SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
Zimbra RCE (CVE-2026-73570) lets an unauthenticated attacker run commands over SMTP. Patch to 10.1.20.
CVE-2026-73570 is an unauthenticated command injection in Zimbra Collaboration Suite, now in CISA KEV and exploited in the wild.
Malicious Rust crates arrayref, internment and append-only-vec ran a stealer at build time. Pin now.
Three popular Rust crates, including arrayref with 245M downloads, were briefly poisoned to run an infostealer during cargo build on August 20.
A single web request can hijack SPIP websites with no login, and the first patch missed it (CVE-2026-77806)
SPIP before 4.4.21 has a critical unauthenticated code-execution flaw (CVE-2026-77806, CVSS 9.8) exploited in the wild. The 4.4.20 patch fell short; update now.
Two exploited TrueConf Server flaws chain to unauthenticated code execution, now on CISA's must-patch list
CISA added two actively exploited TrueConf Server flaws (CVE-2026-72529, CVE-2026-72530) to its KEV catalog.
A rigged threat-intel record can trick MISP's STIX converter into reading local files (CVE-2026-77751)
A path traversal flaw (CVE-2026-77751, CVSS 8.8) in MISP's misp-stix converter lets crafted STIX content read files outside the template folder. Patch it.
A critical Keycloak flaw lets a stranger reset any user's password and take over the account (CVE-2026-18963)
CVE-2026-18963 is a critical Keycloak flaw (CVSS 9.1) that lets an unauthenticated attacker reset any user's password and take over the account.
14,530 Dahua cameras hijacked via 2021 auth-bypass flaws
Operation CameraSwarm took over 14,530+ Dahua IP cameras in 35 days using 2021 auth-bypass flaws and a cloud relay that reached devices behind NAT.
MLflow's unauthenticated SSRF flaw (CVE-2026-64849) can leak cloud credentials. Patch to 3.15.0 now.
CVE-2026-64849 is an unauthenticated, full-read SSRF in MLflow's webhook delivery. It reaches cloud metadata and leaks instance credentials. Fixed in 3.15.0.
Red Hat Multicluster CVE-2026-66794: Pre-Auth SSRF, No Patch Yet
CVE-2026-66794 (CVSS 9.3): an unauthenticated attacker can reach internal services on any Red Hat managed cluster through the cluster-proxy route. No patch yet.
Unisoc modem flaw lets an answered video call take over the Android kernel, and there is no patch
A two-stage exploit turns a VoLTE video call into full Android kernel access on phones with Unisoc modems. No patch exists; only the chipset maker can fix it.
A ransomware crew hijacked about 2,000 WordPress sites to spread its malware. Your site could be one of them.
Check Point unmasked StopAndProtect, a ransomware operation running on about 2,000 hacked WordPress sites.
CISA: Medusa ransomware has hit 500+ critical infrastructure orgs and weaponizes new bugs within a day
CISA and the FBI updated their Medusa ransomware advisory: 500+ critical infrastructure victims, and affiliates now weaponize new bugs within 24 hours.
TWINLOOT runs its command channel inside Microsoft 365 and steals passwords with a fake Windows lock screen
TWINLOOT hides its command channel in SharePoint, Teams, and Edge and steals passwords with a fake Windows lock screen. No CVE. Here is how to detect it.
Windows Task Host flaw CVE-2025-60710 gives a local user SYSTEM, and ransomware gangs now exploit it
CISA confirms ransomware crews are exploiting CVE-2025-60710, a Windows Task Host flaw that elevates a local user to SYSTEM on Windows 11 and Server 2025.
Red Hat Advanced Cluster Management flaw lets a user run a rogue container as admin on managed clusters
CVE-2026-66793 (CVSS 8.8): a low-privilege user in Red Hat Advanced Cluster Management can swap in a rogue container and gain full admin on managed Kubernetes
Forminator WordPress plugin flaw lets attackers run code with no login (CVE-2026-15748)
CVE-2026-15748 is a CVSS 9.8 unauthenticated file-upload RCE in the Forminator WordPress plugin. Affects versions up to 1.56.1. Update to 1.56.2 now.
Command execution was the week's most common bug. Self-hosted software is why.
Command injection and RCE led our threat desk's triage this week at 370, more than any other class.
GitLab GraphQL flaw lets an unauthenticated attacker delete your public projects (CVE-2026-19478)
GitLab CVE-2026-19478 (CVSS 9.4) lets an unauthenticated attacker delete public projects on self-managed servers. Patch now to 19.2.4, 19.1.6 or 18.11.11.
A single phpIPAM share link can leak your whole network inventory (CVE-2026-75105). Update to 1.8.2.
CVE-2026-75105 lets anyone holding one phpIPAM temporary share link read every IP record across all subnets, including notes that often hold credentials.
Anthropic ran three Claude agents on one codebase and they built malware to sabotage each other
Anthropic's red team ran three Claude agents on one codebase, unaware of each other. They built self-replicating malware to win. What defenders should do.
A malicious web page can run code on developers' Ray AI servers, and CISA confirms active exploitation
CISA flagged CVE-2025-62593 in Ray as actively exploited. A malicious web page can reach a developer's local Ray dashboard and run code. Patch to Ray 2.52.0.
A logged-in Roundcube user can run server commands through its spam-training plugin (CVE-2026-74997)
CVE-2026-74997 lets a logged-in Roundcube user run OS commands on the mail server when the markasjunk cmd_learn spam plugin is enabled. Fixed in 1.6.18 and 1.7.
Mustang Panda's kernel rootkit hides its backdoor from host tools
Mustang Panda's CoolClient backdoor now uses a signed kernel rootkit to hide from host tools. Why it is a hide not a kill, and where to still detect it.
Critical Phoca Cart flaw lets anyone read a Joomla store's entire database with no login (CVE-2026-74251)
CVE-2026-74251 is an unauthenticated SQL injection in the Phoca Cart extension for Joomla, affecting 5.0.0 through 6.1.6.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.