Deep-dives, comparisons, and incident replays from the engineers building Suriq, managed security on Wazuh.https://suriq.io/en-ushttps://suriq.io/blog/signal-fixes-outside-package-manager/https://suriq.io/blog/signal-fixes-outside-package-manager/Six of eight flaws Suriq published this week, from Brotli to Oracle Java to LiteLLM, could not be fixed by an OS update. Where each fix landed and how to check.Tue, 27 Oct 2026 10:12:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/brotli-cve-2026-111497-bundled-decoder-rce/https://suriq.io/blog/brotli-cve-2026-111497-bundled-decoder-rce/Brotli CVE-2026-111497 sits in copies bundled by Node.js, .NET, Python and PHP, so a distro update is not enough. Fixed versions, stopgaps and a host check.Tue, 27 Oct 2026 08:22:19 GMTSecurity newsNoam Alumhttps://suriq.io/blog/plex-media-server-cve-2026-96652-exploited-rce-chain/https://suriq.io/blog/plex-media-server-cve-2026-96652-exploited-rce-chain/Four Plex Media Server flaws (CVE-2026-96652 to 96656) chain into unauthenticated RCE, now CISA KEV-listed, exploited for cryptomining. Patch to 1.43.3.10861.Mon, 26 Oct 2026 08:19:14 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/oracle-java-cve-2026-114820-emudhra-ca-trust/https://suriq.io/blog/oracle-java-cve-2026-114820-emudhra-ca-trust/Oracle Security Alert CVE-2026-114820 (CVSS 9.1) removes the compromised eMudhra CA roots from Java's cacerts trust store.Sun, 25 Oct 2026 00:26:53 GMTSecurity newsNoam Alumhttps://suriq.io/blog/litellm-1-107-0-supply-chain-credential-theft/https://suriq.io/blog/litellm-1-107-0-supply-chain-credential-theft/A poisoned LiteLLM 1.107.0 release on PyPI and Docker stole cloud, AI, and SSH credentials via Python startup hooks. Roll back to 1.106.2 and rotate keys.Sat, 24 Oct 2026 00:12:32 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gitlab-cve-2026-110264-regex-rce/https://suriq.io/blog/gitlab-cve-2026-110264-regex-rce/GitLab patched CVE-2026-110264, a CVSS 10 integer-overflow flaw in its regex engine that lets an unauthenticated attacker run code on self-managed servers.Fri, 23 Oct 2026 00:09:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/how-to-use-wazuh-as-edr/https://suriq.io/blog/how-to-use-wazuh-as-edr/How to use Wazuh as an EDR: the real config for endpoint detection, Sysmon ingestion, and scripted active response, plus where it stops short of a full EDR.Thu, 22 Oct 2026 09:16:58 GMTExplainersNoam Alumhttps://suriq.io/blog/siemens-software-center-cve-2026-110936-dll-hijack/https://suriq.io/blog/siemens-software-center-cve-2026-110936-dll-hijack/CVE-2026-110936 is a CISA KEV-listed DLL hijacking flaw in Siemens Software Center, exploited in a ClickFix campaign. Update to V4.0.9.8 and hunt the IOCs.Thu, 22 Oct 2026 00:11:18 GMTSecurity newsNoam Alumhttps://suriq.io/blog/php-core-rce-cve-2026-109618-php2shell/https://suriq.io/blog/php-core-rce-cve-2026-109618-php2shell/PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical CVSS 9.2 core flaws, CVE-2026-109618 and CVE-2026-109619, that leaked before release. Update now.Wed, 21 Oct 2026 13:24:12 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/apache-tomcat-cve-2026-101356-data-mix-up/https://suriq.io/blog/apache-tomcat-cve-2026-101356-data-mix-up/Apache Tomcat fixed two CVSS 9.1 flaws (CVE-2026-101356, CVE-2026-103119) that can send one user's request or response to another.Wed, 21 Oct 2026 00:54:25 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/signal-fail-open-controls/https://suriq.io/blog/signal-fail-open-controls/Four of seven flaws Suriq published this week were controls that failed open: an OAuth gate, a login lockout, an authorization check, and a trust boundary.Tue, 20 Oct 2026 09:18:17 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/siteguard-cve-2026-106931-command-injection-root/https://suriq.io/blog/siteguard-cve-2026-106931-command-injection-root/CVE-2026-106931 is an actively exploited command injection in SiteGuard Server Edition's default-on feature that gives root or SYSTEM. Patch to 8.00 Update 5.Tue, 20 Oct 2026 08:59:05 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/apache-camel-cve-2026-80312-oauth-fail-open-bypass/https://suriq.io/blog/apache-camel-cve-2026-80312-oauth-fail-open-bypass/Apache Camel CVE-2026-80312 is a fail-open OAuth bypass (CVSS 8.2): unauthenticated requests reached protected routes. Upgrade to 4.18.5, 4.22.1, or 4.23.0.Mon, 19 Oct 2026 10:54:19 GMTSecurity newsNoam Alumhttps://suriq.io/blog/beyondtrust-cve-2026-102764-auth-bypass-exploited/https://suriq.io/blog/beyondtrust-cve-2026-102764-auth-bypass-exploited/China-linked actors exploited BeyondTrust Remote Support auth-bypass CVE-2026-102764 (CVSS 9.3) since August. Self-hosted must patch now and hunt.Sun, 18 Oct 2026 15:47:55 GMTSecurity newsNoam Alumhttps://suriq.io/blog/latepoint-cve-2026-110653-otp-race-auth-bypass/https://suriq.io/blog/latepoint-cve-2026-110653-otp-race-auth-bypass/LatePoint CVE-2026-110653 (CVSS 9.1): a race condition defeats the login-code lockout and lets attackers hijack a customer account. Update to 5.7.5 now.Sat, 17 Oct 2026 03:08:02 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/funnelkit-cve-2026-107746-woocommerce-pii-leak/https://suriq.io/blog/funnelkit-cve-2026-107746-woocommerce-pii-leak/FunnelKit CVE-2026-107746 lets unauthenticated attackers read billing names, addresses, emails and phones from any WooCommerce order. Update to 3.17.0 now.Fri, 16 Oct 2026 04:55:12 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/how-to-use-wazuh-logtest/https://suriq.io/blog/how-to-use-wazuh-logtest/How to use wazuh-logtest to test Wazuh decoders and rules: run the CLI, read all three phases, use verbose mode, and fix a rule that will not fire as expected.Thu, 15 Oct 2026 14:12:03 GMTExplainersNoam Alumhttps://suriq.io/blog/onlyoffice-cve-2026-110385-document-builder-rce/https://suriq.io/blog/onlyoffice-cve-2026-110385-document-builder-rce/ONLYOFFICE Document Server has a high-severity RCE (CVE-2026-110385) via the Document Builder. Upgrade to 10.0 and confirm inbound JWT validation is enabled.Wed, 14 Oct 2026 00:55:32 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/signal-pipeline-rce-blast-radius/https://suriq.io/blog/signal-pipeline-rce-blast-radius/GitLab and Argo CD both shipped maximum-severity RCE fixes in one week.Tue, 13 Oct 2026 09:18:50 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gitlab-cve-2026-97229-cicd-regex-unauth-rce/https://suriq.io/blog/gitlab-cve-2026-97229-cicd-regex-unauth-rce/GitLab's emergency patch fixes CVE-2026-97229, a CVSS 10 unauthenticated code-execution flaw in the CI/CD regex compiler.Tue, 13 Oct 2026 01:39:26 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/sonicwall-sma1000-cve-2026-102255-preauth-ssrf/https://suriq.io/blog/sonicwall-sma1000-cve-2026-102255-preauth-ssrf/SonicWall SMA1000 CVE-2026-102255 is a CVSS 10 pre-auth SSRF, exploited within a day of the October 6 patch. Affected versions, the fix, and detection.Mon, 12 Oct 2026 08:13:41 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ahsaycbs-cve-2026-105134-unauth-rce-exploited/https://suriq.io/blog/ahsaycbs-cve-2026-105134-unauth-rce-exploited/Attackers are chaining two AhsayCBS backup-platform flaws for unauthenticated RCE as SYSTEM. CVE-2026-105134 is exploited in the wild with no fixed release yet.Sun, 11 Oct 2026 08:53:42 GMTSecurity newsNoam Alumhttps://suriq.io/blog/argo-cd-coordinated-security-release-four-critical/https://suriq.io/blog/argo-cd-coordinated-security-release-four-critical/Argo CD's October 7 release fixes seven flaws, four rated CVSS 9.9. Low-privilege users could run code or read credentials in the repo-server.Sat, 10 Oct 2026 03:26:08 GMTSecurity newsNoam Alumhttps://suriq.io/blog/flax-typhoon-legacy-server-bugs-cisa-kev/https://suriq.io/blog/flax-typhoon-legacy-server-bugs-cisa-kev/CISA added five legacy self-hosted server flaws (BIND, ProFTPD, Struts, ONLYOFFICE, Strapi) to its KEV catalog as China-linked scanners exploit them.Fri, 09 Oct 2026 08:56:06 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/latepoint-cve-2026-17538-customer-data-tampering/https://suriq.io/blog/latepoint-cve-2026-17538-customer-data-tampering/LatePoint CVE-2026-17538 lets any logged-in WordPress user edit arbitrary customer records in the booking plugin, and can enable account takeover. Update now.Thu, 08 Oct 2026 00:15:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/keycloak-cve-2026-107121-starttls-downgrade/https://suriq.io/blog/keycloak-cve-2026-107121-starttls-downgrade/Keycloak CVE-2026-107121 lets a network attacker force its SMTP STARTTLS connection to plaintext, exposing mail credentials and reset emails.Wed, 07 Oct 2026 08:10:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/rejetto-hfs-cve-2026-61500/https://suriq.io/blog/rejetto-hfs-cve-2026-61500/CVE-2026-61500 lets attackers forge admin sessions in Rejetto HFS 3.0.0-3.2.0 and run code. Fixed in 3.2.1; scanning began within 48 hours of the public PoC.Tue, 06 Oct 2026 08:30:10 GMTSecurity newsNoam Alumhttps://suriq.io/blog/libreoffice-cve-2026-63277-document-open-rce/https://suriq.io/blog/libreoffice-cve-2026-63277-document-open-rce/LibreOffice CVE-2026-63277 lets a crafted Calc file load a remote Java driver and run code on open. One of six flaws fixed in 26.2.5 and 26.8.0. Patch now.Mon, 05 Oct 2026 11:40:21 GMTSecurity newsNoam Alumhttps://suriq.io/blog/netscaler-cve-2026-88779-saml-dos/https://suriq.io/blog/netscaler-cve-2026-88779-saml-dos/Citrix NetScaler CVE-2026-88779 lets an unauthenticated attacker crash ADC and Gateway appliances configured for SAML sign-on. Patch to 14.1-73.41 now.Sun, 04 Oct 2026 03:37:44 GMTSecurity newsNoam Alumhttps://suriq.io/blog/jeg-elementor-kit-cve-2026-100180-stored-xss/https://suriq.io/blog/jeg-elementor-kit-cve-2026-100180-stored-xss/Jeg Kit for Elementor CVE-2026-100180 is an unauthenticated stored XSS fixed in 3.2.20, the second comment XSS in this 300k-install plugin in three weeks.Sat, 03 Oct 2026 03:10:10 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/cpanel-cve-2026-93698-multilang-adminbin-command-injection/https://suriq.io/blog/cpanel-cve-2026-93698-multilang-adminbin-command-injection/cPanel CVE-2026-93698 is a critical 9.9 command-injection flaw in the Multilang adminbin that lets a low-privileged account run commands on the server.Fri, 02 Oct 2026 06:52:21 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/newsletter-plugin-token-leak-cve-2026-92537/https://suriq.io/blog/newsletter-plugin-token-leak-cve-2026-92537/CVE-2026-92537 in the WordPress Newsletter plugin leaks a subscriber's login cookie to anyone holding a tracking link, exposing stored data. Update to 9.4.0.Thu, 01 Oct 2026 03:08:24 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/netscaler-cve-2026-88772-patch-then-hunt/https://suriq.io/blog/netscaler-cve-2026-88772-patch-then-hunt/CVE-2026-88771 and CVE-2026-88772 hit Citrix NetScaler as zero-days, exploited before a patch. Patching does not remove the web shell attackers left.Wed, 30 Sep 2026 08:49:18 GMTSecurity newsNoam Alumhttps://suriq.io/blog/signal-triage-signal-from-noise/https://suriq.io/blog/signal-triage-signal-from-noise/We triaged 4,609 vulnerabilities in a week and acted on 8. Why reachability and in-the-wild exploitation, not CVSS, decide what a self-hosted team should patch.Tue, 29 Sep 2026 09:28:39 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/apache-roller-cve-2026-82384-xmlrpc-rce/https://suriq.io/blog/apache-roller-cve-2026-82384-xmlrpc-rce/Apache Roller 6.1.5 has a critical pre-auth RCE flaw (CVE-2026-82384, CVSS 9.8) in its XML-RPC endpoint. Disabling the feature won't help; upgrade to 6.1.6.Mon, 28 Sep 2026 08:24:30 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/wordpress-core-cve-2026-87902/https://suriq.io/blog/wordpress-core-cve-2026-87902/CVE-2026-87902 is an unauthenticated WordPress core file-inclusion flaw that can run code, exploited in the wild and affecting every release since 4.7.0.Sun, 27 Sep 2026 15:13:25 GMTSecurity newsNoam Alumhttps://suriq.io/blog/request-a-quote-woocommerce-cve-2026-18143/https://suriq.io/blog/request-a-quote-woocommerce-cve-2026-18143/CVE-2026-18143 is a critical unauthenticated file-upload flaw in Request a Quote for WooCommerce (through 2.9.2), with no patch yet. Act now.Sat, 26 Sep 2026 07:12:59 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/containerd-cve-2026-53493-image-pull-dos/https://suriq.io/blog/containerd-cve-2026-53493-image-pull-dos/containerd CVE-2026-53493 lets a crafted OCI image burn CPU and memory during image pull, before any container starts. Moderate, not yet exploited. Update.Fri, 25 Sep 2026 01:12:20 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/check-point-cve-2026-93616-85102-rce-exploited/https://suriq.io/blog/check-point-cve-2026-93616-85102-rce-exploited/Check Point CVE-2026-93616 and CVE-2026-85102 are two 9.8 pre-auth flaws exploited in the wild and on CISA's KEV list. Patch, then hunt for compromise.Thu, 24 Sep 2026 15:19:29 GMTSecurity newsNoam Alumhttps://suriq.io/blog/f5-big-ip-apm-cve-2026-94127-oauth-rce/https://suriq.io/blog/f5-big-ip-apm-cve-2026-94127-oauth-rce/CVE-2026-94127 is an unauthenticated RCE in F5 BIG-IP APM configured as an OAuth authorization server, exploited now. Who is exposed and how to patch.Wed, 23 Sep 2026 16:13:41 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/signal-gatekeeper-was-the-target/https://suriq.io/blog/signal-gatekeeper-was-the-target/This week's exploited flaws were in the access-control layer itself: Cisco ISE (two CVSS 10.0, in CISA KEV) and Kong Gateway's SAML bypass.Tue, 22 Sep 2026 09:19:02 GMTSecurity newsNoam Alumhttps://suriq.io/blog/husky-woocommerce-file-inclusion-cve-2026-92969/https://suriq.io/blog/husky-woocommerce-file-inclusion-cve-2026-92969/CVE-2026-92969 is an unauthenticated file inclusion flaw in HUSKY Products Filter for WooCommerce (up to 1.4.4), fixed in 1.4.5. Update now and hunt your logs.Tue, 22 Sep 2026 08:10:53 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/brevo-cdn-edge-supply-chain-attack/https://suriq.io/blog/brevo-cdn-edge-supply-chain-attack/Attackers abused Brevo (formerly Sendinblue) to inject malware into up to 100,000 sites at the CDN edge, so origin files never changed and checks missed it.Sun, 20 Sep 2026 17:08:17 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cisco-ise-cve-2026-76460-exploited-auth-bypass/https://suriq.io/blog/cisco-ise-cve-2026-76460-exploited-auth-bypass/CVE-2026-76460 is an unauthenticated API auth bypass in Cisco ISE, CVSS 10.0, actively exploited and in CISA KEV. Patch ISE 3.1-3.5 to the fixed build now.Sat, 19 Sep 2026 15:33:06 GMTSecurity newsNoam Alumhttps://suriq.io/blog/wordpress-core-stored-xss-cve-2026-93485/https://suriq.io/blog/wordpress-core-stored-xss-cve-2026-93485/WordPress 7.1.1 fixes CVE-2026-93485, a stored cross-site scripting flaw in core that an unauthenticated comment can carry. Who is exposed and how to patch.Fri, 18 Sep 2026 06:29:10 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/cisco-ise-cve-2026-20192-exploited-access-control/https://suriq.io/blog/cisco-ise-cve-2026-20192-exploited-access-control/Cisco's September 2026 ISE hardening release fixes six flaws, two rated CVSS 10.0. One access-control bug (CVE-2026-20192) is being exploited.Thu, 17 Sep 2026 04:27:23 GMTSecurity newsNoam Alumhttps://suriq.io/blog/kong-gateway-saml-auth-bypass-cve-2026-14917/https://suriq.io/blog/kong-gateway-saml-auth-bypass-cve-2026-14917/Kong Gateway's SAML plugin (CVE-2026-14917) can accept unsigned responses and impersonate admins when signature validation is off. Audit the flag, then patch.Wed, 16 Sep 2026 10:24:46 GMTSecurity newsNoam Alumhttps://suriq.io/blog/litespeed-enterprise-6-3-7-root-escalation/https://suriq.io/blog/litespeed-enterprise-6-3-7-root-escalation/LiteSpeed Enterprise before 6.3.7 lets a low-privilege hosting account reach root and bypass CageFS, per the vendor advisory. No CVE yet. Update every node now.Tue, 15 Sep 2026 08:01:38 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/biostar2-cve-2026-31278-ad-credential-cleartext/https://suriq.io/blog/biostar2-cve-2026-31278-ad-credential-cleartext/Suprema BioStar 2 exposes its Active Directory bind password in cleartext via an API endpoint (CVE-2026-31278). Patch to 2.9.12 and rotate the account.Mon, 14 Sep 2026 01:53:29 GMTSecurity newsNoam Alumhttps://suriq.io/blog/jfrog-artifactory-cve-2026-42016-auth-chain-to-admin/https://suriq.io/blog/jfrog-artifactory-cve-2026-42016-auth-chain-to-admin/CISA added JFrog Artifactory CVE-2026-42016 and CVE-2026-42018 to KEV. Chained, they turn an unauthenticated request into admin.Sun, 13 Sep 2026 16:19:50 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gitlab-cve-2026-85706-unauth-file-read/https://suriq.io/blog/gitlab-cve-2026-85706-unauth-file-read/GitLab's critical patch fixes CVE-2026-85706, an unauthenticated CVSS 10 file-read flaw now being scanned for, plus a CVSS 9.9 credential leak.Sat, 12 Sep 2026 03:09:36 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/omada-controller-cve-2026-84941-saml-xxe/https://suriq.io/blog/omada-controller-cve-2026-84941-saml-xxe/TP-Link patched CVE-2026-84941, an XXE in Omada Controller's SAML SSO that lets an admin read files off the host. Update to 6.2.14.11 or the 20260711 build.Fri, 11 Sep 2026 00:12:19 GMTSecurity newsNoam Alumhttps://suriq.io/blog/keycloak-cve-2026-88770-device-grant-lockout-bypass/https://suriq.io/blog/keycloak-cve-2026-88770-device-grant-lockout-bypass/CVE-2026-88770 lets a held Keycloak session mint fresh tokens through the device grant flow while the account is brute-force-locked.Thu, 10 Sep 2026 07:39:26 GMTSecurity newsNoam Alumhttps://suriq.io/blog/magento-stylesmuggler-cve-2026-75650-patch-and-hunt/https://suriq.io/blog/magento-stylesmuggler-cve-2026-75650-patch-and-hunt/CVE-2026-75650 (StyleSmuggler) is a CVSS 10 unauthenticated RCE in Adobe Commerce and Magento, exploited before the fix shipped. Patch, then hunt the backdoor.Wed, 09 Sep 2026 17:05:38 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/signal-most-exploited-flaws-already-patched/https://suriq.io/blog/signal-most-exploited-flaws-already-patched/Most of this week's actively exploited flaws were n-days, not zero-days: already-patched bugs like Switchvox and Exchange, weaponized weeks after the fixTue, 08 Sep 2026 09:22:40 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/sap-cve-2026-44756-epp-memory-corruption/https://suriq.io/blog/sap-cve-2026-44756-epp-memory-corruption/SAP CVE-2026-44756 is a CVSS 10.0 unauthenticated memory corruption flaw in Extended Passport (EPP) processing that can crash the SAP kernel or Web Dispatcher.Tue, 08 Sep 2026 00:57:52 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/nable-ncentral-cve-2026-86218-unauth-rce/https://suriq.io/blog/nable-ncentral-cve-2026-86218-unauth-rce/N-able shipped its fourth N-central hotfix in five weeks: CVE-2026-86218, a CVSS 10 unauthenticated RCE on the on-prem console. Patch to 2026.3.1.14 and hunt.Mon, 07 Sep 2026 15:49:04 GMTSecurity newsNoam Alumhttps://suriq.io/blog/chrome-v8-cve-2026-85046-exploited/https://suriq.io/blog/chrome-v8-cve-2026-85046-exploited/CVE-2026-85046 is an actively exploited V8 type confusion zero-day in Chrome. Update to 152.0.7977.82, and patch Edge, Brave, Opera and Electron apps too.Sun, 06 Sep 2026 16:23:21 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/litellm-cve-2026-59822-mcp-auth-bypass/https://suriq.io/blog/litellm-cve-2026-59822-mcp-auth-bypass/CVE-2026-59822 is an actively exploited MCP auth bypass in the LiteLLM gateway. Patch to 1.84.0 and rotate every stored provider and virtual key now.Sun, 06 Sep 2026 08:24:04 GMTSecurity newsNoam Alumhttps://suriq.io/blog/whmcs-cve-2026-67399-stopgap-hook/https://suriq.io/blog/whmcs-cve-2026-67399-stopgap-hook/A defense-in-depth WHMCS hook that blocks the payload classes CVE-2026-67399 most likely needs, for installs that cannot reach 8.13.7 or 9.0.8 yet. Not a fix.Fri, 04 Sep 2026 13:41:00 GMTExplainersSuriq's Jackhttps://suriq.io/blog/whmcs-unauthenticated-rce-cve-2026-67399-patch/https://suriq.io/blog/whmcs-unauthenticated-rce-cve-2026-67399-patch/WHMCS shipped 9.0.8 and 8.13.7 to fix an unauthenticated remote code-execution flaw (CVE-2026-67399) plus a customer-data leak (CVE-2026-67398).Thu, 03 Sep 2026 18:10:08 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/jfrog-artifactory-cve-2026-82329-admin-token-forge/https://suriq.io/blog/jfrog-artifactory-cve-2026-82329-admin-token-forge/Attackers are forging admin tokens via a JFrog Artifactory authentication bypass (CVE-2026-82329, CVSS 9.8). Patch the six fixed builds and rotate tokens now.Wed, 02 Sep 2026 18:47:40 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/submariner-gateway-root-rce-cve-2026-66786/https://suriq.io/blog/submariner-gateway-root-rce-cve-2026-66786/CVE-2026-66786 (CVSS 9.1): in cert-auth mode a malicious member cluster can inject IPsec config into Red Hat Submariner and run code as root on the gateway.Wed, 02 Sep 2026 18:25:52 GMTSecurity newsNoam Alumhttps://suriq.io/blog/switchvox-cve-2026-9586-unauth-rce-exploited/https://suriq.io/blog/switchvox-cve-2026-9586-unauth-rce-exploited/Attackers are exploiting CVE-2026-9586, an unauthenticated flaw in Sangoma Switchvox that leads to remote code execution. Patch to 8.4.0.2 and hunt now.Wed, 02 Sep 2026 12:25:53 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/sonicwall-sma1000-ssrf-command-injection-zero-days/https://suriq.io/blog/sonicwall-sma1000-ssrf-command-injection-zero-days/SonicWall SMA1000 zero-days CVE-2026-83548 and CVE-2026-83549 chain a pre-login SSRF into admin command injection for RCE. Exploited now. Patch and hunt.Wed, 02 Sep 2026 08:54:28 GMTSecurity newsNoam Alumhttps://suriq.io/blog/sality-botnet-takedown-machines-still-infected/https://suriq.io/blog/sality-botnet-takedown-machines-still-infected/Police and CrowdStrike disrupted the 23-year-old Sality botnet across 15,000+ machines. The takedown breaks its control, not the infections. What to do now.Wed, 02 Sep 2026 08:26:07 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/predis-crlf-command-injection-cve-2026-84372/https://suriq.io/blog/predis-crlf-command-injection-cve-2026-84372/CVE-2026-84372 is a CVSS 9.8 command-injection flaw in the Predis PHP client. It hits 3.0 to 3.2 on cluster and replication connections. Upgrade to 3.3.0.Tue, 01 Sep 2026 21:39:10 GMTSecurity newsNoam Alumhttps://suriq.io/blog/exchange-cve-2026-62911-auth-bypass-webshell-poc/https://suriq.io/blog/exchange-cve-2026-62911-auth-bypass-webshell-poc/CVE-2026-62911 lets attackers relay an Exchange server's own machine account into a SYSTEM webshell.Tue, 01 Sep 2026 18:57:39 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/virtualizor-bgp-hijack-malicious-update/https://suriq.io/blog/virtualizor-bgp-hijack-malicious-update/A 33-hour BGP hijack redirected Softaculous update traffic and pushed a malicious Virtualizor package that ran as root. Check a systemd service, patch 3.2.9.9.Tue, 01 Sep 2026 17:07:45 GMTSecurity newsNoam Alumhttps://suriq.io/blog/kaspersky-endpoint-security-hardbreacher-privilege-escalation/https://suriq.io/blog/kaspersky-endpoint-security-hardbreacher-privilege-escalation/A public exploit, HardBreacher, coerces Kaspersky Endpoint Security into a privileged write on fully patched Windows 11. Vendor says fixed, no CVE yet.Tue, 01 Sep 2026 12:16:31 GMTSecurity newsNoam Alumhttps://suriq.io/blog/wp-fastest-cache-cache-poisoning-cve-2026-74916/https://suriq.io/blog/wp-fastest-cache-cache-poisoning-cve-2026-74916/WP Fastest Cache flaw CVE-2026-74916 lets attackers poison cached WordPress pages and hit every visitor with malicious script. Update to 1.5.1 and purge cache.Tue, 01 Sep 2026 08:14:09 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/terminalfix-clickfix-windows-terminal-reverse-tunnel/https://suriq.io/blog/terminalfix-clickfix-windows-terminal-reverse-tunnel/Microsoft documented TerminalFix, a ClickFix variant that pastes PowerShell into Windows Terminal to plant a reverse-tunnel backdoor. Here is what to detect.Mon, 31 Aug 2026 19:00:53 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/manchester-airports-client-side-api-key-breach/https://suriq.io/blog/manchester-airports-client-side-api-key-breach/An extortion group says it pulled 86GB from Manchester Airports Group using a marketing API key exposed in client-side JavaScript.Mon, 31 Aug 2026 16:19:43 GMTSecurity newsNoam Alumhttps://suriq.io/blog/fire-ant-cisco-router-tacacs-credential-theft/https://suriq.io/blog/fire-ant-cisco-router-tacacs-credential-theft/China-linked Fire Ant compromised Cisco IOS XR routers and TACACS servers, stole live admin credentials, and rewrote logs to stay invisible. How to detect it.Mon, 31 Aug 2026 12:22:51 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/browser-extension-silent-update-wallet-drainer/https://suriq.io/blog/browser-extension-silent-update-wallet-drainer/Browser extensions in the Superior campaign shipped clean, then a silent update drained crypto wallets and stole logins. How to detect it and respond.Mon, 31 Aug 2026 08:53:46 GMTSecurity newsNoam Alumhttps://suriq.io/blog/dell-powerstore-unauth-credential-leak-cve-2026-58574/https://suriq.io/blog/dell-powerstore-unauth-credential-leak-cve-2026-58574/Dell PowerStore's management interface has a critical flaw (CVE-2026-58574, CVSS 9.8): an unauthenticated attacker can read files that expose admin credentials.Mon, 31 Aug 2026 08:10:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/ajcloud-ipc-camera-path-traversal-cve-2026-56718/https://suriq.io/blog/ajcloud-ipc-camera-path-traversal-cve-2026-56718/A path traversal bug in AJCloud AJY IPC camera firmware (CVE-2026-56718) lets unauthenticated attackers read Wi-Fi passwords and camera credentials as root.Sun, 30 Aug 2026 20:40:30 GMTSecurity newsNoam Alumhttps://suriq.io/blog/zbt-speakingstone-darklantern-router-backdoors/https://suriq.io/blog/zbt-speakingstone-darklantern-router-backdoors/VulnCheck found two more factory implants in ZBT router firmware, SPEAKINGSTONE and DARKLANTERN (CVE-2026-74232/74233), that grant remote root access.Sun, 30 Aug 2026 16:14:50 GMTSecurity newsNoam Alumhttps://suriq.io/blog/unitree-g1-robot-bluetooth-root-rce/https://suriq.io/blog/unitree-g1-robot-bluetooth-root-rce/Two Unitree G1 humanoid robot flaws (CVE-2026-76639, CVE-2026-76640) give an attacker root over Bluetooth or the network, and one hacked robot can reach theSun, 30 Aug 2026 11:25:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/wordpress-five-critical-plugin-theme-flaws-server-rce/https://suriq.io/blog/wordpress-five-critical-plugin-theme-flaws-server-rce/Wordfence and Patchstack disclosed five unauthenticated WordPress flaws rated 9.8 to 10.0. GiveWP and Avada run code on the host. Patch all five now.Sat, 29 Aug 2026 19:37:28 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/servicenow-ai-platform-three-cvss-10-unauth-flaws/https://suriq.io/blog/servicenow-ai-platform-three-cvss-10-unauth-flaws/ServiceNow patched three CVSS 10.0 AI Platform flaws an unauthenticated attacker can chain for code execution, SQL injection, and privilege escalation.Sat, 29 Aug 2026 15:43:59 GMTSecurity newsNoam Alumhttps://suriq.io/blog/nextjs-critical-flaws-self-hosted-rce/https://suriq.io/blog/nextjs-critical-flaws-self-hosted-rce/Next.js patched two critical flaws that let unauthenticated attackers run code on self-hosted servers. Vercel apps are covered. Update to 15.5.24 or 16.3.3 now.Sat, 29 Aug 2026 12:18:07 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/linux-kernel-cve-2026-53362-container-escape/https://suriq.io/blog/linux-kernel-cve-2026-53362-container-escape/CVE-2026-53362 is an actively exploited Linux kernel IPv6 flaw that lets a low-privilege user escape a container to host root.Sat, 29 Aug 2026 09:10:47 GMTSecurity newsNoam Alumhttps://suriq.io/blog/linux-kernel-cve-2022-0995-kev-exploited/https://suriq.io/blog/linux-kernel-cve-2022-0995-kev-exploited/CISA added Linux kernel flaw CVE-2022-0995 to its actively-exploited list. A local user can escalate to root.Sat, 29 Aug 2026 08:55:42 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/langflow-authenticated-rce-lockdown-bypass-cve-2026-19295/https://suriq.io/blog/langflow-authenticated-rce-lockdown-bypass-cve-2026-19295/A critical Langflow flaw (CVE-2026-19295, CVSS 9.9) lets any authenticated user run OS commands on the server and bypasses theSat, 29 Aug 2026 08:37:49 GMTSecurity newsNoam Alumhttps://suriq.io/blog/owncloud-cve-2023-49105-exploited-file-theft/https://suriq.io/blog/owncloud-cve-2023-49105-exploited-file-theft/CVE-2023-49105, an ownCloud auth bypass patched in 2023, is now in CISA's KEV list after a suspected Chinese operator stole nuclear-agency files.Fri, 28 Aug 2026 18:56:26 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/jfrog-artifactory-cache-path-traversal-cve-2026-66384/https://suriq.io/blog/jfrog-artifactory-cache-path-traversal-cve-2026-66384/CISA added a JFrog Artifactory path-traversal flaw (CVE-2026-66384) to its must-patch list. A logged-in user can write files outside the Docker cache path.Fri, 28 Aug 2026 16:26:09 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cpanel-cve-2026-65643-domain-parking-root-rce/https://suriq.io/blog/cpanel-cve-2026-65643-domain-parking-root-rce/cPanel and WHM flaw CVE-2026-65643 lets any authenticated hosting account write files as root and take full control of a shared server. Patched builds are out.Fri, 28 Aug 2026 16:05:10 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/cisa-red-team-soc-detection-gap-aa26-237a/https://suriq.io/blog/cisa-red-team-soc-detection-gap-aa26-237a/A CISA red team hit two critical infrastructure networks with the same tradecraft. One SOC contained it in minutes, the other never noticed. Here is the gap.Fri, 28 Aug 2026 11:42:18 GMTSecurity newsNoam Alumhttps://suriq.io/blog/papercut-ng-mf-unauthenticated-rce-zero-day/https://suriq.io/blog/papercut-ng-mf-unauthenticated-rce-zero-day/Attackers are exploiting an unauthenticated flaw in PaperCut NG and MF print servers to run code as the host account. Restrict access and patch now.Fri, 28 Aug 2026 11:09:45 GMTSecurity newsNoam Alumhttps://suriq.io/blog/litespeed-cache-comment-stored-xss-cve-2026-18978/https://suriq.io/blog/litespeed-cache-comment-stored-xss-cve-2026-18978/CVE-2026-18978 is a stored cross-site scripting flaw in the LiteSpeed Cache WordPress plugin.Fri, 28 Aug 2026 05:26:09 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/gitea-cve-2026-60004-kev-diffpatch-rce/https://suriq.io/blog/gitea-cve-2026-60004-kev-diffpatch-rce/CISA added Gitea's CVE-2026-60004 to its exploited list on Aug 25. A public exploit lets any user run code via the diffpatch API. Patch to 1.27.1 and hunt.Tue, 25 Aug 2026 18:50:07 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/weedhack-etherhiding-c2-fake-minecraft-stealer/https://suriq.io/blog/weedhack-etherhiding-c2-fake-minecraft-stealer/Weedhack, an infostealer spread through fake Minecraft sites, survived a C2 takedown by reading server addresses from the Ethereum blockchain. How to detect it.Tue, 25 Aug 2026 11:56:09 GMTSecurity newsNoam Alumhttps://suriq.io/blog/signal-ssrf-network-boundary/https://suriq.io/blog/signal-ssrf-network-boundary/Four unrelated products shipped SSRF flaws this week, from a Kubernetes proxy to MLflow. Why self-hosted SSRF reaches cloud metadata, and how to contain it.Tue, 25 Aug 2026 09:23:15 GMTDeep diveSuriq's Jackhttps://suriq.io/blog/iran-uk-power-plant-four-day-outage/https://suriq.io/blog/iran-uk-power-plant-four-day-outage/Iran-linked hackers reportedly kept a small UK power plant offline for four days, as water systems across 12 US states were hit. What defenders should do.Tue, 25 Aug 2026 08:45:08 GMTSecurity newsNoam Alumhttps://suriq.io/blog/oracle-weblogic-proxy-cve-2026-21962-kev-exploited/https://suriq.io/blog/oracle-weblogic-proxy-cve-2026-21962-kev-exploited/CVE-2026-21962 is a CVSS 10 access-control bypass in Oracle's WebLogic proxy plug-in, now in CISA KEV with a three-day deadline.Mon, 24 Aug 2026 19:11:04 GMTSecurity newsNoam Alumhttps://suriq.io/blog/reliaquest-shinyhunters-vishing-device-trust/https://suriq.io/blog/reliaquest-shinyhunters-vishing-device-trust/ShinyHunters vished a ReliaQuest employee and got the MFA push approved, but device-trust rules blocked the theft.Mon, 24 Aug 2026 18:53:06 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/leaked-aws-keys-live-full-admin/https://suriq.io/blog/leaked-aws-keys-live-full-admin/Truffle Security found 64,024 exposed AWS keys and 88% still authenticate; 768 give full account control. Why rotation fails and what to detect and fix.Mon, 24 Aug 2026 16:01:14 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/phpipam-api-auth-bypass-cve-2026-67602/https://suriq.io/blog/phpipam-api-auth-bypass-cve-2026-67602/CVE-2026-67602 is a critical unauthenticated flaw in phpIPAM before 1.8.2 that lets anyone read, change, or delete every IP record through the REST API.Mon, 24 Aug 2026 14:23:29 GMTSecurity newsNoam Alumhttps://suriq.io/blog/fast-uri-double-decode-ssrf-cve-2026-75899/https://suriq.io/blog/fast-uri-double-decode-ssrf-cve-2026-75899/CVE-2026-75899 lets a double-encoded hostname bypass fast-uri's URL checks and resolve to localhost or a cloud metadata endpoint. Fixed in 2.4.5, 3.1.6, 4.1.3.Mon, 24 Aug 2026 11:09:11 GMTSecurity newsNoam Alumhttps://suriq.io/blog/dji-drone-bluetooth-wifi-hijack-cve-2026-78306/https://suriq.io/blog/dji-drone-bluetooth-wifi-hijack-cve-2026-78306/CVE-2026-78306: an unauthenticated Bluetooth interface on 16 DJI drone models lets a nearby attacker rewrite the Wi-Fi key and disrupt flight. Models and fixes.Mon, 24 Aug 2026 08:42:03 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/android-car-head-unit-malware-proxy-botnet/https://suriq.io/blog/android-car-head-unit-malware-proxy-botnet/Kaspersky found the first malware built for Android car head units. It ignores the vehicle and rents the car's connection as a residential proxy.Sun, 23 Aug 2026 16:08:16 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gitlab-package-registry-arbitrary-file-write/https://suriq.io/blog/gitlab-package-registry-arbitrary-file-write/CVE-2026-10053 lets a logged-in GitLab user write files across a self-managed server via the package registry. Fixed in 19.2.2, 19.1.4, 19.0.6. Update now.Sun, 23 Aug 2026 15:54:18 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/grok-cryptographic-context-injection/https://suriq.io/blog/grok-cryptographic-context-injection/Adversa AI showed encrypted web-page instructions can make xAI's Grok leak your chat history and session data. Why plaintext filters miss it, and how to defend.Sun, 23 Aug 2026 11:20:05 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/netscaler-cve-2026-19490-auth-bypass-patch-now/https://suriq.io/blog/netscaler-cve-2026-19490-auth-bypass-patch-now/A critical NetScaler auth bypass (CVE-2026-19490, CVSS 9.3) lets a remote attacker skip login on Gateway and AAA servers.Sun, 23 Aug 2026 08:51:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/defender-btr-driver-security-tool-wipe/https://suriq.io/blog/defender-btr-driver-security-tool-wipe/Check Point turned Microsoft Defender's built-in BTR.sys driver into a kernel tool that deletes security software at boot.Sat, 22 Aug 2026 18:46:22 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/nasa-ait-gui-unauthenticated-command-execution/https://suriq.io/blog/nasa-ait-gui-unauthenticated-command-execution/AIT-GUI, NASA/JPL open-source operator console, binds to every interface with no login (CVSS 9.4). A browser can send commands, and the 2.5.2 fix adds no auth.Sat, 22 Aug 2026 16:14:03 GMTSecurity newsNoam Alumhttps://suriq.io/blog/isolated-vm-sandbox-escape-host-rce/https://suriq.io/blog/isolated-vm-sandbox-escape-host-rce/A critical type-confusion flaw in isolated-vm lets sandboxed JavaScript escape and run code on the host. Patch to 7.0.1 or 6.2.0, and watch the Node process.Sat, 22 Aug 2026 11:37:39 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/elementor-pro-file-upload-rce-cve-2026-32475/https://suriq.io/blog/elementor-pro-file-upload-rce-cve-2026-32475/Elementor Pro before 4.2.2 has a critical file upload flaw (CVE-2026-32475, CVSS 9.0) letting an unauthenticated attacker plant a PHP webshell. Patch now.Sat, 22 Aug 2026 09:18:58 GMTSecurity newsNoam Alumhttps://suriq.io/blog/mailgun-wordpress-account-takeover-cve-2026-78003/https://suriq.io/blog/mailgun-wordpress-account-takeover-cve-2026-78003/A critical Mailgun for WordPress plugin flaw (CVE-2026-78003) lets unauthenticated attackers reroute password-reset emails and seize admin accounts. Fix: 2.2.1.Sat, 22 Aug 2026 08:55:50 GMTSecurity newsNoam Alumhttps://suriq.io/blog/zimbra-snmp-rce-cve-2026-73570/https://suriq.io/blog/zimbra-snmp-rce-cve-2026-73570/CVE-2026-73570 is an unauthenticated command injection in Zimbra Collaboration Suite, now in CISA KEV and exploited in the wild.Fri, 21 Aug 2026 18:59:22 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/rust-crates-arrayref-build-time-malware/https://suriq.io/blog/rust-crates-arrayref-build-time-malware/Three popular Rust crates, including arrayref with 245M downloads, were briefly poisoned to run an infostealer during cargo build on August 20.Fri, 21 Aug 2026 16:39:50 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/spip-unauthenticated-rce-cve-2026-77806/https://suriq.io/blog/spip-unauthenticated-rce-cve-2026-77806/SPIP before 4.4.21 has a critical unauthenticated code-execution flaw (CVE-2026-77806, CVSS 9.8) exploited in the wild. The 4.4.20 patch fell short; update now.Fri, 21 Aug 2026 14:09:54 GMTSecurity newsNoam Alumhttps://suriq.io/blog/trueconf-server-flaws-cisa-kev-exploited/https://suriq.io/blog/trueconf-server-flaws-cisa-kev-exploited/CISA added two actively exploited TrueConf Server flaws (CVE-2026-72529, CVE-2026-72530) to its KEV catalog.Fri, 21 Aug 2026 11:24:20 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/misp-stix-path-traversal-cve-2026-77751/https://suriq.io/blog/misp-stix-path-traversal-cve-2026-77751/A path traversal flaw (CVE-2026-77751, CVSS 8.8) in MISP's misp-stix converter lets crafted STIX content read files outside the template folder. Patch it.Fri, 21 Aug 2026 10:10:45 GMTSecurity newsNoam Alumhttps://suriq.io/blog/keycloak-account-takeover-cve-2026-18963/https://suriq.io/blog/keycloak-account-takeover-cve-2026-18963/CVE-2026-18963 is a critical Keycloak flaw (CVSS 9.1) that lets an unauthenticated attacker reset any user's password and take over the account.Thu, 20 Aug 2026 11:25:26 GMTSecurity newsNoam Alumhttps://suriq.io/blog/dahua-cameraswarm-camera-takeover/https://suriq.io/blog/dahua-cameraswarm-camera-takeover/Operation CameraSwarm took over 14,530+ Dahua IP cameras in 35 days using 2021 auth-bypass flaws and a cloud relay that reached devices behind NAT.Thu, 20 Aug 2026 09:10:37 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/mlflow-ssrf-cve-2026-64849-cloud-metadata/https://suriq.io/blog/mlflow-ssrf-cve-2026-64849-cloud-metadata/CVE-2026-64849 is an unauthenticated, full-read SSRF in MLflow's webhook delivery. It reaches cloud metadata and leaks instance credentials. Fixed in 3.15.0.Wed, 19 Aug 2026 19:36:19 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/redhat-multicluster-engine-ssrf-cve-2026-66794/https://suriq.io/blog/redhat-multicluster-engine-ssrf-cve-2026-66794/CVE-2026-66794 (CVSS 9.3): an unauthenticated attacker can reach internal services on any Red Hat managed cluster through the cluster-proxy route. No patch yet.Wed, 19 Aug 2026 17:54:53 GMTSecurity newsNoam Alumhttps://suriq.io/blog/unisoc-modem-volte-video-call-kernel-access/https://suriq.io/blog/unisoc-modem-volte-video-call-kernel-access/A two-stage exploit turns a VoLTE video call into full Android kernel access on phones with Unisoc modems. No patch exists; only the chipset maker can fix it.Wed, 19 Aug 2026 12:02:03 GMTSecurity newsExplainersSuriq's Jackhttps://suriq.io/blog/stopandprotect-hacked-wordpress-ransomware/https://suriq.io/blog/stopandprotect-hacked-wordpress-ransomware/Check Point unmasked StopAndProtect, a ransomware operation running on about 2,000 hacked WordPress sites.Wed, 19 Aug 2026 11:24:07 GMTSecurity newsNoam Alumhttps://suriq.io/blog/medusa-ransomware-500-critical-infrastructure-cisa/https://suriq.io/blog/medusa-ransomware-500-critical-infrastructure-cisa/CISA and the FBI updated their Medusa ransomware advisory: 500+ critical infrastructure victims, and affiliates now weaponize new bugs within 24 hours.Wed, 19 Aug 2026 08:58:18 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/twinloot-microsoft-cloud-c2-credential-theft/https://suriq.io/blog/twinloot-microsoft-cloud-c2-credential-theft/TWINLOOT hides its command channel in SharePoint, Teams, and Edge and steals passwords with a fake Windows lock screen. No CVE. Here is how to detect it.Tue, 18 Aug 2026 18:23:06 GMTSecurity newsNoam Alumhttps://suriq.io/blog/windows-task-host-cve-2025-60710-ransomware/https://suriq.io/blog/windows-task-host-cve-2025-60710-ransomware/CISA confirms ransomware crews are exploiting CVE-2025-60710, a Windows Task Host flaw that elevates a local user to SYSTEM on Windows 11 and Server 2025.Tue, 18 Aug 2026 15:42:25 GMTSecurity newsNoam Alumhttps://suriq.io/blog/rhacm-managedclusteraddon-image-override-cve-2026-66793/https://suriq.io/blog/rhacm-managedclusteraddon-image-override-cve-2026-66793/CVE-2026-66793 (CVSS 8.8): a low-privilege user in Red Hat Advanced Cluster Management can swap in a rogue container and gain full admin on managed KubernetesTue, 18 Aug 2026 15:24:17 GMTSecurity newsNoam Alumhttps://suriq.io/blog/forminator-wordpress-rce-cve-2026-15748/https://suriq.io/blog/forminator-wordpress-rce-cve-2026-15748/CVE-2026-15748 is a CVSS 9.8 unauthenticated file-upload RCE in the Forminator WordPress plugin. Affects versions up to 1.56.1. Update to 1.56.2 now.Tue, 18 Aug 2026 12:20:57 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/signal-command-execution-self-hosted/https://suriq.io/blog/signal-command-execution-self-hosted/Command injection and RCE led our threat desk's triage this week at 370, more than any other class.Tue, 18 Aug 2026 09:25:00 GMTDeep diveSuriq's Jackhttps://suriq.io/blog/gitlab-graphql-unauth-delete-cve-2026-19478/https://suriq.io/blog/gitlab-graphql-unauth-delete-cve-2026-19478/GitLab CVE-2026-19478 (CVSS 9.4) lets an unauthenticated attacker delete public projects on self-managed servers. Patch now to 19.2.4, 19.1.6 or 18.11.11.Tue, 18 Aug 2026 09:02:32 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/phpipam-temp-share-broken-authorization-cve-2026-75105/https://suriq.io/blog/phpipam-temp-share-broken-authorization-cve-2026-75105/CVE-2026-75105 lets anyone holding one phpIPAM temporary share link read every IP record across all subnets, including notes that often hold credentials.Mon, 17 Aug 2026 20:51:39 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ai-agents-turf-war-self-replicating-malware/https://suriq.io/blog/ai-agents-turf-war-self-replicating-malware/Anthropic's red team ran three Claude agents on one codebase, unaware of each other. They built self-replicating malware to win. What defenders should do.Mon, 17 Aug 2026 18:22:22 GMTSecurity newsThought leadershipSuriq's Jackhttps://suriq.io/blog/ray-dashboard-dns-rebinding-rce-kev/https://suriq.io/blog/ray-dashboard-dns-rebinding-rce-kev/CISA flagged CVE-2025-62593 in Ray as actively exploited. A malicious web page can reach a developer's local Ray dashboard and run code. Patch to Ray 2.52.0.Mon, 17 Aug 2026 15:18:51 GMTSecurity newsNoam Alumhttps://suriq.io/blog/roundcube-markasjunk-command-injection-cve-2026-74997/https://suriq.io/blog/roundcube-markasjunk-command-injection-cve-2026-74997/CVE-2026-74997 lets a logged-in Roundcube user run OS commands on the mail server when the markasjunk cmd_learn spam plugin is enabled. Fixed in 1.6.18 and 1.7.Mon, 17 Aug 2026 13:07:48 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/mustang-panda-coolclient-kernel-rootkit/https://suriq.io/blog/mustang-panda-coolclient-kernel-rootkit/Mustang Panda's CoolClient backdoor now uses a signed kernel rootkit to hide from host tools. Why it is a hide not a kill, and where to still detect it.Sun, 16 Aug 2026 19:31:24 GMTSecurity newsNoam Alumhttps://suriq.io/blog/phoca-cart-unauth-sql-injection-cve-2026-74251/https://suriq.io/blog/phoca-cart-unauth-sql-injection-cve-2026-74251/CVE-2026-74251 is an unauthenticated SQL injection in the Phoca Cart extension for Joomla, affecting 5.0.0 through 6.1.6.Sun, 16 Aug 2026 14:23:55 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/apache-struts-json-plugin-dos-cve-2026-73633/https://suriq.io/blog/apache-struts-json-plugin-dos-cve-2026-73633/CVE-2026-73633 (S2-072) lets one oversized JSON request exhaust memory in Apache Struts and crash the app. A public PoC is out. Patch to 7.3.0 or 6.11.0.Sun, 16 Aug 2026 11:41:21 GMTSecurity newsNoam Alumhttps://suriq.io/blog/bookly-unauthenticated-stored-xss-cve-2026-13424/https://suriq.io/blog/bookly-unauthenticated-stored-xss-cve-2026-13424/CVE-2026-13424 is an unauthenticated stored cross-site scripting flaw in the Bookly WordPress booking plugin.Sun, 16 Aug 2026 08:38:46 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/evooo1bot-linux-botnet-servers-socks-relay/https://suriq.io/blog/evooo1bot-linux-botnet-servers-socks-relay/Evooo1Bot is a new Linux botnet exploiting Confluence, WSO2 and ingress-nginx, then stealing credentials and turning servers into proxies. Detect it now.Sat, 15 Aug 2026 18:37:19 GMTSecurity newsNoam Alumhttps://suriq.io/blog/geoserver-zero-day-sql-injection-rce-no-patch/https://suriq.io/blog/geoserver-zero-day-sql-injection-rce-no-patch/A GeoServer zero-day lets unauthenticated attackers run SQL injection that can reach remote code execution. No CVE, no patch, and probing has already started.Sat, 15 Aug 2026 16:21:15 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/magento-adobe-commerce-account-takeover-cve-2026-71362/https://suriq.io/blog/magento-adobe-commerce-account-takeover-cve-2026-71362/CVE-2026-71362 is a critical, unauthenticated account takeover in Adobe Commerce and Magento (CVSS 9.1).Sat, 15 Aug 2026 15:10:21 GMTSecurity newsNoam Alumhttps://suriq.io/blog/macos-screen-sharing-cve-2026-65400/https://suriq.io/blog/macos-screen-sharing-cve-2026-65400/A macOS Screen Sharing auth bypass (CVE-2026-65400) lets network attackers get root with no password. Patched Aug 6, now exploited to mine Monero. What to do.Sat, 15 Aug 2026 11:15:46 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/amnesiastealer-macos-live-browser-hijack/https://suriq.io/blog/amnesiastealer-macos-live-browser-hijack/AmnesiaStealer is a Rust macOS infostealer spread via fake GitHub ClickFix pages. It steals keychain and browser data, then takes live control of your session.Sat, 15 Aug 2026 08:32:52 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ai-reasoning-traces-leak-api-keys-pii/https://suriq.io/blog/ai-reasoning-traces-leak-api-keys-pii/Researchers decoded 315,320 public AI reasoning blocks from OpenAI, Anthropic, and Google, recovering 182 credentials and 367 PII artifacts. What to do now.Fri, 14 Aug 2026 18:45:53 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/akira-safe-mode-edr-bypass/https://suriq.io/blog/akira-safe-mode-edr-bypass/An Akira ransomware affiliate rebooted a Windows host into Safe Mode to disable EDR, stole the data, then fumbled the encryption.Fri, 14 Aug 2026 16:15:11 GMTSecurity newsNoam Alumhttps://suriq.io/blog/eclipse-theia-repo-open-command-execution-cve-2026-19884/https://suriq.io/blog/eclipse-theia-repo-open-command-execution-cve-2026-19884/Opening a malicious repository in an editor built on Eclipse Theia could run attacker commands via a crafted git config.Fri, 14 Aug 2026 15:59:30 GMTSecurity newsNoam Alumhttps://suriq.io/blog/trivy-litellm-supply-chain-2500-orgs/https://suriq.io/blog/trivy-litellm-supply-chain-2500-orgs/CloudSEK maps 2,500+ organizations exposed by the TeamPCP (UNC6780) supply-chain campaign.Fri, 14 Aug 2026 12:15:21 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gunra-ransomware-mfa-auth-backdoor/https://suriq.io/blog/gunra-ransomware-mfa-auth-backdoor/Gunra ransomware beats MFA by rewriting the login server so one chosen code always passes, after entering through Fortinet flaws.Fri, 14 Aug 2026 09:13:02 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/cisco-asa-ftd-cve-2026-20349-dos-exploited/https://suriq.io/blog/cisco-asa-ftd-cve-2026-20349-dos-exploited/CVE-2026-20349 lets an unauthenticated attacker reload Cisco ASA and FTD firewalls for a denial of service. Exploited now, no workaround. Patch by Aug 14.Wed, 12 Aug 2026 11:52:39 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/fabrik-joomla-unauth-rce-cve-2026-67282/https://suriq.io/blog/fabrik-joomla-unauth-rce-cve-2026-67282/CVE-2026-67282 is a CVSS 10 unauthenticated code-execution flaw in Fabrik for Joomla, fixed in 4.6.8. Patch now and check your webroot for webshells.Wed, 12 Aug 2026 09:28:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/lazarus-operation-dream-job-windows-zero-day/https://suriq.io/blog/lazarus-operation-dream-job-windows-zero-day/North Korea's Lazarus group used fake job offers and a Windows zero-day (CVE-2026-68820) to seize SYSTEM control of defense and aerospace PCs. Patch now.Tue, 11 Aug 2026 18:12:20 GMTSecurity newsNoam Alumhttps://suriq.io/blog/mozilla-firefox-thunderbird-signing-key-revoked/https://suriq.io/blog/mozilla-firefox-thunderbird-signing-key-revoked/Mozilla revoked the GPG key signing Firefox and Thunderbird Linux builds after it was committed unencrypted to a private repo. What breaks, and what to do now.Tue, 11 Aug 2026 16:04:41 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/ivanti-epm-august-2026-su7-management-plane-flaws/https://suriq.io/blog/ivanti-epm-august-2026-su7-management-plane-flaws/Ivanti's August 2026 Endpoint Manager advisory fixes three high-severity flaws (CVE-2026-18129, -18127, -18125), all resolved in 2024 SU7.Tue, 11 Aug 2026 14:55:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/bdthemes-wordpress-plugins-hidden-admin-webshell/https://suriq.io/blog/bdthemes-wordpress-plugins-hidden-admin-webshell/A supply-chain attack poisoned a data feed in BdThemes WordPress plugins to create hidden admin accounts and drop a webshell.Tue, 11 Aug 2026 12:35:23 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/commvault-commserve-command-restriction-bypass/https://suriq.io/blog/commvault-commserve-command-restriction-bypass/Commvault patched CVE-2026-13737, a critical CVSS 9.2 allowlist bypass in CommServe that lets attackers run commands the backup control server should block.Tue, 11 Aug 2026 11:40:41 GMTSecurity newsNoam Alumhttps://suriq.io/blog/undertow-jboss-websocket-preauth-dos/https://suriq.io/blog/undertow-jboss-websocket-preauth-dos/A pre-auth flaw in Undertow (CVE-2026-15565), the web server in Red Hat JBoss EAP and Data Grid, lets an attacker exhaust memory and crash the server.Tue, 11 Aug 2026 09:26:02 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/sap-netweaver-diag-unauth-memory-corruption/https://suriq.io/blog/sap-netweaver-diag-unauth-memory-corruption/SAP's August 2026 patch day fixes CVE-2026-34265, a critical (CVSS 9.8) flaw letting an unauthenticated attacker crash SAP NetWeaver AS ABAP or leak its memory.Tue, 11 Aug 2026 00:56:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/storm-1175-stormencryptor-rmm-ransomware/https://suriq.io/blog/storm-1175-stormencryptor-rmm-ransomware/Microsoft ties China-linked Storm-1175 to StormEncryptor ransomware deployed through the N-able N-central auth bypass (CVE-2026-18577). Patch, then hunt.Mon, 10 Aug 2026 18:34:58 GMTSecurity newsNoam Alumhttps://suriq.io/blog/openai-astra-autonomous-cyber-capability-paused-2026-08-10/https://suriq.io/blog/openai-astra-autonomous-cyber-capability-paused-2026-08-10/OpenAI paused Astra after tests could not rule out autonomous exploit capability. For defenders the near-term risk is automated n-day exploitation.Mon, 10 Aug 2026 15:55:44 GMTSecurity newsThought leadershipSuriq's Jackhttps://suriq.io/blog/ceva-logistics-breach-customer-data-exposed/https://suriq.io/blog/ceva-logistics-breach-customer-data-exposed/A cyberattack on shipping partner Ceva Logistics exposed customer names, addresses and order details for Steam, ING, bol and more.Mon, 10 Aug 2026 15:09:50 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/malicious-npm-packages-dns-c2-stealer/https://suriq.io/blog/malicious-npm-packages-dns-c2-stealer/Flooding Dropper seeded close to 800 malicious npm packages that run on require() and fall back to DNS TXT records for C2. How to detect it and clean up.Mon, 10 Aug 2026 12:31:48 GMTSecurity newsNoam Alumhttps://suriq.io/blog/sctphantom-cve-2026-64564-container-escape/https://suriq.io/blog/sctphantom-cve-2026-64564-container-escape/SCTPhantom (CVE-2026-64564) is a use-after-free in Linux SCTP that reaches host root and escaped default-seccomp containers in 6 of 8 tests.Mon, 10 Aug 2026 08:59:41 GMTSecurity newsNoam Alumhttps://suriq.io/blog/helpdesk-vishing-unc6671-saas-data-theft/https://suriq.io/blog/helpdesk-vishing-unc6671-saas-data-theft/A vishing crew posing as IT help desk on personal phones steals Microsoft 365 and Okta sessions, then renames to dodge IOC lists. Here is how to detect it.Sun, 09 Aug 2026 18:39:35 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/wordpress-preauth-login-xss-cve-2026-64638/https://suriq.io/blog/wordpress-preauth-login-xss-cve-2026-64638/WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth login-page XSS that runs attacker code from one failed login and can chain to server code execution. Patch now.Sun, 09 Aug 2026 15:35:17 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/windows-hello-entra-id-key-abuse/https://suriq.io/blog/windows-hello-entra-id-key-abuse/Malware in a signed-in Windows session can use the Windows Hello key to log into Microsoft Entra ID and hold a 90-day token. How to detect and mitigate it.Sun, 09 Aug 2026 12:11:03 GMTSecurity newsNoam Alumhttps://suriq.io/blog/natjack-shared-nat-session-hijack/https://suriq.io/blog/natjack-shared-nat-session-hijack/NatJack lets an attacker behind the same NAT hijack live TCP sessions, spoof DNS, and exhaust connection tables. Two CVEs: patch Windows and Linux now.Sun, 09 Aug 2026 08:41:55 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/trueconf-server-trojanized-installers-backdoor/https://suriq.io/blog/trueconf-server-trojanized-installers-backdoor/Head Mare exploited unpatched TrueConf servers (before 5.3.9, 5.4.9, 5.5.5) to swap client installers for unsigned backdoors.Sat, 08 Aug 2026 18:41:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/atlassian-rovo-ai-prompt-injection-data-leak/https://suriq.io/blog/atlassian-rovo-ai-prompt-injection-data-leak/Two firms found Atlassian Rovo could be tricked into leaking Jira, Confluence and SharePoint data. One attack route is patched; the other is unconfirmed.Sat, 08 Aug 2026 16:16:30 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/metabase-sql-injection-zero-day-admin-access/https://suriq.io/blog/metabase-sql-injection-zero-day-admin-access/Metabase's SQL injection zero-day (CVSS 10.0) gives unauthenticated attackers admin access and stored database credentials. Exploited now: patch and rotate.Sat, 08 Aug 2026 12:49:48 GMTSecurity newsNoam Alumhttps://suriq.io/blog/tontou-spectre-v2-bypass-interrupt-injection/https://suriq.io/blog/tontou-spectre-v2-bypass-interrupt-injection/TONTOU, a new MIT attack, re-poisons the branch predictor after Spectre v2 defenses run to leak kernel memory. It needs local code. AMD patched, Intel did not.Fri, 07 Aug 2026 19:25:25 GMTSecurity newsNoam Alumhttps://suriq.io/blog/zbtlink-endlessdoors-router-root-backdoor/https://suriq.io/blog/zbtlink-endlessdoors-router-root-backdoor/VulnCheck found a factory-shipped remote-access implant in 20 Zbtlink router models that calls home and hands a remote root shell. There is no patched firmware.Fri, 07 Aug 2026 15:43:50 GMTSecurity newsNoam Alumhttps://suriq.io/blog/snowflake-hacker-guilty-plea-stolen-credentials/https://suriq.io/blog/snowflake-hacker-guilty-plea-stolen-credentials/The Snowflake hacker pleaded guilty to breaching 165 companies and exposing 100M people.Fri, 07 Aug 2026 12:07:26 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/dracut-cve-2026-15816-dhcp-root-execution/https://suriq.io/blog/dracut-cve-2026-15816-dhcp-root-execution/CVE-2026-15816 is a second dracut flaw: a rogue DHCP server can run code as root during boot on network-booted Linux. June's CVE-2026-6893 fix missed it.Fri, 07 Aug 2026 11:11:21 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/commonmark-attributes-xss-cve-2026-71478/https://suriq.io/blog/commonmark-attributes-xss-cve-2026-71478/CVE-2026-71478 lets attacker-planted Markdown run scripts through league/commonmark's Attributes extension, bypassing allow_unsafe_links. Update to 2.9.0.Fri, 07 Aug 2026 08:26:14 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/smokescreen-screenconnect-rmm-defender-evasion/https://suriq.io/blog/smokescreen-screenconnect-rmm-defender-evasion/The SMOKE#SCREEN campaign disables Windows Defender, then installs a legitimately signed ScreenConnect agent your allowlist trusts.Wed, 05 Aug 2026 20:01:35 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ovswrap-open-vswitch-kernel-local-root/https://suriq.io/blog/ovswrap-open-vswitch-kernel-local-root/OVSwrap (CVE-2026-64531, CVSS 7.8) lets an ordinary local user reach root through the Linux Open vSwitch datapath on most default distros.Wed, 05 Aug 2026 15:13:19 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/keycloak-saml-signature-bypass-cve-2026-16443/https://suriq.io/blog/keycloak-saml-signature-bypass-cve-2026-16443/CVE-2026-16443 is a Keycloak flaw where importing SAML identity-provider metadata can leave signature checks off, letting an attacker forge a login.Wed, 05 Aug 2026 14:11:12 GMTSecurity newsNoam Alumhttps://suriq.io/blog/doublecup-clickfix-browser-cache-loader/https://suriq.io/blog/doublecup-clickfix-browser-cache-loader/DOUBLECUP, a Russian loader service, stages malware in the browser cache via ClickFix, then rebuilds it with trusted tools to drop a RAT on Windows and macOS.Wed, 05 Aug 2026 11:18:36 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/rancher-cve-2026-55997-plaintext-cluster-tokens/https://suriq.io/blog/rancher-cve-2026-55997-plaintext-cluster-tokens/SUSE Rancher stored long-lived Kubernetes registration tokens in plaintext (CVE-2026-55997, CVSS 8.8). Upgrade to 2.14.4 or 2.13.8, then rotate every token.Wed, 05 Aug 2026 08:38:51 GMTSecurity newsNoam Alumhttps://suriq.io/blog/langflow-cve-2026-9198-auto-login-rce/https://suriq.io/blog/langflow-cve-2026-9198-auto-login-rce/CVE-2026-9198 lets an unauthenticated attacker mint a Langflow superuser token via auto-login, then run code as admin. KEV-listed, patch past 1.10.0 now.Tue, 04 Aug 2026 19:15:48 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/chaindrop-keyv-npm-worm-credential-theft/https://suriq.io/blog/chaindrop-keyv-npm-worm-credential-theft/A self-propagating npm worm that began in keyv 6.0.0 poisoned hundreds of packages on August 4, steals GitHub, npm, cloud, Vault and Kubernetes credentialsTue, 04 Aug 2026 15:46:14 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ai-scanner-14090-open-source-bugs/https://suriq.io/blog/ai-scanner-14090-open-source-bugs/Palo Alto's Unit 42 says its NOVA system found 14,090 unreported bugs across 3,915 open-source projects. The count is not the story.Tue, 04 Aug 2026 13:24:39 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cpanel-cve-2026-58048-database-root-escalation/https://suriq.io/blog/cpanel-cve-2026-58048-database-root-escalation/cPanel CVE-2026-58048 (CVSS 9.4) lets an authenticated hosting customer run SQL as database root, risking full server compromise. Patch to the fixed build now.Tue, 04 Aug 2026 11:50:48 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/device-code-phishing-microsoft-365-token-theft/https://suriq.io/blog/device-code-phishing-microsoft-365-token-theft/Device-code phishing rose 1,500% in 2026, letting attackers mint Microsoft 365 tokens with no password or MFA. Here is how to detect and block the OAuth flow.Tue, 04 Aug 2026 08:52:38 GMTSecurity newsNoam Alumhttps://suriq.io/blog/coldcard-weak-rng-seed-bitcoin-theft/https://suriq.io/blog/coldcard-weak-rng-seed-bitcoin-theft/A Coldcard firmware error generated low-entropy Bitcoin seeds since 2021, and attackers swept about $88M by regenerating keys offline.Mon, 03 Aug 2026 18:29:41 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/thermo-fisher-dna-file-tampering-cve-2026-17583/https://suriq.io/blog/thermo-fisher-dna-file-tampering-cve-2026-17583/Thermo Fisher patched CVE-2026-17583, a flaw that let .fsa and .hid forensic DNA files be modified before its analysis software loaded them, with no warningMon, 03 Aug 2026 15:23:59 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/nable-ncentral-auth-bypass-incomplete-patch/https://suriq.io/blog/nable-ncentral-auth-bypass-incomplete-patch/N-able N-central RMM has an actively exploited authentication bypass (CVE-2026-18577). The first patch failed; upgrade to 2026.3.1.7 and hunt your endpoints.Mon, 03 Aug 2026 12:14:09 GMTSecurity newsNoam Alumhttps://suriq.io/blog/chrome-passkey-malware-account-takeover/https://suriq.io/blog/chrome-passkey-malware-account-takeover/Google Chrome passkeys can be hijacked by malware: Unit 42 showed the device key can be copied and replayed when a site skips the user-verified check.Mon, 03 Aug 2026 11:40:25 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/sharp-toshiba-mfp-auth-off-default-cve-2026-63563/https://suriq.io/blog/sharp-toshiba-mfp-auth-off-default-cve-2026-63563/Sharp and Toshiba Tec copiers sold outside Japan shipped with authentication off, exposing the address book and stored scans (CVE-2026-63563).Mon, 03 Aug 2026 09:23:09 GMTSecurity newsNoam Alumhttps://suriq.io/blog/npm-debug-chalk-axios-north-korea/https://suriq.io/blog/npm-debug-chalk-axios-north-korea/npm supply-chain attacks on debug, chalk, and axios are tied to one North Korean crew, Sapphire Sleet. Why signing missed it, and how to detect it.Sun, 02 Aug 2026 16:47:38 GMTSecurity newsNoam Alumhttps://suriq.io/blog/freerdp-windows-clipboard-heap-overflow-cve-2026-68579/https://suriq.io/blog/freerdp-windows-clipboard-heap-overflow-cve-2026-68579/FreeRDP fixed CVE-2026-68579, a critical clipboard heap overflow in its Windows client. A malicious remote desktop server can corrupt memory. Update to 3.30.0.Sun, 02 Aug 2026 15:08:49 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/water-utilities-7-states-exposed-plc-default-passwords/https://suriq.io/blog/water-utilities-7-states-exposed-plc-default-passwords/Attackers hijacked internet-exposed water-utility control devices in 7 US states using default passwords, no CVE required. CISA says disconnect them now.Sun, 02 Aug 2026 12:55:23 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/adform-ad-script-crypto-wallet-swap-supply-chain/https://suriq.io/blog/adform-ad-script-crypto-wallet-swap-supply-chain/Attackers trojanized Adform's shared trackpoint-async.js to swap Bitcoin, Ethereum, and Tron wallet addresses in visitors' browsers. Why SRI can't stop it.Sat, 01 Aug 2026 19:44:15 GMTSecurity newsNoam Alumhttps://suriq.io/blog/autonomous-ai-agent-deepseek-hermes-460-servers/https://suriq.io/blog/autonomous-ai-agent-deepseek-hermes-460-servers/A China-linked operator wired DeepSeek into an autonomous agent that swept 460+ exposed servers.Sat, 01 Aug 2026 16:40:16 GMTSecurity newsNoam Alumhttps://suriq.io/blog/chrome-ai-1072-bugs-faster-patch-cadence/https://suriq.io/blog/chrome-ai-1072-bugs-faster-patch-cadence/Google credits AI for fixing 1,072 Chrome bugs in two June releases, but never said how many AI found. The real shift for defenders is a faster patch cadence.Sat, 01 Aug 2026 13:02:24 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/anthropic-ai-models-breached-real-companies-ctf-tests/https://suriq.io/blog/anthropic-ai-models-breached-real-companies-ctf-tests/Anthropic says three of its AI models breached real companies during security tests after a sandbox misconfiguration. Two of three victims never noticed.Sat, 01 Aug 2026 08:33:35 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ai-engine-wordpress-mcp-oauth-csrf-rogue-admin-cve-2026-15988/https://suriq.io/blog/ai-engine-wordpress-mcp-oauth-csrf-rogue-admin-cve-2026-15988/CVE-2026-15988 lets an attacker create a new WordPress administrator on sites running AI Engine 3.6.5 or earlier if a logged-in admin clicks one link.Sat, 01 Aug 2026 08:09:52 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/vault-secrets-webhook-ssrf-token-theft/https://suriq.io/blog/vault-secrets-webhook-ssrf-token-theft/CVE-2026-54725 is a critical SSRF in bank-vaults vault-secrets-webhook (CVSS 9.6). A user who can create a ConfigMap can steal ServiceAccount tokens. Fix: 1.23.Fri, 31 Jul 2026 18:24:37 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/rails-active-storage-cve-2026-66066-arbitrary-file-read/https://suriq.io/blog/rails-active-storage-cve-2026-66066-arbitrary-file-read/CVE-2026-66066 lets an unauthenticated attacker upload a crafted image to a Rails app and read any server file, including its signing key. Patch now.Fri, 31 Jul 2026 16:04:08 GMTSecurity newsNoam Alumhttps://suriq.io/blog/azure-cosmos-db-cosmosescape-master-key/https://suriq.io/blog/azure-cosmos-db-cosmosescape-master-key/Wiz's CosmosEscape exposed a platform-wide Azure Cosmos DB key that could read and write any customer's database.Fri, 31 Jul 2026 11:22:07 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/silverfox-modular-byovd-valleyrat/https://suriq.io/blog/silverfox-modular-byovd-valleyrat/Silver Fox now runs a modular bring-your-own-vulnerable-driver kit with three interchangeable drivers, killing EDR from the kernel to deploy ValleyRAT.Fri, 31 Jul 2026 09:09:41 GMTSecurity newsNoam Alumhttps://suriq.io/blog/keycloak-google-domain-bypass-token-exchange-cve-2026-18214/https://suriq.io/blog/keycloak-google-domain-bypass-token-exchange-cve-2026-18214/A missing check in Red Hat Build of Keycloak lets an outside Google account bypass a Google Workspace domain restriction during token exchange.Fri, 31 Jul 2026 08:11:44 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/fcc-covered-list-robots-inverters-installed-base/https://suriq.io/blog/fcc-covered-list-robots-inverters-installed-base/The FCC added networked power inverters and mobile robots to its Covered List over remote-control risk.Thu, 30 Jul 2026 19:24:46 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ruflo-rufroot-mcp-bridge-rce-cve-2026-59726/https://suriq.io/blog/ruflo-rufroot-mcp-bridge-rce-cve-2026-59726/Ruflo exposed an unauthenticated MCP bridge to 233 tools, so one request gets full remote code execution (CVE-2026-59726).Thu, 30 Jul 2026 16:13:38 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/owareaper-outlook-web-access-cve-2026-42897/https://suriq.io/blog/owareaper-outlook-web-access-cve-2026-42897/Russian group Void Blizzard is exploiting Outlook Web Access flaw CVE-2026-42897 to plant OWAReaper, a backdoor whose server-side mailbox access survivesThu, 30 Jul 2026 12:10:45 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cisco-fmc-hardcoded-password-cve-2026-20316/https://suriq.io/blog/cisco-fmc-hardcoded-password-cve-2026-20316/Cisco Secure Firewall Management Center ships a static password (CVE-2026-20316) that lets unauthenticated attackers log in. Now in CISA KEV. Patch and hunt.Thu, 30 Jul 2026 11:13:38 GMTSecurity newsNoam Alumhttps://suriq.io/blog/adminer-cve-2026-15686-authenticated-rce/https://suriq.io/blog/adminer-cve-2026-15686-authenticated-rce/CVE-2026-15686 lets a logged-in Adminer user slip a blocked SQLite command past a filter and run code on the server. Fixed in Adminer 5.4.3; update now.Thu, 30 Jul 2026 08:26:56 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/vmware-vcenter-esxi-preauth-rce-vm-escape/https://suriq.io/blog/vmware-vcenter-esxi-preauth-rce-vm-escape/VMware's VMSA-2026-0006 patches two 9.8 vCenter flaws that add up to unauthenticated code execution, plus a 9.3 ESXi VM escape. Patch vCenter first.Wed, 29 Jul 2026 18:39:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cpanel-whm-security-release-exim/https://suriq.io/blog/cpanel-whm-security-release-exim/cPanel and WHM's new security release fixes CVE-2026-58047, CVE-2026-58048 and an Exim flaw, rated up to High. Patched versions for every branch, what to do.Wed, 29 Jul 2026 17:40:47 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/minnesota-water-utilities-coordinated-ot-attack/https://suriq.io/blog/minnesota-water-utilities-coordinated-ot-attack/More than 30 Minnesota water systems were hit in a coordinated two-day attack. The simultaneity points to shared exposure; the signal sits on the IT side.Wed, 29 Jul 2026 15:46:49 GMTSecurity newsNoam Alumhttps://suriq.io/blog/dysphoria-iot-botnet-blockchain-c2-relays/https://suriq.io/blog/dysphoria-iot-botnet-blockchain-c2-relays/Dysphoria, a DDoS-for-hire IoT botnet, survived a March takedown by anchoring its command servers to Ethereum and Solana names no registrar can seize, and nowWed, 29 Jul 2026 12:51:47 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/erpnext-cve-2026-12895-supplier-sql-injection/https://suriq.io/blog/erpnext-cve-2026-12895-supplier-sql-injection/CVE-2026-12895 is a SQL injection in ERPNext that lets a low-privilege user read the whole database. Fixed in 15.111.0 and 16.22.0. Patch and rotate secrets.Wed, 29 Jul 2026 11:25:03 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/apache-traffic-server-cve-2026-33267-request-smuggling/https://suriq.io/blog/apache-traffic-server-cve-2026-33267-request-smuggling/Apache Traffic Server has a critical flaw, CVE-2026-33267 (CVSS 10), that lets attackers smuggle requests and spoof internal metadata.Wed, 29 Jul 2026 08:09:56 GMTSecurity newsNoam Alumhttps://suriq.io/blog/fastjson-cve-2026-16723-spring-boot-exploited/https://suriq.io/blog/fastjson-cve-2026-16723-spring-boot-exploited/CVE-2026-16723, a fastjson 1.x remote code execution flaw, is now exploited against US firms. Only Spring Boot fat-JAR apps are hit, and no 1.x patch is coming.Tue, 28 Jul 2026 19:38:36 GMTSecurity newsNoam Alumhttps://suriq.io/blog/exposed-bmc-ipmi-password-hash-leak/https://suriq.io/blog/exposed-bmc-ipmi-password-hash-leak/A scan found 24,650 internet-exposed server BMCs leaking IPMI password hashes to anyone via CVE-2013-4786. There is no patch. Here is how to close the exposure.Tue, 28 Jul 2026 15:39:35 GMTSecurity newsNoam Alumhttps://suriq.io/blog/teamcity-cve-2026-63077-preauth-rce-build-server/https://suriq.io/blog/teamcity-cve-2026-63077-preauth-rce-build-server/CVE-2026-63077 is a CVSS 9.8 auth bypass in every TeamCity On-Premises version. An unauthenticated attacker can run commands. Patch to 2025.11.7 or 2026.1.3.Tue, 28 Jul 2026 12:15:15 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/public-dns-servers-filtering-verified/https://suriq.io/blog/public-dns-servers-filtering-verified/Public DNS servers with filtering, verified against official docs: what the Cloudflare, Quad9, AdGuard, CleanBrowsing, ControlD, Mullvad and OpenDNS IPs block.Tue, 28 Jul 2026 09:59:12 GMTExplainersNoam Alumhttps://suriq.io/blog/signal-patch-is-not-the-finish-line/https://suriq.io/blog/signal-patch-is-not-the-finish-line/This week's most-exploited bugs each shipped with a fix, yet patching FortiOS, SharePoint, Check Point, and Langflow did not end the incident.Tue, 28 Jul 2026 09:27:50 GMTDeep diveSuriq's Jackhttps://suriq.io/blog/dassault-3dexperience-cve-2026-11756-launcher-rce/https://suriq.io/blog/dassault-3dexperience-cve-2026-11756-launcher-rce/CVE-2026-11756 is a CVSS 10 deserialization flaw in Dassault's 3DEXPERIENCE Launcher that allows unauthenticated remote code execution.Tue, 28 Jul 2026 08:25:08 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/velocloud-orchestrator-cve-2026-16812-onprem-command-injection/https://suriq.io/blog/velocloud-orchestrator-cve-2026-16812-onprem-command-injection/CVE-2026-16812 is a CVSS 10.0 OS command injection in on-prem VeloCloud Orchestrator, actively exploited. See the affected and fixed builds to patch now.Mon, 27 Jul 2026 20:04:38 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/fortios-symlink-patch-bypass-cve-2025-68686-kev/https://suriq.io/blog/fortios-symlink-patch-bypass-cve-2025-68686-kev/CISA added CVE-2025-68686 to its exploited catalog: a bypass of Fortinet's FortiOS symlink fix lets attackers who already breached a FortiGate keep reading itsMon, 27 Jul 2026 18:39:43 GMTSecurity newsNoam Alumhttps://suriq.io/blog/n8n-sandbox-escape-workflow-editor-rce/https://suriq.io/blog/n8n-sandbox-escape-workflow-editor-rce/n8n patched a CVSS 8.7 expression sandbox escape (GHSA-gv7g-jm28-cr3m) that lets any workflow editor run OS commands on the host. Update to 2.32.1 now.Mon, 27 Jul 2026 16:51:45 GMTSecurity newsNoam Alumhttps://suriq.io/blog/vbulletin-cve-2026-61511-template-eval-rce/https://suriq.io/blog/vbulletin-cve-2026-61511-template-eval-rce/CVE-2026-61511 is an unauthenticated remote code execution flaw in vBulletin's template engine (CVSS 9.8).Mon, 27 Jul 2026 14:09:46 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/github-pypi-release-cooldown-supply-chain-gap/https://suriq.io/blog/github-pypi-release-cooldown-supply-chain-gap/GitHub now waits three days before Dependabot opens an update pull request, and PyPI locks old releases from new files.Mon, 27 Jul 2026 11:33:16 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/openshift-virtualization-view-role-cross-tenant-clone/https://suriq.io/blog/openshift-virtualization-view-role-cross-tenant-clone/CVE-2026-17527 lets a low-privileged OpenShift Virtualization tenant copy other tenants' data across namespaces through a read-only role. No fix yet; audit now.Mon, 27 Jul 2026 10:26:06 GMTSecurity newsNoam Alumhttps://suriq.io/blog/hotel-wifi-dns-hijack-microsoft-365-mfa/https://suriq.io/blog/hotel-wifi-dns-hijack-microsoft-365-mfa/A campaign is hijacking hotel and conference Wi-Fi to steal Microsoft 365 accounts. A VPN closes most of it, but not the device-code trick that beats MFA.Sun, 26 Jul 2026 19:19:15 GMTSecurity newsNoam Alumhttps://suriq.io/blog/sourtrade-browser-assembled-malware/https://suriq.io/blog/sourtrade-browser-assembled-malware/SourTrade malvertising makes the victim's browser assemble a Windows infostealer in memory, with a unique hash per visitor, so no scannable file ever crossesSun, 26 Jul 2026 15:42:49 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/gitlab-notebook-diff-rce-public-exploit/https://suriq.io/blog/gitlab-notebook-diff-rce-public-exploit/GitLab quietly patched a self-managed code-execution flaw on June 10 with no CVE. A public exploit is now out and any push-access user can run code as git.Sun, 26 Jul 2026 11:30:05 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/miniorange-saml-sso-wordpress-admin-bypass/https://suriq.io/blog/miniorange-saml-sso-wordpress-admin-bypass/A public exploit for CVE-2026-15981 lets unauthenticated attackers log in as any WordPress admin via the miniOrange SAML SSO plugin. Update to 5.4.5 now.Sun, 26 Jul 2026 09:55:01 GMTSecurity newsNoam Alumhttps://suriq.io/blog/certighost-adcs-cve-2026-54121/https://suriq.io/blog/certighost-adcs-cve-2026-54121/CVE-2026-54121 lets a standard Active Directory user impersonate a domain controller through AD CS and run DCSync.Sat, 25 Jul 2026 15:45:18 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/oracle-weblogic-cve-2026-60206-saml-login-forgery-exploit/https://suriq.io/blog/oracle-weblogic-cve-2026-60206-saml-login-forgery-exploit/A public proof-of-concept exploit now targets CVE-2026-60206, a CVSS 9.9 Oracle WebLogic flaw that forges a login to take over the server. Patch and hunt now.Sat, 25 Jul 2026 15:27:56 GMTSecurity newsNoam Alumhttps://suriq.io/blog/windmill-cve-2026-29059-arbitrary-file-read/https://suriq.io/blog/windmill-cve-2026-29059-arbitrary-file-read/Windmill's unauthenticated file-read flaw CVE-2026-29059 is being exploited in the wild. Patch self-hosted instances to 1.603.3 and rotate any exposed secrets.Sat, 25 Jul 2026 11:34:38 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/wpforms-pro-cve-2026-10818-file-upload-rce/https://suriq.io/blog/wpforms-pro-cve-2026-10818-file-upload-rce/A flaw in WPForms Pro (CVE-2026-10818) lets unauthenticated attackers upload executable files to WordPress sites on versions up to 1.10.1.1 and run code.Sat, 25 Jul 2026 08:10:39 GMTSecurity newsNoam Alumhttps://suriq.io/blog/chatgpt-agentforger-csrf-rogue-agent/https://suriq.io/blog/chatgpt-agentforger-csrf-rogue-agent/Zenity Labs' AgentForger let one crafted ChatGPT link forge a self-running AI agent wired to your connected apps. OpenAI fixed it. Here's what to watch.Fri, 24 Jul 2026 18:32:54 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/hermes-ai-agent-thailand-finance-ministry/https://suriq.io/blog/hermes-ai-agent-thailand-finance-ministry/An attacker ran an unattended AI agent to hack Thailand's finance ministry. It used no new exploit, and defenders catch it by watching host actions.Fri, 24 Jul 2026 15:52:48 GMTSecurity newsNoam Alumhttps://suriq.io/blog/keycloak-cve-2026-17048-vault-secret-leak/https://suriq.io/blog/keycloak-cve-2026-17048-vault-secret-leak/CVE-2026-17048 lets a view-only Keycloak admin read resolved client secrets from the vault instead of the placeholder.Fri, 24 Jul 2026 14:11:05 GMTSecurity newsNoam Alumhttps://suriq.io/blog/fake-notepad-plugin-dll-sideload-uac0099/https://suriq.io/blog/fake-notepad-plugin-dll-sideload-uac0099/CERT-UA ties UAC-0099 to a campaign hiding a Windows loader in a genuine Notepad++ via DLL sideloading.Fri, 24 Jul 2026 11:14:43 GMTSecurity newsNoam Alumhttps://suriq.io/blog/eset-macos-cve-2026-7483-privileged-service-local-root/https://suriq.io/blog/eset-macos-cve-2026-7483-privileged-service-local-root/ESET patched CVE-2026-7483, a local privilege escalation in its Mac security software that let any logged-in user write files as root.Fri, 24 Jul 2026 10:11:44 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/zimbra-cve-2025-66376-russian-mail-theft/https://suriq.io/blog/zimbra-cve-2025-66376-russian-mail-theft/Russian group Void Blizzard exploited Zimbra webmail flaw CVE-2025-66376 as a zero-day to steal 90 days of mail and mint app passwords that survive resets.Thu, 23 Jul 2026 19:06:36 GMTSecurity newsNoam Alumhttps://suriq.io/blog/refluxfs-xfs-linux-local-root/https://suriq.io/blog/refluxfs-xfs-linux-local-root/RefluXFS (CVE-2026-64600) lets any local user get root on default RHEL, Rocky, Alma and Amazon Linux via an XFS race. No workaround: patch and reboot.Thu, 23 Jul 2026 15:58:48 GMTSecurity newsNoam Alumhttps://suriq.io/blog/phpspreadsheet-cve-2026-59933-spreadsheet-upload-dos/https://suriq.io/blog/phpspreadsheet-cve-2026-59933-spreadsheet-upload-dos/CVE-2026-59933: a 1 KB malformed spreadsheet can exhaust memory and crash PHP apps using PhpSpreadsheet, even during automatic file-type detection. Patch now.Thu, 23 Jul 2026 15:28:07 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/adobe-acrobat-extension-whatsapp-web-cross-origin/https://suriq.io/blog/adobe-acrobat-extension-whatsapp-web-cross-origin/A cross-origin flaw in Adobe's Acrobat Chrome extension (CVE-2026-48294) let any website read WhatsApp Web chats. Update to 26.5.2.3 and govern extensions.Thu, 23 Jul 2026 11:45:23 GMTSecurity newsNoam Alumhttps://suriq.io/blog/libcupsfilters-cve-2026-64611-printer-loop-dos/https://suriq.io/blog/libcupsfilters-cve-2026-64611-printer-loop-dos/CVE-2026-64611 lets a crafted printer advertisement drive libcupsfilters into an infinite loop, burning a CPU core on Linux print systems. Patch and harden now.Thu, 23 Jul 2026 11:25:14 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/fastjson-cve-2026-16723-default-config-rce/https://suriq.io/blog/fastjson-cve-2026-16723-default-config-rce/CVE-2026-16723 lets attackers run code on Java apps using fastjson 1.2.68 to 1.2.83 in default configuration. Turn on SafeMode or move to fastjson2.Thu, 23 Jul 2026 08:39:14 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/check-point-smartconsole-cve-2026-16232-exploited/https://suriq.io/blog/check-point-smartconsole-cve-2026-16232-exploited/Check Point SmartConsole flaw CVE-2026-16232 is exploited and in CISA KEV, letting an unauthenticated attacker log in as full admin.Wed, 22 Jul 2026 20:10:17 GMTSecurity newsNoam Alumhttps://suriq.io/blog/sharepoint-cve-2026-50522-rotate-machine-keys/https://suriq.io/blog/sharepoint-cve-2026-50522-rotate-machine-keys/CVE-2026-50522, a CVSS 9.8 SharePoint RCE, went from public PoC to active exploitation in hours.Wed, 22 Jul 2026 15:57:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/langflow-cve-2026-0770-validate-rce-kev/https://suriq.io/blog/langflow-cve-2026-0770-validate-rce-kev/CVE-2026-0770 (CVSS 9.8) is an unauthenticated root RCE in Langflow's validate endpoint, actively exploited and added to CISA's KEV catalog.Wed, 22 Jul 2026 13:05:36 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/oracle-july-2026-cpu-unauthenticated-rce-weblogic-coherence/https://suriq.io/blog/oracle-july-2026-cpu-unauthenticated-rce-weblogic-coherence/Oracle's July 2026 update ships 1,449 fixes, including unauthenticated CVSS 10.0 remote code execution in WebLogic, Oracle HTTP Server, and Coherence.Wed, 22 Jul 2026 04:58:33 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/jackson-databind-jsonview-write-bypass-cve-2026-59889/https://suriq.io/blog/jackson-databind-jsonview-write-bypass-cve-2026-59889/CVE-2026-59889 lets a low-privilege user bypass jackson-databind's @JsonView write guard and set admin-only fields. Patched in 2.18.9, 2.21.5, 3.1.5.Wed, 22 Jul 2026 00:16:31 GMTSecurity newsNoam Alumhttps://suriq.io/blog/qilin-ransomware-palo-alto-globalprotect-cve-2026-0257/https://suriq.io/blog/qilin-ransomware-palo-alto-globalprotect-cve-2026-0257/CVE-2026-0257 lets attackers open a Palo Alto GlobalProtect VPN session with no login, and the Qilin ransomware crew is using it for initial access.Tue, 21 Jul 2026 18:26:29 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/hollowgraph-microsoft-365-calendar-c2/https://suriq.io/blog/hollowgraph-microsoft-365-calendar-c2/HollowGraph runs its command channel through a hijacked Microsoft 365 calendar over the Graph API. No CVE, no patch: here is how to detect it.Tue, 21 Jul 2026 16:04:00 GMTSecurity newsNoam Alumhttps://suriq.io/blog/nginx-cve-2026-42533-map-regex-heap-overflow/https://suriq.io/blog/nginx-cve-2026-42533-map-regex-heap-overflow/CVE-2026-42533 is a CVSS 9.2 heap overflow in nginx's string engine, patched July 15. Unlike June's flaws it fires on a common regex map config.Tue, 21 Jul 2026 11:41:51 GMTSecurity newsDeep diveNoam Alumhttps://suriq.io/blog/signal-ai-bugs-confused-deputy/https://suriq.io/blog/signal-ai-bugs-confused-deputy/This week's headline ‘AI’ vulnerabilities in Grafana and Apache Camel are the 1988 confused-deputy flaw, the same one that hit Fastify, Directus and OpenShiftTue, 21 Jul 2026 09:25:08 GMTDeep diveSuriq's Jackhttps://suriq.io/blog/directus-cache-authorization-leak-cve-2026-61836/https://suriq.io/blog/directus-cache-authorization-leak-cve-2026-61836/Directus before 12.0.0 caches responses under a key that omits authorization, so with caching on it can serve one visitor's share-scoped data to another.Tue, 21 Jul 2026 09:10:05 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/servicenow-cve-2026-6875-sandbox-escape-exploited/https://suriq.io/blog/servicenow-cve-2026-6875-sandbox-escape-exploited/ServiceNow's pre-auth sandbox-escape flaw CVE-2026-6875 (CVSS 9.5) is under active exploitation.Mon, 20 Jul 2026 20:03:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/hugging-face-autonomous-ai-agent-breach/https://suriq.io/blog/hugging-face-autonomous-ai-agent-breach/Hugging Face says an autonomous AI agent breached it, taking internal data and service credentials.Mon, 20 Jul 2026 12:23:25 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/apache-camel-llm-tool-header-injection-cve-2026-49042/https://suriq.io/blog/apache-camel-llm-tool-header-injection-cve-2026-49042/CVE-2026-49042 lets a prompt-injected AI model set hidden Apache Camel headers via tool-call arguments, reaching code execution or SSRF on exposed routes.Mon, 20 Jul 2026 11:10:19 GMTSecurity newsNoam Alumhttps://suriq.io/blog/openshift-hypershift-konnectivity-cert-bypass/https://suriq.io/blog/openshift-hypershift-konnectivity-cert-bypass/CVE-2026-16242 (CVSS 9.4): a missing certificate check in OpenShift hosted control planes lets a remote attacker intercept control-plane-to-node traffic.Mon, 20 Jul 2026 08:26:42 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/ey-breach-it-support-ticket-platform/https://suriq.io/blog/ey-breach-it-support-ticket-platform/EY says client tax data leaked from a third-party IT support platform, not its audit systems. Why help-desk tooling is a crown-jewel store, and how to watch it.Sun, 19 Jul 2026 19:42:49 GMTSecurity newsThought leadershipNoam Alumhttps://suriq.io/blog/nadmesh-botnet-exposed-ai-cloud-keys/https://suriq.io/blog/nadmesh-botnet-exposed-ai-cloud-keys/NadMesh, a new Go botnet, scans exposed self-hosted AI tools like Ollama and ComfyUI to steal cloud keys and Kubernetes tokens.Sun, 19 Jul 2026 15:42:01 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/wp2shell-exploits-public-hunt-now/https://suriq.io/blog/wp2shell-exploits-public-hunt-now/Public proof-of-concept exploits for the wp2shell WordPress Core RCE (CVE-2026-63030) are live and the mechanism is disclosed.Sun, 19 Jul 2026 11:11:36 GMTSecurity newsNoam Alumhttps://suriq.io/blog/inc-ransomware-sonicwall-sma-mfa-seed-theft/https://suriq.io/blog/inc-ransomware-sonicwall-sma-mfa-seed-theft/Rapid7 ties the SonicWall SMA 1000 zero-days to an Inc ransomware actor that stole credentials, sessions, and TOTP seeds. A password reset won't evict it.Sun, 19 Jul 2026 09:06:06 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/acr-stealer-clickfix-session-theft/https://suriq.io/blog/acr-stealer-clickfix-session-theft/ACR Stealer, now surging per Microsoft, steals live browser sessions and Microsoft 365 files through ClickFix lures.Sat, 18 Jul 2026 19:30:36 GMTSecurity newsNoam Alumhttps://suriq.io/blog/fastify-http-proxy-prefix-bypass-cve-2026-16117/https://suriq.io/blog/fastify-http-proxy-prefix-bypass-cve-2026-16117/A single URL-encoded character slips past @fastify/http-proxy's prefix rewrite (CVE-2026-16117, CVSS 10), exposing internal upstream endpoints. Upgrade to 11.6.Sat, 18 Jul 2026 18:54:32 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/openssl-hollowbyte-tls-memory-dos/https://suriq.io/blog/openssl-hollowbyte-tls-memory-dos/OpenSSL patched HollowByte, an 11-byte flaw that strands server memory, quietly in June with no CVE.Sat, 18 Jul 2026 12:05:18 GMTSecurity newsNoam Alumhttps://suriq.io/blog/vmware-avi-load-balancer-control-plane-flaws-vmsa-2026-0005/https://suriq.io/blog/vmware-avi-load-balancer-control-plane-flaws-vmsa-2026-0005/Broadcom's VMSA-2026-0005 patches seven VMware Avi Load Balancer flaws, including a CVSS 9.8 unauthenticated control-plane bypass. No workaround exists.Sat, 18 Jul 2026 09:37:00 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/wordpress-core-wp2shell-unauth-rce-cve-2026-63030/https://suriq.io/blog/wordpress-core-wp2shell-unauth-rce-cve-2026-63030/WordPress Core 6.9 and 7.0 carry wp2shell (CVE-2026-63030), an unauthenticated remote code execution flaw. Update to 6.9.5 or 7.0.2 right away, then hunt.Fri, 17 Jul 2026 22:55:08 GMTSecurity newsNoam Alumhttps://suriq.io/blog/clicklock-macos-coercion-stealer/https://suriq.io/blog/clicklock-macos-coercion-stealer/ClickLock is a macOS infostealer that kills your apps every 210ms until you type your login password into a fake prompt.Fri, 17 Jul 2026 19:25:30 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/tuxbot-ai-built-iot-botnet/https://suriq.io/blog/tuxbot-ai-built-iot-botnet/Unit 42 found TuxBot v3, an IoT botnet largely written with an AI. The build is 70% broken, the working core is plain Mirai, and your defenses still hold.Fri, 17 Jul 2026 16:45:10 GMTSecurity newsThought leadershipNoam Alumhttps://suriq.io/blog/cursor-windows-malicious-git-repo-rce/https://suriq.io/blog/cursor-windows-malicious-git-repo-rce/A malicious repository can run code when opened in Cursor on Windows through a planted git.exe. CVE-2026-63093 has no patch yet. How to detect and contain it.Fri, 17 Jul 2026 15:08:40 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/sharepoint-cve-2026-58644-machine-key-persistence/https://suriq.io/blog/sharepoint-cve-2026-58644-machine-key-persistence/CVE-2026-58644, a SharePoint deserialization RCE, is in CISA's KEV catalog and exploited as a zero-day. Patching alone won't evict an attacker who stole keys.Fri, 17 Jul 2026 11:40:11 GMTSecurity newsNoam Alumhttps://suriq.io/blog/apache-camel-solr-header-injection-ssrf-cve-2026-48203/https://suriq.io/blog/apache-camel-solr-header-injection-ssrf-cve-2026-48203/CVE-2026-48203: Camel's SolrParam. and SolrField. header prefixes slip past its HTTP header filter, letting outside requests inject Solr parameters and forceFri, 17 Jul 2026 11:10:53 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/envoy-gateway-lua-validator-file-read-cve-2026-53713/https://suriq.io/blog/envoy-gateway-lua-validator-file-read-cve-2026-53713/CVE-2026-53713 (CVSS 9.1): a path check in Envoy Gateway misses double slashes, letting a submitted Lua policy read the controller's Kubernetes token and TLSThu, 16 Jul 2026 19:37:33 GMTSecurity newsNoam Alumhttps://suriq.io/blog/legacyhive-windows-profsvc-privilege-zero-day/https://suriq.io/blog/legacyhive-windows-profsvc-privilege-zero-day/LegacyHive is a Windows User Profile Service privilege-escalation zero-day that works on fully patched systems, with no CVE and no fix yet.Thu, 16 Jul 2026 15:45:59 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/pipewire-pulseaudio-sandbox-escape/https://suriq.io/blog/pipewire-pulseaudio-sandbox-escape/CVE-2026-5674 lets a sandboxed Linux app abuse PipeWire's PulseAudio layer to load a malicious library and run code outside the sandbox.Thu, 16 Jul 2026 14:09:47 GMTSecurity newsNoam Alumhttps://suriq.io/blog/uefi-shims-secure-boot-revocation/https://suriq.io/blog/uefi-shims-secure-boot-revocation/ESET found 11 old Microsoft-signed UEFI shims that bypass Secure Boot on almost any system. Apply the June dbx revocation and verify it across your fleet.Thu, 16 Jul 2026 11:37:35 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/watchguard-firebox-unauth-rce-cve-2026-8247/https://suriq.io/blog/watchguard-firebox-unauth-rce-cve-2026-8247/CVE-2026-8247 lets a network-adjacent attacker run code as root on WatchGuard Firebox firewalls with no login.Thu, 16 Jul 2026 08:10:30 GMTSecurity newsNoam Alumhttps://suriq.io/blog/asyncapi-npm-provenance-signed-malware/https://suriq.io/blog/asyncapi-npm-provenance-signed-malware/Four @asyncapi npm packages shipped a malware loader carrying valid OIDC provenance attestations.Wed, 15 Jul 2026 15:51:58 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/rabbitmq-oauth-secret-leak-cve-2026-57219/https://suriq.io/blog/rabbitmq-oauth-secret-leak-cve-2026-57219/RabbitMQ patched CVE-2026-57219 and CVE-2026-57221. The severe OAuth secret leak needs OAuth configured; the quiet metadata bug hits every shared virtual host.Wed, 15 Jul 2026 11:23:11 GMTSecurity newsNoam Alumhttps://suriq.io/blog/claude-chrome-extension-forged-click-gmail/https://suriq.io/blog/claude-chrome-extension-forged-click-gmail/A rogue browser extension can forge a click that makes Claude for Chrome read your Gmail, Docs, and Calendar, unpatched across eight releases.Wed, 15 Jul 2026 09:07:01 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/grafana-mcp-server-token-leak-ssrf/https://suriq.io/blog/grafana-mcp-server-token-leak-ssrf/A high-severity flaw (CVSS 8.6) in Grafana's MCP server lets an unauthenticated attacker steal its Grafana service-account token and relay requests intoWed, 15 Jul 2026 08:11:56 GMTSecurity newsNoam Alumhttps://suriq.io/blog/sonicwall-sma1000-zero-days-exploited-2026-07-14/https://suriq.io/blog/sonicwall-sma1000-zero-days-exploited-2026-07-14/SonicWall patched two actively exploited SMA 1000 zero-days, CVE-2026-15409 and CVE-2026-15410.Tue, 14 Jul 2026 20:11:52 GMTSecurity newsNoam Alumhttps://suriq.io/blog/microsoft-patch-tuesday-zero-days-exploited/https://suriq.io/blog/microsoft-patch-tuesday-zero-days-exploited/Microsoft's July 2026 Patch Tuesday fixes two zero-days already exploited in the wild: an ADFS and a SharePoint Server privilege bug.Tue, 14 Jul 2026 18:28:35 GMTSecurity newsNoam Alumhttps://suriq.io/blog/sap-july-2026-critical-patch-priority/https://suriq.io/blog/sap-july-2026-critical-patch-priority/SAP's July 2026 patch day has three criticals. The top-scored 9.9 NetWeaver bug needs a login; the two pre-auth 9.1s in AppRouter and Commerce Cloud go first.Tue, 14 Jul 2026 16:44:45 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/crashstealer-notarized-macos-gatekeeper/https://suriq.io/blog/crashstealer-notarized-macos-gatekeeper/CrashStealer is a macOS info-stealer that Apple notarized, so Gatekeeper cleared it on launch before it drained keychains, browser logins and crypto wallets.Tue, 14 Jul 2026 11:51:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/signal-safety-appliances-broke-authorization/https://suriq.io/blog/signal-safety-appliances-broke-authorization/Dell Data Domain, Progress ShareFile and BeyondTrust all failed at authorization this week.Tue, 14 Jul 2026 09:16:57 GMTDeep diveSuriq's Jackhttps://suriq.io/blog/cisco-ios-csrf-legacy-router-kev-exploited/https://suriq.io/blog/cisco-ios-csrf-legacy-router-kev-exploited/CISA flagged an 18-year-old Cisco IOS flaw (CVE-2008-4128) as actively exploited. What it hits, why old routers are the target, and how to shut it down.Tue, 14 Jul 2026 05:40:40 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/ghostcommit-png-prompt-injection-ai-agents/https://suriq.io/blog/ghostcommit-png-prompt-injection-ai-agents/Researchers hid prompt-injection text inside a PNG in a pull request and made AI coding agents read .env and leak the secrets.Mon, 13 Jul 2026 16:26:45 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/cms-webshell-campaign-unpatched-plugins/https://suriq.io/blog/cms-webshell-campaign-unpatched-plugins/Australia's cyber agency warns of a global campaign mass-exploiting 16 known CMS and plugin flaws to drop webshells on WordPress, Joomla and Craft sites.Mon, 13 Jul 2026 12:32:15 GMTSecurity newsNoam Alumhttps://suriq.io/blog/helix-ultimate-joomla-unauthenticated-menu-xss/https://suriq.io/blog/helix-ultimate-joomla-unauthenticated-menu-xss/A public exploit now targets CVE-2026-57829, an unauthenticated stored XSS in the Helix Ultimate Joomla framework below 2.2.7.Mon, 13 Jul 2026 08:24:03 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/wp-shellstorm-wordpress-webshell-detection/https://suriq.io/blog/wp-shellstorm-wordpress-webshell-detection/An exposed server revealed WP-SHELLSTORM, a WordPress and Joomla webshell operation. Its own logs show CVE severity barely predicted which sites got hacked.Sun, 12 Jul 2026 19:28:51 GMTSecurity newsNoam Alumhttps://suriq.io/blog/openwrt-luci-dhcpv6-hostname-xss/https://suriq.io/blog/openwrt-luci-dhcpv6-hostname-xss/A stored XSS in OpenWrt's LuCI web panel (CVE-2026-61876, CVSS 8.8) lets a device on the LAN plant a script in a DHCPv6 hostname that runs in the admin'sSun, 12 Jul 2026 19:08:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/github-org-enumeration-ghost-accounts-leaked-tokens/https://suriq.io/blog/github-org-enumeration-ghost-accounts-leaked-tokens/Datadog found 50+ dormant GitHub accounts enumerating corporate orgs through the public API, some escalating to private-repo clones with stolen tokens.Sun, 12 Jul 2026 16:17:01 GMTSecurity newsNoam Alumhttps://suriq.io/blog/zimbra-classic-web-client-crafted-email-xss/https://suriq.io/blog/zimbra-classic-web-client-crafted-email-xss/Zimbra shipped ZCS 10.1.19 to fix a stored XSS in the Classic Web Client that runs code from a crafted email. Google TAG reported it; no public exploit yet.Sun, 12 Jul 2026 12:49:32 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/npm-12-install-scripts-supply-chain-blind-spot/https://suriq.io/blog/npm-12-install-scripts-supply-chain-blind-spot/npm 12 disables install scripts by default, which would have stopped this week's jscrambler infostealer.Sat, 11 Jul 2026 19:24:17 GMTSecurity newsNoam Alumhttps://suriq.io/blog/progress-sharefile-storage-zone-shutdown/https://suriq.io/blog/progress-sharefile-storage-zone-shutdown/Progress told ShareFile customers to shut down on-premises Storage Zone Controllers over a credible threat.Sat, 11 Jul 2026 16:24:46 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/super-forms-wordpress-file-upload-rce/https://suriq.io/blog/super-forms-wordpress-file-upload-rce/A critical flaw (CVSS 9.8) in the Super Forms WordPress plugin lets unauthenticated attackers run code on the server.Sat, 11 Jul 2026 16:09:40 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gigawiper-fake-ransomware-disk-wiper/https://suriq.io/blog/gigawiper-fake-ransomware-disk-wiper/GigaWiper encrypts files to .candy with no key and no ransom note, because the ransomware is a decoy for a disk wipe. Here are the host signals that catch it.Sat, 11 Jul 2026 11:48:10 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/mcp-atlassian-upload-arbitrary-file-read/https://suriq.io/blog/mcp-atlassian-upload-arbitrary-file-read/mcp-atlassian before 0.22.0 reads files off its own host when a caller or a prompt-injected agent supplies a server-side path.Sat, 11 Jul 2026 00:56:51 GMTSecurity newsNoam Alumhttps://suriq.io/blog/joomla-balbooa-icagenda-upload-rce-kev/https://suriq.io/blog/joomla-balbooa-icagenda-upload-rce-kev/CISA added Balbooa Forms (CVE-2026-56291) and iCagenda (CVE-2026-48939) to its exploited list on July 10, the fourth and fifth Joomla extension with the sameFri, 10 Jul 2026 18:57:14 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/hallusquatting-ai-coding-agent-endpoint-risk/https://suriq.io/blog/hallusquatting-ai-coding-agent-endpoint-risk/HalluSquatting and Friendly Fire show AI coding agents running attacker code with a developer's privileges. No CVE, no patch. Here is the detection posture.Fri, 10 Jul 2026 16:58:22 GMTSecurity newsNoam Alumhttps://suriq.io/blog/insider-ransomware-negotiators-blackcat/https://suriq.io/blog/insider-ransomware-negotiators-blackcat/Three incident-response insiders at DigitalMint and Sygnia were sentenced for helping run BlackCat ransomware, one leaking victims' insurance limits.Fri, 10 Jul 2026 11:58:07 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/lurking-lizard-fake-7zip-residential-proxy/https://suriq.io/blog/lurking-lizard-fake-7zip-residential-proxy/A trojanized 7-Zip and VPN campaign called Lurking Lizard turns servers and PCs into residential proxy nodes.Fri, 10 Jul 2026 08:57:13 GMTSecurity newsNoam Alumhttps://suriq.io/blog/helix3-joomla-antonkill-database-defacement/https://suriq.io/blog/helix3-joomla-antonkill-database-defacement/An unauthenticated bug in JoomShaper's Helix3 (CVE-2026-49049) is defacing Joomla sites. It hides in the database, so patching to 3.1.2 alone won't clean it.Fri, 10 Jul 2026 08:41:28 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/ghostlock-linux-kernel-container-escape-root/https://suriq.io/blog/ghostlock-linux-kernel-container-escape-root/GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel flaw that turns any local foothold into host root and escapes containers. Who is exposed, how to patch.Thu, 09 Jul 2026 20:04:37 GMTSecurity newsNoam Alumhttps://suriq.io/blog/dialogflow-cx-rogue-agent-edit-permission/https://suriq.io/blog/dialogflow-cx-rogue-agent-edit-permission/Google's Dialogflow CX let one edit permission run code across every chatbot in a project.Thu, 09 Jul 2026 15:12:57 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/signed-kernel-driver-edr-killer/https://suriq.io/blog/signed-kernel-driver-edr-killer/GodDamn ransomware uses PoisonX, a kernel driver carrying a valid Microsoft signature, to disable EDR.Thu, 09 Jul 2026 12:34:05 GMTSecurity newsNoam Alumhttps://suriq.io/blog/how-to-use-wazuh-api/https://suriq.io/blog/how-to-use-wazuh-api/How to use the Wazuh API: authenticate on port 55000 for a JWT token, then query your agents and automate with copy-pasteable curl commands and a workedThu, 09 Jul 2026 09:25:02 GMTExplainersSuriq's Jackhttps://suriq.io/blog/tenda-router-hardcoded-backdoor-no-patch/https://suriq.io/blog/tenda-router-hardcoded-backdoor-no-patch/CERT/CC flagged a hardcoded admin password in five Tenda router models (CVE-2026-11405). No fix exists yet, so here is how to detect and contain it.Thu, 09 Jul 2026 08:36:46 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gitlost-github-agent-repo-leak/https://suriq.io/blog/gitlost-github-agent-repo-leak/A crafted public GitHub issue tricked an AI Agentic Workflow into posting a private repo's contents as a public comment. Why no patch closes this class.Wed, 08 Jul 2026 18:56:33 GMTSecurity newsThought leadershipSuriq's Jackhttps://suriq.io/blog/beyondtrust-remote-support-pra-auth-bypass/https://suriq.io/blog/beyondtrust-remote-support-pra-auth-bypass/BeyondTrust patched four flaws in Remote Support and Privileged Remote Access, including two pre-auth CVSS 9.2 bypasses. Upgrade to 25.3.3 and hunt the window.Wed, 08 Jul 2026 15:29:36 GMTSecurity newsNoam Alumhttps://suriq.io/blog/dell-data-domain-authorization-flaw-cve-2026-56086/https://suriq.io/blog/dell-data-domain-authorization-flaw-cve-2026-56086/CVE-2026-56086 lets a low-privileged remote user gain unauthorized access on Dell PowerProtect Data Domain backup appliances. CVSS 8.8. Patched builds are out.Wed, 08 Jul 2026 14:38:37 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/joomla-page-builder-uploads-exploited-kev/https://suriq.io/blog/joomla-page-builder-uploads-exploited-kev/CISA flagged two CVSS-10 Joomla page-builder flaws, SP Page Builder (CVE-2026-48908) and Page Builder CK (CVE-2026-56290), as exploited.Wed, 08 Jul 2026 12:05:22 GMTSecurity newsNoam Alumhttps://suriq.io/blog/xorg-xwayland-graphics-server-memory-corruption/https://suriq.io/blog/xorg-xwayland-graphics-server-memory-corruption/X.Org patched two memory-corruption bugs in the X server and XWayland. A local client can reach root where Xorg runs as root. Update to 21.1.24 and 24.1.13.Wed, 08 Jul 2026 08:41:02 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/adobe-coldfusion-cve-2026-48282-exploited-kev/https://suriq.io/blog/adobe-coldfusion-cve-2026-48282-exploited-kev/Adobe ColdFusion flaw CVE-2026-48282 (CVSS 10.0) is now exploited in the wild and in CISA KEV. Who is actually exposed, how to detect it, and what to patch.Tue, 07 Jul 2026 20:11:04 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cavern-manticore-c2-no-cve-it-provider-supply-chain/https://suriq.io/blog/cavern-manticore-c2-no-cve-it-provider-supply-chain/Check Point ties the Iran-linked Cavern C2 to intrusions that skip vulnerabilities entirely, abusing IT providers' own deployment tools.Tue, 07 Jul 2026 19:16:01 GMTSecurity newsNoam Alumhttps://suriq.io/blog/django-6-0-7-5-2-16-security-release/https://suriq.io/blog/django-6-0-7-5-2-16-security-release/Django 6.0.7 and 5.2.16 patch three low-severity issues: a header injection, a cache data leak, and a heap over-read.Tue, 07 Jul 2026 15:11:35 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/januscape-kvm-guest-host-vm-escape/https://suriq.io/blog/januscape-kvm-guest-host-vm-escape/Januscape (CVE-2026-53359) is a 16-year-old KVM use-after-free that lets a rooted guest VM crash its Linux host. Nested virtualization is the trigger.Tue, 07 Jul 2026 12:32:41 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/sssd-sudo-default-root-escalation/https://suriq.io/blog/sssd-sudo-default-root-escalation/CVE-2026-14474: when SSSD's LDAP sudo provider has no explicit search base, one directory account can plant a rule that grants root on every enrolled LinuxTue, 07 Jul 2026 11:09:11 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gitea-docker-reverse-proxy-auth-bypass/https://suriq.io/blog/gitea-docker-reverse-proxy-auth-bypass/A default in Gitea's Docker image trusts the X-WEBAUTH-USER header from any IP, so anyone can log in as any user.Mon, 06 Jul 2026 18:39:23 GMTSecurity newsNoam Alumhttps://suriq.io/blog/formie-craft-cms-template-injection/https://suriq.io/blog/formie-craft-cms-template-injection/Formie for Craft CMS has a critical flaw (CVE-2026-52889) that lets an unauthenticated visitor inject Twig template code through a hidden field.Mon, 06 Jul 2026 17:10:09 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/fatfs-embedded-devices-seven-flaws-no-patch/https://suriq.io/blog/fatfs-embedded-devices-seven-flaws-no-patch/runZero found seven flaws in FatFs, the filesystem inside millions of cameras, drones and controllers. No upstream patch exists. How to detect and contain it.Mon, 06 Jul 2026 11:41:27 GMTSecurity newsNoam Alumhttps://suriq.io/blog/rancher-fleet-foothold-to-cluster-takeover/https://suriq.io/blog/rancher-fleet-foothold-to-cluster-takeover/SUSE Rancher and Fleet patched critical flaws that let a leaked token or one tenant account seize whole Kubernetes clusters.Mon, 06 Jul 2026 10:54:23 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/kairos-encryptionless-extortion-detection/https://suriq.io/blog/kairos-encryptionless-extortion-detection/Kairos stole 2TB from a US county, encrypted nothing, and was paid $1M. Encryptionless extortion breaks file-locker alarms. Detect the login and egress.Sun, 05 Jul 2026 16:39:45 GMTSecurity newsNoam Alumhttps://suriq.io/blog/fortibleed-credentials-inc-lynx-ransomware/https://suriq.io/blog/fortibleed-credentials-inc-lynx-ransomware/FortiBleed harvested 110 million Fortinet credentials. SOCRadar links that access to INC and Lynx ransomware, with 12 encryptions and a Nextcloud zero-day.Sun, 05 Jul 2026 11:34:59 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/teampcp-supply-chain-cloud-credentials/https://suriq.io/blog/teampcp-supply-chain-cloud-credentials/The FBI's TeamPCP FLASH alert shows why a trojanized scanner steals from your servers, not the registry, and why pinning packages will not save you.Sun, 05 Jul 2026 08:39:18 GMTSecurity newsNoam Alumhttps://suriq.io/blog/bad-epoll-linux-kernel-privesc-sandbox-escape/https://suriq.io/blog/bad-epoll-linux-kernel-privesc-sandbox-escape/Bad Epoll (CVE-2026-46242) lets a sandboxed or unprivileged process reach root on Linux 6.4+ and Android. Fixed in April; a public 99% exploit now exists.Sat, 04 Jul 2026 19:29:45 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/control-web-panel-cve-2026-57517-public-exploit/https://suriq.io/blog/control-web-panel-cve-2026-57517-public-exploit/A public exploit for a critical Control Web Panel flaw (CVE-2026-57517) lets unauthenticated attackers seize hosting servers. Patch to 0.9.8.1225 and hunt now.Sat, 04 Jul 2026 15:12:49 GMTSecurity newsNoam Alumhttps://suriq.io/blog/netnut-proxy-takedown-devices-still-infected/https://suriq.io/blog/netnut-proxy-takedown-devices-still-infected/The FBI and Google seized the NetNut residential proxy network on July 2, but its two million compromised devices are still infected. Why IP reputation fails.Sat, 04 Jul 2026 11:53:59 GMTSecurity newsNoam Alumhttps://suriq.io/blog/scattered-spider-help-desk-attack/https://suriq.io/blog/scattered-spider-help-desk-attack/An extradited Scattered Spider suspect breached a retailer in under three hours through a help-desk password reset. Here is the identity control that stops it.Sat, 04 Jul 2026 09:07:08 GMTSecurity newsNoam Alumhttps://suriq.io/blog/kemp-loadmaster-cve-2026-8037-exploited/https://suriq.io/blog/kemp-loadmaster-cve-2026-8037-exploited/Kemp LoadMaster's CVE-2026-8037 gives unauthenticated root through its API and is under active exploitation. Affected versions, the fix, and how to detect it.Fri, 03 Jul 2026 15:37:59 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ai-agent-ransomware-langflow-unrecoverable/https://suriq.io/blog/ai-agent-ransomware-langflow-unrecoverable/The first ransomware attack run end to end by an AI agent broke in through a year-old Langflow flaw and encrypted a database with a key it never saved.Fri, 03 Jul 2026 12:17:09 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cursor-duneslide-sandbox-escape-rce/https://suriq.io/blog/cursor-duneslide-sandbox-escape-rce/Two critical Cursor flaws, DuneSlide (CVE-2026-50548/50549, CVSS 9.8), let a poisoned MCP server or web result overwrite the sandbox binary and run code.Fri, 03 Jul 2026 08:42:31 GMTSecurity newsNoam Alumhttps://suriq.io/blog/puppet-resource-api-cleartext-secrets/https://suriq.io/blog/puppet-resource-api-cleartext-secrets/CVE-2026-8804: Puppet's Resource API stopped honoring the sensitive flag, writing passwords in cleartext to each agent's state cache. Upgrade, then rotate.Fri, 03 Jul 2026 08:26:20 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/argo-cd-repo-server-unauth-rce-no-patch/https://suriq.io/blog/argo-cd-repo-server-unauth-rce-no-patch/Argo CD's repo-server runs code for unauthenticated callers and can take over your Kubernetes cluster. No patch or CVE exists yet, so isolate and watch it now.Thu, 02 Jul 2026 19:07:00 GMTSecurity newsNoam Alumhttps://suriq.io/blog/bioshocking-ai-browser-agent-credential-leak/https://suriq.io/blog/bioshocking-ai-browser-agent-credential-leak/A game-themed web page talked six AI browsers into leaking a developer's SSH keys. Why patching one vendor is not the fix, and what to watch instead.Thu, 02 Jul 2026 15:51:49 GMTSecurity newsNoam Alumhttps://suriq.io/blog/chocopoc-fake-poc-exploit-stealer/https://suriq.io/blog/chocopoc-fake-poc-exploit-stealer/ChocoPoC hides a credential-stealing trojan inside fake CVE proof-of-concept repos, targeting the researchers and red teams who download and test them.Thu, 02 Jul 2026 11:47:01 GMTSecurity newsNoam Alumhttps://suriq.io/blog/how-to-use-wazuh/https://suriq.io/blog/how-to-use-wazuh/How to use Wazuh: install the server, enroll an agent, reach the dashboard, and write and test a detection rule with wazuh-logtest.Thu, 02 Jul 2026 09:12:41 GMTExplainersNoam Alumhttps://suriq.io/blog/sharepoint-cve-2026-45659-kev-exploited/https://suriq.io/blog/sharepoint-cve-2026-45659-kev-exploited/Microsoft rated SharePoint's CVE-2026-45659 unlikely to be exploited. CISA added it to the KEV catalog on July 1 after active exploitation. Patch and hunt now.Thu, 02 Jul 2026 08:33:26 GMTSecurity newsNoam Alumhttps://suriq.io/blog/adobe-coldfusion-max-severity-rce-patch/https://suriq.io/blog/adobe-coldfusion-max-severity-rce-patch/Adobe patched six unauthenticated CVSS 10.0 code-execution flaws in ColdFusion (bulletin APSB26-68).Wed, 01 Jul 2026 19:21:44 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/azure-cli-password-spray-mfa-bypass/https://suriq.io/blog/azure-cli-password-spray-mfa-bypass/A password spray beat Conditional Access at 64 organizations by abusing ROPC, a retired Azure login flow that never triggers an MFA prompt. What to fix now.Wed, 01 Jul 2026 15:44:21 GMTSecurity newsNoam Alumhttps://suriq.io/blog/citrix-netscaler-http2-bomb-memory-leak/https://suriq.io/blog/citrix-netscaler-http2-bomb-memory-leak/Citrix fixed six NetScaler flaws, including a pre-login memory leak and an HTTP/2 Bomb denial of service. One fix needs a config change, not just an upgrade.Wed, 01 Jul 2026 12:00:27 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/browser-only-ransomware-file-system-access/https://suriq.io/blog/browser-only-ransomware-file-system-access/Check Point built browser-only ransomware from a DeepSeek AI output: a web page encrypts your files through a legitimate browser API, with no binary forWed, 01 Jul 2026 11:10:54 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/phantom-squatting-ai-hallucinated-domains/https://suriq.io/blog/phantom-squatting-ai-hallucinated-domains/Unit 42 found attackers registering the fake web domains AI models hallucinate, turning a chatbot's answer into a phishing and supply chain threat.Wed, 01 Jul 2026 01:23:38 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ai-coding-agent-guardrail-bypass/https://suriq.io/blog/ai-coding-agent-guardrail-bypass/AI coding agent guardrails fall to GuardFall, a bash trick that bypassed the command safety check in 10 of 11 open-source agents Adversa AI tested.Tue, 30 Jun 2026 19:07:57 GMTSecurity newsNoam Alumhttps://suriq.io/blog/stegoad-edge-extension-steganography/https://suriq.io/blog/stegoad-edge-extension-steganography/Microsoft pulled 119 malicious Edge extensions in the StegoAd campaign. Steganographic payloads, 2.6 million installs, and a 2FA lesson for defenders.Tue, 30 Jun 2026 16:56:06 GMTSecurity newsNoam Alumhttps://suriq.io/blog/oracle-ebs-payments-cve-2026-46817/https://suriq.io/blog/oracle-ebs-payments-cve-2026-46817/CVE-2026-46817, a CVSS 9.8 flaw in Oracle E-Business Suite Payments, is exploited weeks after Oracle's May patch. What to check and how to fix it now.Tue, 30 Jun 2026 13:07:29 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/simplehelp-auth-bypass-djinn-stealer/https://suriq.io/blog/simplehelp-auth-bypass-djinn-stealer/A maximum-severity SimpleHelp flaw, CVE-2026-48558, lets attackers forge a login and is now exploited to drop Djinn Stealer against cloud and AI keys.Tue, 30 Jun 2026 10:55:52 GMTSecurity newsNoam Alumhttps://suriq.io/blog/signal-toolchain-is-the-attack-surface/https://suriq.io/blog/signal-toolchain-is-the-attack-surface/This week's most serious compromises were not in application code but in the tools that build, ship, and assist it. The pattern, and what to do.Tue, 30 Jun 2026 09:12:57 GMTDeep diveSuriq's Jackhttps://suriq.io/blog/decode-uri-component-dos-patch-gap/https://suriq.io/blog/decode-uri-component-dos-patch-gap/decode-uri-component, the npm decoder behind query-string and millions of apps, has a denial-of-service bug (CVE-2026-45822).Tue, 30 Jun 2026 08:42:11 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/vscode-folderopen-npm-supply-chain-stealer/https://suriq.io/blog/vscode-folderopen-npm-supply-chain-stealer/Two hijacked npm packages skip the install step entirely. They run when you open the project in VS Code, then steal developer, browser, and wallet logins.Mon, 29 Jun 2026 18:53:09 GMTSecurity newsNoam Alumhttps://suriq.io/blog/clean-repo-ai-coding-agent-reverse-shell/https://suriq.io/blog/clean-repo-ai-coding-agent-reverse-shell/Mozilla's 0DIN made Claude Code open a reverse shell from a GitHub repo with no malicious code. Here is why scanners miss it and how to constrain the agent.Mon, 29 Jun 2026 15:54:37 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/tinyrct-backdoor-disguised-security-tools/https://suriq.io/blog/tinyrct-backdoor-disguised-security-tools/A Chinese APT called CL-STA-1062 ships its TinyRCT backdoor disguised as VMware and EDR agents. Why filename allowlists miss it, and what to hunt instead.Mon, 29 Jun 2026 12:58:23 GMTSecurity newsNoam Alumhttps://suriq.io/blog/suse-libzypp-repo-metadata-file-overwrite/https://suriq.io/blog/suse-libzypp-repo-metadata-file-overwrite/SUSE and openSUSE patched seven flaws in their package manager. CVE-2026-25707 lets a malicious repository overwrite system files as root.Mon, 29 Jun 2026 11:25:34 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/libssh2-malicious-server-client-rce/https://suriq.io/blog/libssh2-malicious-server-client-rce/libssh2's CVE-2026-55200 lets a malicious SSH server run code on the client that connects to it. No login, a public PoC is out, and there is no tagged fix yet.Mon, 29 Jun 2026 08:30:37 GMTSecurity newsNoam Alumhttps://suriq.io/blog/tonrat-nodejs-hotel-phishing-implant/https://suriq.io/blog/tonrat-nodejs-hotel-phishing-implant/TonRAT runs on a genuine Node.js runtime on hotel front-desk machines, hides its C2 on the TON blockchain, and slips past allowlists. Here is what to hunt.Sun, 28 Jun 2026 18:15:36 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/cellebrite-seized-device-encryption-lesson/https://suriq.io/blog/cellebrite-seized-device-encryption-lesson/Cellebrite's UFED tool fully read a locked iPhone in Russian custody but failed on the encrypted MacBook seized beside it.Sun, 28 Jun 2026 16:29:14 GMTSecurity newsNoam Alumhttps://suriq.io/blog/dirtyclone-linux-page-cache-privesc/https://suriq.io/blog/dirtyclone-linux-page-cache-privesc/DirtyClone and pedit COW are the latest in a family of Linux kernel root bugs that rewrite binaries in memory, invisible to file-integrity monitoring.Sun, 28 Jun 2026 12:08:33 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/7-zip-archive-strips-windows-download-warning/https://suriq.io/blog/7-zip-archive-strips-windows-download-warning/A crafted RAR5 archive lets 7-Zip 26.02 strip the Mark-of-the-Web, defeating Windows SmartScreen warnings. No patch exists yet.Sun, 28 Jun 2026 09:55:31 GMTSecurity newsNoam Alumhttps://suriq.io/blog/signal-recovery-key-phishing-russia/https://suriq.io/blog/signal-recovery-key-phishing-russia/Russian intelligence is phishing Signal users for the Backup Recovery Key, a secret that decrypts a whole message history and that no reset or new account canSat, 27 Jun 2026 16:29:26 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/polymarket-frontend-supply-chain-theft/https://suriq.io/blog/polymarket-frontend-supply-chain-theft/A compromised third-party vendor injected malicious code into Polymarket's site and stole nearly $3 million from users. The backend was never breached.Sat, 27 Jun 2026 13:05:27 GMTSecurity newsNoam Alumhttps://suriq.io/blog/what-is-mitre-attack/https://suriq.io/blog/what-is-mitre-attack/A plain-English guide to MITRE ATT&CK: what it is, how its tactics and techniques are organized, a real intrusion mapped step by step, and how defenders use it.Sat, 27 Jun 2026 11:52:08 GMTExplainersSuriq's Jackhttps://suriq.io/blog/what-is-a-siem/https://suriq.io/blog/what-is-a-siem/What a SIEM is, what it actually does, and how it differs from a SOC, an EDR, and plain log management - explained by a team that runs one.Sat, 27 Jun 2026 11:51:04 GMTExplainersNoam Alumhttps://suriq.io/blog/amazon-q-mcp-config-repo-rce/https://suriq.io/blog/amazon-q-mcp-config-repo-rce/Amazon Q Developer ran a repo's MCP config file as you, with AWS keys attached. CVE-2026-12957 is patched in 1.69.0. What to verify and hunt for now.Sat, 27 Jun 2026 08:15:12 GMTSecurity newsNoam Alumhttps://suriq.io/blog/signal-old-bug-classes-still-dominate/https://suriq.io/blog/signal-old-bug-classes-still-dominate/The vulnerability classes that actually shipped this week are the same five from 2010, even in new AI tooling. The pattern, and what to do.Sat, 27 Jun 2026 06:37:44 GMTDeep diveSuriq's Jackhttps://suriq.io/blog/php-weasyprint-ssrf-file-disclosure/https://suriq.io/blog/php-weasyprint-ssrf-file-disclosure/php-weasyprint's attachment option fetched attacker-controlled URLs server-side, reaching internal services, cloud metadata, and local files.Fri, 26 Jun 2026 22:26:30 GMTSecurity newsNoam Alumhttps://suriq.io/blog/turla-stockstay-backdoor-redundancy/https://suriq.io/blog/turla-stockstay-backdoor-redundancy/Google tied Russia's Turla to STOCKSTAY, a new .NET backdoor built as four swappable parts. Why deleting one piece does not evict the group, and what to hunt.Fri, 26 Jun 2026 18:30:42 GMTSecurity newsDeep diveSuriq's Jackhttps://suriq.io/blog/ptc-windchill-cve-2026-12569-exploited/https://suriq.io/blog/ptc-windchill-cve-2026-12569-exploited/CISA added PTC Windchill RCE CVE-2026-12569 to its KEV catalog after web shells hit exposed PLM servers. Patch to 11.0 M030 before the June 28 deadline.Fri, 26 Jun 2026 16:46:02 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/mistic-backdoor-access-broker-ransomware-setup/https://suriq.io/blog/mistic-backdoor-access-broker-ransomware-setup/Mistic is an in-memory backdoor that access broker KongTuke uses to hold footholds and sell them to Qilin and other ransomware crews. Here is where to catch it.Fri, 26 Jun 2026 11:45:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/openshift-virtualization-disabletls-vm-exposure/https://suriq.io/blog/openshift-virtualization-disabletls-vm-exposure/CVE-2026-13325: enabling disableTLS for faster live migration in Red Hat OpenShift Virtualization drops authentication, letting any pod reach another tenant’sFri, 26 Jun 2026 11:12:22 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/gitlab-no-login-session-hijack-patch/https://suriq.io/blog/gitlab-no-login-session-hijack-patch/GitLab's June 24 release fixes 14 flaws, including an unauthenticated cross-site scripting bug.Thu, 25 Jun 2026 05:23:36 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cordyceps-github-actions-pull-request-takeover/https://suriq.io/blog/cordyceps-github-actions-pull-request-takeover/Cordyceps lets anyone with a free GitHub account run code as a maintainer on 300+ repos. Why upgrading actions/checkout closes one door, not the others.Thu, 25 Jun 2026 04:06:39 GMTSecurity newsNoam Alumhttps://suriq.io/blog/unraid-web-panel-command-injection-rce/https://suriq.io/blog/unraid-web-panel-command-injection-rce/Two command injection flaws in Unraid's web panel, CVE-2026-9772 and CVE-2026-9773, let any logged-in user run code as www-data.Thu, 25 Jun 2026 02:23:59 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/docker-mcp-gateway-malicious-image-root-escape/https://suriq.io/blog/docker-mcp-gateway-malicious-image-root-escape/CVE-2026-55887 lets a malicious container image escape Docker's MCP Gateway and run code as root on the host. Rated 8.7.Thu, 25 Jun 2026 01:37:36 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/quest-netvault-backup-rce-cve-2026-7570/https://suriq.io/blog/quest-netvault-backup-rce-cve-2026-7570/CVE-2026-7570 is a SQL-injection-to-remote-code-execution flaw in Quest NetVault Backup, rated 8.8. The login can be bypassed. Quest fixed it in 14.0.2.Wed, 24 Jun 2026 23:52:11 GMTSecurity newsNoam Alumhttps://suriq.io/blog/stealc-amadey-takedown-stolen-credentials/https://suriq.io/blog/stealc-amadey-takedown-stolen-credentials/Operation Endgame seized the servers behind the Amadey and StealC malware, but the 27 million credentials they already stole stay valid until you rotate them.Wed, 24 Jun 2026 19:26:41 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/shapedplugin-wordpress-update-backdoor/https://suriq.io/blog/shapedplugin-wordpress-update-backdoor/Backdoored ShapedPlugin Pro updates stole admin logins and 2FA seeds from WordPress sites between April and June 2026. A password reset alone will not clear it.Wed, 24 Jun 2026 11:32:55 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ultimate-member-contributor-account-takeover/https://suriq.io/blog/ultimate-member-contributor-account-takeover/A contributor-level user can make Ultimate Member leak every user's password reset link, admins included. Affects versions through 2.11.4; fixed in 2.12.0.Wed, 24 Jun 2026 08:27:39 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/cisco-unified-cm-cve-2026-20230-exploited/https://suriq.io/blog/cisco-unified-cm-cve-2026-20230-exploited/CVE-2026-20230 in Cisco Unified CM can reach root, but only where WebDialer is enabled, and it ships off. Check that before you panic-patch.Wed, 24 Jun 2026 08:10:45 GMTSecurity newsNoam Alumhttps://suriq.io/blog/qemu-libslirp-guest-reads-host-memory/https://suriq.io/blog/qemu-libslirp-guest-reads-host-memory/A patched flaw in libslirp, QEMU's usermode networking, lets a privileged guest virtual machine read gigabytes of host memory. Update to libslirp 4.9.2 now.Wed, 24 Jun 2026 06:22:16 GMTSecurity newsNoam Alumhttps://suriq.io/blog/lantronix-eds5000-serial-server-root-exploited/https://suriq.io/blog/lantronix-eds5000-serial-server-root-exploited/CISA flagged CVE-2025-67038 as exploited on June 23. A failed login on a Lantronix EDS5000 serial server runs attacker commands as root.Wed, 24 Jun 2026 05:06:09 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/crawl4ai-docker-unauthenticated-rce/https://suriq.io/blog/crawl4ai-docker-unauthenticated-rce/Crawl4AI's Docker API shipped unauthenticated by default, exposing 51,000+ deployments to remote code execution and cloud-metadata SSRF. Upgrade to 0.9.0 now.Wed, 24 Jun 2026 04:11:43 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/openclaw-clawhub-malicious-skills/https://suriq.io/blog/openclaw-clawhub-malicious-skills/Malicious OpenClaw skills on the ClawHub marketplace steal credentials and hijack AI agents for crypto fraud, and some slip past the store's own scanner.Tue, 23 Jun 2026 22:25:33 GMTSecurity newsNoam Alumhttps://suriq.io/blog/macos-gaslight-prompt-injection-analyst/https://suriq.io/blog/macos-gaslight-prompt-injection-analyst/macOS.Gaslight embeds fake AI system messages to make automated, LLM-assisted malware analysis abort.Tue, 23 Jun 2026 22:09:38 GMTSecurity newsNoam Alumhttps://suriq.io/blog/jackson-databind-array-allowlist-bypass/https://suriq.io/blog/jackson-databind-array-allowlist-bypass/CVE-2026-54513 lets attackers bypass jackson-databind's polymorphic type validator by wrapping a banned class in an array. Patch to 2.18.8, 2.21.4 or 3.1.4.Tue, 23 Jun 2026 21:56:06 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/unifi-os-server-unauth-root-exploited/https://suriq.io/blog/unifi-os-server-unauth-root-exploited/Three chained UniFi OS Server flaws give unauthenticated root. CISA added all three to its exploited list on June 23. Patch to 5.0.8 and check who can reach it.Tue, 23 Jun 2026 19:50:29 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/pixelsmash-ffmpeg-media-pipeline-rce/https://suriq.io/blog/pixelsmash-ffmpeg-media-pipeline-rce/PixelSmash (CVE-2026-8461) lets a crafted video run code on FFmpeg-based media servers like Jellyfin and Nextcloud. Update to FFmpeg 8.1.2, then hunt.Tue, 23 Jun 2026 12:23:58 GMTSecurity newsNoam Alumhttps://suriq.io/blog/whatsapp-invoice-manageengine-rmm-backdoor/https://suriq.io/blog/whatsapp-invoice-manageengine-rmm-backdoor/A fake invoice on WhatsApp silently installs ManageEngine Endpoint Central, a legitimate remote-management tool, to hijack PCs.Tue, 23 Jun 2026 03:59:42 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gogs-mirror-settings-local-repo-access/https://suriq.io/blog/gogs-mirror-settings-local-repo-access/A validation gap in Gogs Mirror Settings (CVE-2026-52801) lets any authenticated user import local repositories and reach internal systems. Patch to 0.14.3 now.Tue, 23 Jun 2026 03:08:31 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/scim-patch-prototype-pollution-account-sync/https://suriq.io/blog/scim-patch-prototype-pollution-account-sync/CVE-2026-48170 lets one SCIM PATCH request poison Object.prototype across a Node.js app using scim-patch, risking admin forgery. Update to 0.9.1 now.Tue, 23 Jun 2026 01:41:05 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/budibase-pwa-zip-symlink-file-read/https://suriq.io/blog/budibase-pwa-zip-symlink-file-read/CVE-2026-54352 lets a Budibase workspace builder read the server's secret file via a crafted PWA zip and take over every workspace. Patch self-hosted to 3.39.9.Tue, 23 Jun 2026 00:10:44 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ai-export-control-patch-window/https://suriq.io/blog/ai-export-control-patch-window/The US used export-control powers to pull a frontier AI model that finds software bugs at scale.Mon, 22 Jun 2026 19:07:48 GMTSecurity newsThought leadershipNoam Alumhttps://suriq.io/blog/usbliter8-apple-bootrom-unpatchable-exploit/https://suriq.io/blog/usbliter8-apple-bootrom-unpatchable-exploit/usbliter8 is an unpatchable boot-chain exploit for Apple A12 and A13 devices. Here is the real enterprise risk, why remote wipe will not help, and what to do.Mon, 22 Jun 2026 15:31:48 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/papercut-print-deploy-local-takeover/https://suriq.io/blog/papercut-print-deploy-local-takeover/CVE-2026-6645 lets a local attacker plant a file that PaperCut's Print Deploy client runs with full system rights on Windows. Update to version 1.10.4178.Mon, 22 Jun 2026 04:25:17 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/central-dogma-default-secret-cluster-takeover/https://suriq.io/blog/central-dogma-default-secret-cluster-takeover/Central Dogma before 0.84.0 silently uses a public default secret when ZooKeeper replication runs without one set, letting nearby attackers seize the cluster.Mon, 22 Jun 2026 03:10:10 GMTSecurity newsNoam Alumhttps://suriq.io/blog/squidbleed-squid-proxy-credential-leak/https://suriq.io/blog/squidbleed-squid-proxy-credential-leak/Squidbleed (CVE-2026-47729) leaks memory from Squid proxies in default config, including login credentials. A public exploit is out, and 7.6 does not patch it.Mon, 22 Jun 2026 00:08:18 GMTSecurity newsNoam Alumhttps://suriq.io/blog/arystinger-router-botnet-recon-scanning/https://suriq.io/blog/arystinger-router-botnet-recon-scanning/A botnet called AryStinger hijacked over 4,300 end-of-life D-Link and Linksys routers into a distributed scanning grid for reconnaissance, not DDoS. What to do.Sun, 21 Jun 2026 18:35:49 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/popa-residential-proxy-ip-reputation-account-takeover/https://suriq.io/blog/popa-residential-proxy-ip-reputation-account-takeover/Researchers linked the Popa botnet of 2 million hacked TV boxes to a residential proxy service. Here is why IP reputation no longer stops account takeovers.Sun, 21 Jun 2026 16:52:26 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/prinz-eugen-ransomware-no-ransom-note/https://suriq.io/blog/prinz-eugen-ransomware-no-ransom-note/Prinz Eugen ransomware encrypts your most recently changed files first and drops no ransom note, defeating canary traps and note-based SOC alerts. What to do.Sun, 21 Jun 2026 11:51:28 GMTSecurity newsDeep diveNoam Alumhttps://suriq.io/blog/easeus-partition-master-driver-escalation/https://suriq.io/blog/easeus-partition-master-driver-escalation/A signed driver in EaseUS Partition Master (CVE-2026-12781) lets any standard Windows user read and overwrite the whole disk to reach SYSTEM.Sun, 21 Jun 2026 09:55:36 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/autojack-ai-agent-localhost-rce/https://suriq.io/blog/autojack-ai-agent-localhost-rce/Microsoft's AutoJack shows how one web page an AI browsing agent visits can run code on the host. The bug is a near miss. The architecture lesson is not.Sun, 21 Jun 2026 07:46:22 GMTSecurity newsNoam Alumhttps://suriq.io/blog/ash-authentication-email-account-takeover/https://suriq.io/blog/ash-authentication-email-account-takeover/CVE-2026-49757 (CVSS 9.2) let attackers take over accounts in Elixir apps built on ash_authentication by matching users on email instead of identity.Sun, 21 Jun 2026 07:24:16 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/fortibleed-cisa-alert-session-reset/https://suriq.io/blog/fortibleed-cisa-alert-session-reset/CISA warned Fortinet users on June 18; reporting counted 86,644 affected devices. Resetting passwords is not enough: kill live sessions and fix the hashing.Sun, 21 Jun 2026 03:18:09 GMTSecurity newsDeep diveNoam Alumhttps://suriq.io/blog/vllm-prompt-embeds-tensor-validation-flaw/https://suriq.io/blog/vllm-prompt-embeds-tensor-validation-flaw/CVE-2026-56340 lets a crafted tensor crash vLLM (CVSS 8.8) with a path to memory corruption. It only bites if you re-enabled prompt embeds. Fix is 0.13.0.Sun, 21 Jun 2026 02:55:23 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/gravity-smtp-credential-leak-cve-2026-4020/https://suriq.io/blog/gravity-smtp-credential-leak-cve-2026-4020/Gravity SMTP's CVE-2026-4020 hands live Amazon SES, Google, and OAuth keys to unauthenticated visitors on 100,000 WordPress sites.Sat, 20 Jun 2026 16:51:58 GMTSecurity newsNoam Alumhttps://suriq.io/blog/socgholish-operation-endgame-wordpress-takedown/https://suriq.io/blog/socgholish-operation-endgame-wordpress-takedown/Operation Endgame seized 106 SocGholish servers and cleaned 14,971 WordPress sites. The takedown hit an access broker, not the entry vector.Sat, 20 Jun 2026 12:19:16 GMTSecurity newsNoam Alumhttps://suriq.io/blog/langsmith-tracing-header-file-read/https://suriq.io/blog/langsmith-tracing-header-file-read/LangSmith SDK before 0.8.18 lets a crafted tracing header read arbitrary files off any server running TracingMiddleware. Upgrade now; it is the second such bug.Sat, 20 Jun 2026 09:09:23 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/usb-worm-clipper-crypto-clipboard/https://suriq.io/blog/usb-worm-clipper-crypto-clipboard/Microsoft found a USB worm that hijacks the clipboard to swap crypto wallet addresses and hides its command channel in Tor. Here is why it beats your controls.Sat, 20 Jun 2026 07:43:38 GMTSecurity newsDeep diveSuriq's Jackhttps://suriq.io/blog/appium-mcp-locator-xss-agent-hijack/https://suriq.io/blog/appium-mcp-locator-xss-agent-hijack/An XSS flaw in Appium's official MCP server let a hostile test app hijack the AI agent driving it and call its tools. Patch appium-mcp to 1.85.10 now.Sat, 20 Jun 2026 07:10:40 GMTSecurity newsNoam Alumhttps://suriq.io/blog/gentlemen-edr-killer-byovd-detection/https://suriq.io/blog/gentlemen-edr-killer-byovd-detection/The Gentlemen ransomware gang ships a standardized EDR killer to affiliates using BYOVD. Here is why driver-name hunting fails and what to detect instead.Sat, 20 Jun 2026 04:42:29 GMTSecurity newsDeep diveNoam Alumhttps://suriq.io/blog/branda-wordpress-account-takeover-cve-2026-11551/https://suriq.io/blog/branda-wordpress-account-takeover-cve-2026-11551/CVE-2026-11551 is a CVSS 9.8 unauthenticated account takeover in the Branda WordPress plugin (versions up to 3.4.29). A public exploit is out.Sat, 20 Jun 2026 03:56:36 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/wordpress-form-entries-file-deletion-rce/https://suriq.io/blog/wordpress-form-entries-file-deletion-rce/CVE-2026-9843 lets an unauthenticated visitor plant a form entry that deletes WordPress files when an admin opens it.Sat, 20 Jun 2026 02:40:19 GMTSecurity newsNoam Alumhttps://suriq.io/blog/langflow-rag-file-read-rce/https://suriq.io/blog/langflow-rag-file-read-rce/A crafted document in a Langflow RAG pipeline (CVE-2026-55447, CVSS 9.6) reads any file, forges a login token, then runs code. Upgrade to 1.9.2 or later.Sat, 20 Jun 2026 01:25:41 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/langflow-idor-cross-user-flow-execution/https://suriq.io/blog/langflow-idor-cross-user-flow-execution/A critical IDOR in Langflow (CVE-2026-55255, CVSS 9.9) lets any logged-in user run another user's AI flow. Upgrade to 1.9.1. The real problem is the pattern.Fri, 19 Jun 2026 23:53:51 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/mastra-npm-supply-chain-compromise/https://suriq.io/blog/mastra-npm-supply-chain-compromise/Attackers hijacked a dormant maintainer account to poison 140+ Mastra npm packages with a wallet-stealing payload.Fri, 19 Jun 2026 22:55:50 GMTSecurity newsNoam Alumhttps://suriq.io/blog/corewcf-saml-signature-bypass/https://suriq.io/blog/corewcf-saml-signature-bypass/CVE-2026-54782 lets an attacker forge a SAML token and impersonate anyone, admins included, on CoreWCF federation services. No workaround.Fri, 19 Jun 2026 21:55:54 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/quarkus-encoded-path-auth-bypass/https://suriq.io/blog/quarkus-encoded-path-auth-bypass/Quarkus fixed a semicolon authorization bypass in May, but CVE-2026-50559 reopens it with URL-encoded characters. What to patch now and how to detect abuse.Fri, 19 Jun 2026 20:56:09 GMTSecurity newsNoam Alumhttps://suriq.io/blog/dragonforce-teams-relay-c2-backdoor-turn/https://suriq.io/blog/dragonforce-teams-relay-c2-backdoor-turn/DragonForce's Backdoor.Turn routes C2 through Microsoft Teams TURN relays, so network sensors see only Microsoft.Fri, 19 Jun 2026 19:34:51 GMTSecurity newsDeep diveSuriq's Jackhttps://suriq.io/blog/klue-oauth-salesforce-connected-app-breach/https://suriq.io/blog/klue-oauth-salesforce-connected-app-breach/The Icarus group stole Salesforce CRM data through Klue's connected app, not a Salesforce flaw. Why OAuth integration tokens are the unmonitored attack surface.Fri, 19 Jun 2026 14:50:51 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/jetbrains-hub-predictable-recovery-codes/https://suriq.io/blog/jetbrains-hub-predictable-recovery-codes/JetBrains Hub generated predictable 2FA recovery codes (CVE-2026-56141, CVSS 9.8), allowing pre-auth account takeover.Fri, 19 Jun 2026 13:37:56 GMTSecurity newsNoam Alumhttps://suriq.io/blog/perry-jwt-expiration-bypass/https://suriq.io/blog/perry-jwt-expiration-bypass/CVE-2026-53776: Perry's bundled JWT helper hard-codes validate_exp = false, so expired and revoked tokens stay valid. Patch to 0.5.1166 and rotate signing keys.Fri, 19 Jun 2026 10:59:11 GMTSecurity newsNoam Alumhttps://suriq.io/blog/splunk-postgres-sidecar-preauth-rce/https://suriq.io/blog/splunk-postgres-sidecar-preauth-rce/CVE-2026-20253 is an unauthenticated RCE in Splunk Enterprise 10.x via a bundled PostgreSQL sidecar. On CISA KEV, exploited now. Patch to 10.0.7 or 10.2.4.Fri, 19 Jun 2026 07:42:37 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/nginx-critical-rce-config-triage/https://suriq.io/blog/nginx-critical-rce-config-triage/F5's two critical NGINX flaws (CVE-2026-42530, CVE-2026-42055) score 9.2, but RCE needs ASLR off and a non-default config. Here is what to actually triage.Fri, 19 Jun 2026 03:45:04 GMTSecurity newsDeep diveNoam Alumhttps://suriq.io/blog/inc-ransomware-patch-backlog-edge-devices/https://suriq.io/blog/inc-ransomware-patch-backlog-edge-devices/INC reached top-tier RaaS in 2026 with no zero-days. Every edge-device flaw it exploits was patched months earlier. Here is what to actually fix.Thu, 18 Jun 2026 16:56:17 GMTSecurity newsSuriq's Jackhttps://suriq.io/blog/clickfix-shared-delivery-detection/https://suriq.io/blog/clickfix-shared-delivery-detection/Three unrelated crews adopted ClickFix delivery in a single quarter. The lure keeps changing; the execution chain does not. Here is where to detect it.Thu, 18 Jun 2026 12:10:34 GMTSecurity newsNoam Alumhttps://suriq.io/blog/cisco-sd-wan-manager-cve-2026-20262/https://suriq.io/blog/cisco-sd-wan-manager-cve-2026-20262/CVE-2026-20262 is an actively exploited Cisco SD-WAN Manager flaw that escalates a low-privilege login to root.Thu, 18 Jun 2026 08:11:51 GMTSecurity newsDeep diveSuriq's Jackhttps://suriq.io/blog/rogueplanet-defender-system-zero-day/https://suriq.io/blog/rogueplanet-defender-system-zero-day/RoguePlanet (CVE-2026-50656) is a public-exploit privilege escalation in Microsoft Defender's engine.Thu, 18 Jun 2026 05:50:21 GMTSecurity newsNoam Alumhttps://suriq.io/blog/fortibleed-fortinet-no-cve-to-patch/https://suriq.io/blog/fortibleed-fortinet-no-cve-to-patch/FortiBleed exposed working VPN logins for tens of thousands of Fortinet firewalls. There is no CVE to patch; the fix is rotating credentials and enforcing MFA.Wed, 17 Jun 2026 19:12:55 GMTSecurity newsDeep diveSuriq's Jackhttps://suriq.io/blog/jetbrains-plugins-steal-ai-api-keys/https://suriq.io/blog/jetbrains-plugins-steal-ai-api-keys/Aikido found 15 JetBrains Marketplace plugins stealing AI API keys across 70,000 installs.Wed, 17 Jun 2026 15:04:54 GMTSecurity newsNoam Alumhttps://suriq.io/blog/fortisandbox-flaws-actively-exploited/https://suriq.io/blog/fortisandbox-flaws-actively-exploited/Three critical FortiSandbox flaws are under active exploitation, two unauthenticated and one patched a week ago.Wed, 17 Jun 2026 11:08:44 GMTSecurity newsDeep diveSuriq's Jackhttps://suriq.io/blog/joomla-jce-unauthenticated-rce/https://suriq.io/blog/joomla-jce-unauthenticated-rce/Unauthenticated RCE (CVSS 10, CVE-2026-48907) in JCE, the most-installed Joomla editor. KEV-listed and exploited. Patch to 2.9.99.6 and hunt for webshells.Wed, 17 Jun 2026 05:20:51 GMTSecurity newsNoam Alumhttps://suriq.io/blog/sprysocks-windows-kernel-driver/https://suriq.io/blog/sprysocks-windows-kernel-driver/SprySOCKS, a China-nexus Linux backdoor, now ships a Windows kernel-driver variant that hides itself from the host. Here is where defenders can still catch it.Tue, 16 Jun 2026 19:40:47 GMTSecurity newsNoam Alumhttps://suriq.io/blog/litespeed-cpanel-plugin-root-escalation/https://suriq.io/blog/litespeed-cpanel-plugin-root-escalation/CVE-2026-54420 and CVE-2026-48172 let shared-hosting tenants reach root through the LiteSpeed cPanel plugin. Why CageFS isolation failed and what to patch now.Tue, 16 Jun 2026 07:13:38 GMTSecurity newsDeep diveNoam Alumhttps://suriq.io/blog/awesome-motive-wordpress-cdn-backdoor/https://suriq.io/blog/awesome-motive-wordpress-cdn-backdoor/OptinMonster, TrustPulse and PushEngage served a backdoor that ran only for logged-in WordPress admins, evading visitor scanners. How to scope and hunt it.Mon, 15 Jun 2026 20:32:28 GMTSecurity newsNoam Alumhttps://suriq.io/blog/searchleak-copilot-prompt-injection/https://suriq.io/blog/searchleak-copilot-prompt-injection/SearchLeak chained prompt injection, an HTML render race, and Bing SSRF to steal Microsoft 365 Copilot data in one click. What it means for detection.Mon, 15 Jun 2026 19:25:51 GMTSecurity newsNoam Alumhttps://suriq.io/blog/why-suriq-built-on-wazuh/https://suriq.io/blog/why-suriq-built-on-wazuh/Suriq runs on Wazuh because a detection engine is a decade of decoders, CVE feeds, and agents you should never rebuild. Here is the reasoning behind the bet.Mon, 15 Jun 2026 07:42:14 GMTThought leadershipDeep diveSuriq's Jackhttps://suriq.io/blog/ivanti-sentry-patched-still-breached/https://suriq.io/blog/ivanti-sentry-patched-still-breached/Ivanti Sentry CVE-2026-10520 is an unauthenticated root RCE under active attack. CISA's new 3-day patch rule applies; patched gateways were already breached.Sun, 14 Jun 2026 07:06:06 GMTSecurity newsDeep diveSuriq's Jackhttps://suriq.io/blog/peoplesoft-psemhub-zero-day/https://suriq.io/blog/peoplesoft-psemhub-zero-day/CVE-2026-35273 sits in PeopleSoft's Updates Environment Management module. Mandiant ties active exploitation to ShinyHunters, with 100+ orgs already breached.Sat, 13 Jun 2026 18:38:12 GMTSecurity newsDeep diveSuriq's Jackhttps://suriq.io/blog/velvet-ant-auth-stack-blind-spot/https://suriq.io/blog/velvet-ant-auth-stack-blind-spot/Sygnia found nine backdoored pam_unix.so variants and four trojanized OpenSSH binaries on one victim. Why auth-stack integrity is the SIEM-invisible gap.Sat, 13 Jun 2026 17:01:32 GMTSecurity newsDeep diveSuriq's Jack