SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
A breach at shipping partner Ceva Logistics exposed customer data for Steam, ING and other brands
A cyberattack on shipping partner Ceva Logistics exposed customer names, addresses and order details for Steam, ING, bol and more.
Malicious npm packages skip install scripts and hide their C2 in DNS to drop a cross-platform stealer
Flooding Dropper seeded close to 800 malicious npm packages that run on require() and fall back to DNS TXT records for C2. How to detect it and clean up.
A Linux kernel SCTP flaw (CVE-2026-64564) escalates to root and breaks out of default-seccomp containers
SCTPhantom (CVE-2026-64564) is a use-after-free in Linux SCTP that reaches host root and escaped default-seccomp containers in 6 of 8 tests.
Fake IT help-desk calls are stealing Microsoft 365 and Okta data
A vishing crew posing as IT help desk on personal phones steals Microsoft 365 and Okta sessions, then renames to dodge IOC lists. Here is how to detect it.
WordPress login-page XSS can chain to code execution, patch 7.0.3
WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth login-page XSS that runs attacker code from one failed login and can chain to server code execution. Patch now.
Malware can use Windows Hello keys to sign into Entra ID as you
Malware in a signed-in Windows session can use the Windows Hello key to log into Microsoft Entra ID and hold a 90-day token. How to detect and mitigate it.
NatJack: a shared-NAT neighbor can seize your live TCP sessions and forge DNS
NatJack lets an attacker behind the same NAT hijack live TCP sessions, spoof DNS, and exhaust connection tables. Two CVEs: patch Windows and Linux now.
Attackers turn unpatched TrueConf servers into backdoor delivery, pushing trojanized client installers
Head Mare exploited unpatched TrueConf servers (before 5.3.9, 5.4.9, 5.5.5) to swap client installers for unsigned backdoors.
Atlassian Rovo could leak Jira and Confluence data; one of two attack routes is unconfirmed as fixed
Two firms found Atlassian Rovo could be tricked into leaking Jira, Confluence and SharePoint data. One attack route is patched; the other is unconfirmed.
Metabase zero-day (CVSS 10.0): unauthenticated SQL injection hands attackers admin and data. Patch now.
Metabase's SQL injection zero-day (CVSS 10.0) gives unauthenticated attackers admin access and stored database credentials. Exploited now: patch and rotate.
TONTOU beats Spectre v2 fixes to read kernel memory on AMD chips, but only from local code
TONTOU, a new MIT attack, re-poisons the branch predictor after Spectre v2 defenses run to leak kernel memory. It needs local code. AMD patched, Intel did not.
VulnCheck: Zbtlink routers ship a factory root shell with no fix. The model list is not where you start.
VulnCheck found a factory-shipped remote-access implant in 20 Zbtlink router models that calls home and hands a remote root shell. There is no patched firmware.
The Snowflake hacker pleaded guilty. The breach used no exploit, just old passwords and MFA left off.
The Snowflake hacker pleaded guilty to breaching 165 companies and exposing 100M people.
A second dracut flaw (CVE-2026-15816) lets a rogue DHCP server run code as root on network-booted Linux
CVE-2026-15816 is a second dracut flaw: a rogue DHCP server can run code as root during boot on network-booted Linux. June's CVE-2026-6893 fix missed it.
league/commonmark flaw lets planted text run scripts in your users' browsers, even with safe links on
CVE-2026-71478 lets attacker-planted Markdown run scripts through league/commonmark's Attributes extension, bypassing allow_unsafe_links. Update to 2.9.0.
A signed ScreenConnect installer becomes a backdoor after malware turns Defender off
The SMOKE#SCREEN campaign disables Windows Defender, then installs a legitimately signed ScreenConnect agent your allowlist trusts.
OVSwrap (CVE-2026-64531): a 13-year-old Open vSwitch kernel bug now hands local users root on default Linux
OVSwrap (CVE-2026-64531, CVSS 7.8) lets an ordinary local user reach root through the Linux Open vSwitch datapath on most default distros.
A Keycloak flaw lets attackers forge a single sign-on login and hijack accounts (CVE-2026-16443)
CVE-2026-16443 is a Keycloak flaw where importing SAML identity-provider metadata can leave signature checks off, letting an attacker forge a login.
DOUBLECUP loader service stages malware in the browser cache to drop a RAT on Windows and macOS
DOUBLECUP, a Russian loader service, stages malware in the browser cache via ClickFix, then rebuilds it with trusted tools to drop a RAT on Windows and macOS.
SUSE Rancher stored cluster join tokens in plaintext, and one leaked token can take over the whole cluster
SUSE Rancher stored long-lived Kubernetes registration tokens in plaintext (CVE-2026-55997, CVSS 8.8). Upgrade to 2.14.4 or 2.13.8, then rotate every token.
Langflow's auto-login default gives any stranger admin, then RCE
CVE-2026-9198 lets an unauthenticated attacker mint a Langflow superuser token via auto-login, then run code as admin. KEV-listed, patch past 1.10.0 now.
A self-spreading npm worm poisoned hundreds of packages to steal cloud and GitHub tokens
A self-propagating npm worm that began in keyv 6.0.0 poisoned hundreds of packages on August 4, steals GitHub, npm, cloud, Vault and Kubernetes credentials
An AI system found 14,090 new bugs across open-source software. Attackers can run the same scan.
Palo Alto's Unit 42 says its NOVA system found 14,090 unreported bugs across 3,915 open-source projects. The count is not the story.
Critical cPanel flaw lets a hosting account reach database root
cPanel CVE-2026-58048 (CVSS 9.4) lets an authenticated hosting customer run SQL as database root, risking full server compromise. Patch to the fixed build now.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.