SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
Apache Struts flaw: one crafted JSON request can exhaust memory and crash the app (CVE-2026-73633)
CVE-2026-73633 (S2-072) lets one oversized JSON request exhaust memory in Apache Struts and crash the app. A public PoC is out. Patch to 7.3.0 or 6.11.0.
Bookly WordPress plugin flaw lets an anonymous visitor run scripts in the admin's browser (CVE-2026-13424)
CVE-2026-13424 is an unauthenticated stored cross-site scripting flaw in the Bookly WordPress booking plugin.
Evooo1Bot botnet turns exposed Linux servers into credential-stealing proxies
Evooo1Bot is a new Linux botnet exploiting Confluence, WSO2 and ingress-nginx, then stealing credentials and turning servers into proxies. Detect it now.
GeoServer zero-day: unauthenticated SQL injection can reach remote code execution, and there is no patch yet
A GeoServer zero-day lets unauthenticated attackers run SQL injection that can reach remote code execution. No CVE, no patch, and probing has already started.
A flaw in Adobe Commerce and Magento lets a stranger take over customer accounts with no login. Patch now.
CVE-2026-71362 is a critical, unauthenticated account takeover in Adobe Commerce and Magento (CVSS 9.1).
macOS Screen Sharing flaw (CVE-2026-65400) hands attackers root with no password, now exploited
A macOS Screen Sharing auth bypass (CVE-2026-65400) lets network attackers get root with no password. Patched Aug 6, now exploited to mine Monero. What to do.
AmnesiaStealer hijacks live macOS browser sessions, not just saved passwords
AmnesiaStealer is a Rust macOS infostealer spread via fake GitHub ClickFix pages. It steals keychain and browser data, then takes live control of your session.
Shared AI logs leak API keys and PII: OpenAI, Anthropic, and Google reasoning traces can be decoded
Researchers decoded 315,320 public AI reasoning blocks from OpenAI, Anthropic, and Google, recovering 182 credentials and 367 PII artifacts. What to do now.
Akira ransomware reboots Windows into Safe Mode to shut off security tools
An Akira ransomware affiliate rebooted a Windows host into Safe Mode to disable EDR, stole the data, then fumbled the encryption.
A malicious code repository can run commands when opened in editors built on Eclipse Theia. Update to 1.70.
Opening a malicious repository in an editor built on Eclipse Theia could run attacker commands via a crafted git config.
A poisoned Trivy scanner, not LiteLLM, exposed 2,500 organizations' CI/CD secrets
CloudSEK maps 2,500+ organizations exposed by the TeamPCP (UNC6780) supply-chain campaign.
Gunra ransomware beats MFA by backdooring the login server, not the user. Patching Fortinet won't evict it.
Gunra ransomware beats MFA by rewriting the login server so one chosen code always passes, after entering through Fortinet flaws.
Cisco ASA and FTD firewalls can be crashed by an unauthenticated attacker (CVE-2026-20349). Patch by Aug 14.
CVE-2026-20349 lets an unauthenticated attacker reload Cisco ASA and FTD firewalls for a denial of service. Exploited now, no workaround. Patch by Aug 14.
A critical flaw in Joomla's Fabrik add-on lets anyone run code on the server. Patch to 4.6.8.
CVE-2026-67282 is a CVSS 10 unauthenticated code-execution flaw in Fabrik for Joomla, fixed in 4.6.8. Patch now and check your webroot for webshells.
North Korea's Lazarus used fake job offers and a Windows zero-day to hijack defense firms' PCs
North Korea's Lazarus group used fake job offers and a Windows zero-day (CVE-2026-68820) to seize SYSTEM control of defense and aerospace PCs. Patch now.
Mozilla reissued the GPG key signing Firefox and Thunderbird on Linux after a leak, voiding old signatures
Mozilla revoked the GPG key signing Firefox and Thunderbird Linux builds after it was committed unencrypted to a private repo. What breaks, and what to do now.
Ivanti Endpoint Manager patch: leaked database passwords, editable session recordings, crashable agents
Ivanti's August 2026 Endpoint Manager advisory fixes three high-severity flaws (CVE-2026-18129, -18127, -18125), all resolved in 2024 SU7.
BdThemes WordPress plugins were hijacked to plant hidden admin accounts and a webshell
A supply-chain attack poisoned a data feed in BdThemes WordPress plugins to create hidden admin accounts and drop a webshell.
Critical Commvault flaw lets attackers run blocked commands on the backup control server
Commvault patched CVE-2026-13737, a critical CVSS 9.2 allowlist bypass in CommServe that lets attackers run commands the backup control server should block.
A WebSocket flaw in Undertow, the engine inside Red Hat JBoss, lets anyone crash the server with no login
A pre-auth flaw in Undertow (CVE-2026-15565), the web server in Red Hat JBoss EAP and Data Grid, lets an attacker exhaust memory and crash the server.
Unauthenticated SAP NetWeaver flaw can leak server memory or crash it (CVE-2026-34265). Patch now.
SAP's August 2026 patch day fixes CVE-2026-34265, a critical (CVSS 9.8) flaw letting an unauthenticated attacker crash SAP NetWeaver AS ABAP or leak its memory.
China-linked Storm-1175 turns N-able N-central into a ransomware launchpad with new StormEncryptor
Microsoft ties China-linked Storm-1175 to StormEncryptor ransomware deployed through the N-able N-central auth bypass (CVE-2026-18577). Patch, then hunt.
OpenAI paused Astra over autonomous exploit-writing
OpenAI paused Astra after tests could not rule out autonomous exploit capability. For defenders the near-term risk is automated n-day exploitation.
A breach at shipping partner Ceva Logistics exposed customer data for Steam, ING and other brands
A cyberattack on shipping partner Ceva Logistics exposed customer names, addresses and order details for Steam, ING, bol and more.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.