virtualizor package that ran as root. Check a systemd service, patch 3.2.9.9.
A public exploit turns Kaspersky's endpoint agent into a privilege-escalation tool on fully patched Windows 11
A public exploit, HardBreacher, coerces Kaspersky Endpoint Security into a privileged write on fully patched Windows 11. Vendor says fixed, no CVE yet.
WP Fastest Cache flaw lets attackers poison cached pages served to every WordPress visitor
WP Fastest Cache flaw CVE-2026-74916 lets attackers poison cached WordPress pages and hit every visitor with malicious script. Update to 1.5.1 and purge cache.
TerminalFix moves ClickFix into the terminal to slip past the defenses built for the Run box
Microsoft documented TerminalFix, a ClickFix variant that pastes PowerShell into Windows Terminal to plant a reverse-tunnel backdoor. Here is what to detect.
Manchester Airports breach: a marketing API key exposed in client-side JavaScript
An extortion group says it pulled 86GB from Manchester Airports Group using a marketing API key exposed in client-side JavaScript.
Fire Ant compromised Cisco routers and TACACS servers, stole admin credentials, and rewrote logs to hide
China-linked Fire Ant compromised Cisco IOS XR routers and TACACS servers, stole live admin credentials, and rewrote logs to stay invisible. How to detect it.
Trusted browser extensions turned into crypto-wallet drainers after silent updates
Browser extensions in the Superior campaign shipped clean, then a silent update drained crypto wallets and stole logins. How to detect it and respond.
Dell PowerStore flaw lets an attacker read admin credentials off the array without logging in
Dell PowerStore's management interface has a critical flaw (CVE-2026-58574, CVSS 9.8): an unauthenticated attacker can read files that expose admin credentials.
AJCloud camera firmware flaw lets anyone read your Wi-Fi password and camera logins
A path traversal bug in AJCloud AJY IPC camera firmware (CVE-2026-56718) lets unauthenticated attackers read Wi-Fi passwords and camera credentials as root.
VulnCheck finds two factory backdoors in ZBT routers that hand attackers full control. No fix exists.
VulnCheck found two more factory implants in ZBT router firmware, SPEAKINGSTONE and DARKLANTERN (CVE-2026-74232/74233), that grant remote root access.
Unitree G1 robot flaws give root over Bluetooth, and one hacked robot can reach the next
Two Unitree G1 humanoid robot flaws (CVE-2026-76639, CVE-2026-76640) give an attacker root over Bluetooth or the network, and one hacked robot can reach the
Five WordPress plugin and theme flaws let attackers take the site or the whole server
Wordfence and Patchstack disclosed five unauthenticated WordPress flaws rated 9.8 to 10.0. GiveWP and Avada run code on the host. Patch all five now.
Three ServiceNow AI Platform flaws (CVSS 10.0) let an unauthenticated attacker run code. Patch now.
ServiceNow patched three CVSS 10.0 AI Platform flaws an unauthenticated attacker can chain for code execution, SQL injection, and privilege escalation.
Two critical Next.js flaws let attackers run code on self-hosted servers
Next.js patched two critical flaws that let unauthenticated attackers run code on self-hosted servers. Vercel apps are covered. Update to 15.5.24 or 16.3.3 now.
Linux kernel IPv6 flaw (CVE-2026-53362) lets a container break out to host root, now exploited
CVE-2026-53362 is an actively exploited Linux kernel IPv6 flaw that lets a low-privilege user escape a container to host root.
CISA says a 2022 Linux kernel flaw lets a local user become root, and it's now being exploited (CVE-2022-0995)
CISA added Linux kernel flaw CVE-2022-0995 to its actively-exploited list. A local user can escalate to root.
One logged-in Langflow user can run any command on the server, and its code lockdown doesn't stop it
A critical Langflow flaw (CVE-2026-19295, CVSS 9.9) lets any authenticated user run OS commands on the server and bypasses the
An old ownCloud flaw is now stealing files from unpatched servers, including a nuclear agency
CVE-2023-49105, an ownCloud auth bypass patched in 2023, is now in CISA's KEV list after a suspected Chinese operator stole nuclear-agency files.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.