SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
New VMware flaws let a network attacker run code on vCenter with no login, and escape a VM onto the host
VMware's VMSA-2026-0006 patches two 9.8 vCenter flaws that add up to unauthenticated code execution, plus a 9.3 ESXi VM escape. Patch vCenter first.
cPanel security update fixes three flaws rated up to High, including one in the bundled Exim mail server
cPanel and WHM's new security release fixes CVE-2026-58047, CVE-2026-58048 and an Exim flaw, rated up to High. Patched versions for every branch, what to do.
30+ Minnesota water utilities hit in a coordinated attack, and the timing is the real warning
More than 30 Minnesota water systems were hit in a coordinated two-day attack. The simultaneity points to shared exposure; the signal sits on the IT side.
Dysphoria botnet hides on the blockchain to survive takedowns
Dysphoria, a DDoS-for-hire IoT botnet, survived a March takedown by anchoring its command servers to Ethereum and Solana names no registrar can seize, and now
ERPNext SQL injection lets a low-privilege user read the entire database, passwords included (CVE-2026-12895)
CVE-2026-12895 is a SQL injection in ERPNext that lets a low-privilege user read the whole database. Fixed in 15.111.0 and 16.22.0. Patch and rotate secrets.
Apache Traffic Server flaw lets attackers slip hidden requests past security checks and forge internal data
Apache Traffic Server has a critical flaw, CVE-2026-33267 (CVSS 10), that lets attackers smuggle requests and spoof internal metadata.
Fastjson RCE (CVE-2026-16723) now exploited on Spring Boot apps
CVE-2026-16723, a fastjson 1.x remote code execution flaw, is now exploited against US firms. Only Spring Boot fat-JAR apps are hit, and no 1.x patch is coming.
24,650 exposed server BMCs leak crackable IPMI password hashes, and no patch can fix it
A scan found 24,650 internet-exposed server BMCs leaking IPMI password hashes to anyone via CVE-2013-4786. There is no patch. Here is how to close the exposure.
Critical TeamCity flaw CVE-2026-63077 lets an unauthenticated attacker run commands on your build server
CVE-2026-63077 is a CVSS 9.8 auth bypass in every TeamCity On-Premises version. An unauthenticated attacker can run commands. Patch to 2025.11.7 or 2026.1.3.
Public DNS servers with filtering: a verified list of what each IP really blocks
Public DNS servers with filtering, verified against official docs: what the Cloudflare, Quad9, AdGuard, CleanBrowsing, ControlD, Mullvad and OpenDNS IPs block.
For this week's most-exploited bugs, the patch was the easy part
This week's most-exploited bugs each shipped with a fix, yet patching FortiOS, SharePoint, Check Point, and Langflow did not end the incident.
A max-severity flaw in Dassault's 3DEXPERIENCE platform lets an attacker run code with no login. Patch now.
CVE-2026-11756 is a CVSS 10 deserialization flaw in Dassault's 3DEXPERIENCE Launcher that allows unauthenticated remote code execution.
On-prem VeloCloud Orchestrator flaw (CVE-2026-16812) lets attackers run commands, and it is exploited now
CVE-2026-16812 is a CVSS 10.0 OS command injection in on-prem VeloCloud Orchestrator, actively exploited. See the affected and fixed builds to patch now.
Attackers can slip past Fortinet's fix and keep reading a hacked firewall's files, CISA warns
CISA added CVE-2025-68686 to its exploited catalog: a bypass of Fortinet's FortiOS symlink fix lets attackers who already breached a FortiGate keep reading its
n8n flaw lets any workflow editor run OS commands on your server (GHSA-gv7g-jm28-cr3m)
n8n patched a CVSS 8.7 expression sandbox escape (GHSA-gv7g-jm28-cr3m) that lets any workflow editor run OS commands on the host. Update to 2.32.1 now.
A vBulletin bug lets anyone run code on the forum server without logging in. Update to 6.2.2 now.
CVE-2026-61511 is an unauthenticated remote code execution flaw in vBulletin's template engine (CVSS 9.8).
GitHub and PyPI add release delays to slow poisoned packages
GitHub now waits three days before Dependabot opens an update pull request, and PyPI locks old releases from new files.
A 'read-only' role in Red Hat OpenShift Virtualization lets one tenant copy another tenant's data
CVE-2026-17527 lets a low-privileged OpenShift Virtualization tenant copy other tenants' data across namespaces through a read-only role. No fix yet; audit now.
Hotel Wi-Fi hijacks steal Microsoft 365 accounts past MFA
A campaign is hijacking hotel and conference Wi-Fi to steal Microsoft 365 accounts. A VPN closes most of it, but not the device-code trick that beats MFA.
SourTrade malvertising builds an infostealer inside your browser, so no file crosses the wire to scan
SourTrade malvertising makes the victim's browser assemble a Windows infostealer in memory, with a unique hash per visitor, so no scannable file ever crosses
A GitLab flaw lets any user with push access run code on the server, and a public exploit is now out
GitLab quietly patched a self-managed code-execution flaw on June 10 with no CVE. A public exploit is now out and any push-access user can run code as git.
A public exploit lets a stranger log in as WordPress admin through miniOrange's single sign-on plugin
A public exploit for CVE-2026-15981 lets unauthenticated attackers log in as any WordPress admin via the miniOrange SAML SSO plugin. Update to 5.4.5 now.
Any domain user can now DCSync your forest. Certighost is why.
CVE-2026-54121 lets a standard Active Directory user impersonate a domain controller through AD CS and run DCSync.
Public exploit hits a critical Oracle WebLogic flaw that forges a login to take over the server
A public proof-of-concept exploit now targets CVE-2026-60206, a CVSS 9.9 Oracle WebLogic flaw that forges a login to take over the server. Patch and hunt now.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.