SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
A logged-in user can write files outside JFrog Artifactory's cache, and it's now on CISA's must-patch list
CISA added a JFrog Artifactory path-traversal flaw (CVE-2026-66384) to its must-patch list. A logged-in user can write files outside the Docker cache path.
cPanel flaw CVE-2026-65643 lets any hosting account gain root on the whole server. Patch now.
cPanel and WHM flaw CVE-2026-65643 lets any authenticated hosting account write files as root and take full control of a shared server. Patched builds are out.
CISA red team breached two critical infrastructure networks. Only one SOC noticed.
A CISA red team hit two critical infrastructure networks with the same tradecraft. One SOC contained it in minutes, the other never noticed. Here is the gap.
PaperCut print servers are under active attack through a login-free code-execution flaw
Attackers are exploiting an unauthenticated flaw in PaperCut NG and MF print servers to run code as the host account. Restrict access and patch now.
LiteSpeed Cache flaw lets a planted comment run scripts in your visitors' browsers (CVE-2026-18978)
CVE-2026-18978 is a stored cross-site scripting flaw in the LiteSpeed Cache WordPress plugin.
Gitea flaw CVE-2026-60004 lets any user run code on your server, now exploited. Patch 1.27.1.
CISA added Gitea's CVE-2026-60004 to its exploited list on Aug 25. A public exploit lets any user run code via the diffpatch API. Patch to 1.27.1 and hunt.
Weedhack stealer survives takedown by hiding servers on Ethereum, still spreading via fake Minecraft sites
Weedhack, an infostealer spread through fake Minecraft sites, survived a C2 takedown by reading server addresses from the Ethereum blockchain. How to detect it.
Four SSRF flaws in one week turned self-hosted apps into a foothold in your own network
Four unrelated products shipped SSRF flaws this week, from a Kubernetes proxy to MLflow. Why self-hosted SSRF reaches cloud metadata, and how to contain it.
Iran-linked hackers took a UK power plant offline for four days
Iran-linked hackers reportedly kept a small UK power plant offline for four days, as water systems across 12 US states were hit. What defenders should do.
A max-severity Oracle WebLogic proxy flaw lets attackers reach protected data, and it is under active attack
CVE-2026-21962 is a CVSS 10 access-control bypass in Oracle's WebLogic proxy plug-in, now in CISA KEV with a three-day deadline.
ShinyHunters beat MFA at ReliaQuest. Device trust stopped it.
ShinyHunters vished a ReliaQuest employee and got the MFA push approved, but device-trust rules blocked the theft.
Thousands of leaked AWS keys still work, and 768 give attackers full account control
Truffle Security found 64,024 exposed AWS keys and 88% still authenticate; 768 give full account control. Why rotation fails and what to detect and fix.
A phpIPAM flaw lets an unauthenticated attacker read and delete every network record (CVE-2026-67602)
CVE-2026-67602 is a critical unauthenticated flaw in phpIPAM before 1.8.2 that lets anyone read, change, or delete every IP record through the REST API.
fast-uri, the URL parser in many Node.js apps, can be tricked into calling internal systems (CVE-2026-75899)
CVE-2026-75899 lets a double-encoded hostname bypass fast-uri's URL checks and resolve to localhost or a cloud metadata endpoint. Fixed in 2.4.5, 3.1.6, 4.1.3.
DJI drone flaw lets a nearby attacker hijack the Wi-Fi link over Bluetooth and disrupt flight
CVE-2026-78306: an unauthenticated Bluetooth interface on 16 DJI drone models lets a nearby attacker rewrite the Wi-Fi key and disrupt flight. Models and fixes.
Malware turns Android car head units into a proxy botnet that hides attacks behind trusted home IPs
Kaspersky found the first malware built for Android car head units. It ignores the vehicle and rents the car's connection as a residential proxy.
A logged-in GitLab user can write files across the server through the package registry (CVE-2026-10053)
CVE-2026-10053 lets a logged-in GitLab user write files across a self-managed server via the package registry. Fixed in 19.2.2, 19.1.4, 19.0.6. Update now.
Encrypted page instructions make Grok leak your chat history
Adversa AI showed encrypted web-page instructions can make xAI's Grok leak your chat history and session data. Why plaintext filters miss it, and how to defend.
Citrix NetScaler flaw CVE-2026-19490 lets an attacker bypass login on Gateway and AAA servers. Patch now.
A critical NetScaler auth bypass (CVE-2026-19490, CVSS 9.3) lets a remote attacker skip login on Gateway and AAA servers.
Defender's own signed driver can delete your security tools at boot, and Microsoft won't patch it
Check Point turned Microsoft Defender's built-in BTR.sys driver into a kernel tool that deletes security software at boot.
NASA AIT-GUI console has no login (CVSS 9.4), and the 2.5.2 patch still adds no authentication
AIT-GUI, NASA/JPL open-source operator console, binds to every interface with no login (CVSS 9.4). A browser can send commands, and the 2.5.2 fix adds no auth.
isolated-vm's sandbox flaw lets untrusted code take over the host running your AI workflows
A critical type-confusion flaw in isolated-vm lets sandboxed JavaScript escape and run code on the host. Patch to 7.0.1 or 6.2.0, and watch the Node process.
Elementor Pro flaw (CVE-2026-32475) lets an unauthenticated attacker upload PHP and run code. Patch to 4.2.2.
Elementor Pro before 4.2.2 has a critical file upload flaw (CVE-2026-32475, CVSS 9.0) letting an unauthenticated attacker plant a PHP webshell. Patch now.
A flaw in the Mailgun for WordPress plugin lets a stranger take over the admin account (CVE-2026-78003)
A critical Mailgun for WordPress plugin flaw (CVE-2026-78003) lets unauthenticated attackers reroute password-reset emails and seize admin accounts. Fix: 2.2.1.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.