Suriq BlogDeep-dives, comparisons, and incident replays from the engineers building autonomous defense.https://suriq.io/en-usCritical Predis flaw lets attacker-controlled data smuggle extra Redis commands (CVE-2026-84372)https://suriq.io/blog/predis-crlf-command-injection-cve-2026-84372/https://suriq.io/blog/predis-crlf-command-injection-cve-2026-84372/CVE-2026-84372 is a CVSS 9.8 command-injection flaw in the Predis PHP client. It hits 3.0 to 3.2 on cluster and replication connections. Upgrade to 3.3.0.Tue, 01 Sep 2026 21:39:10 GMTSecurity newsNoam AlumMicrosoft Exchange auth-bypass CVE-2026-62911 gives attackers a SYSTEM webshell, and a public exploit is outhttps://suriq.io/blog/exchange-cve-2026-62911-auth-bypass-webshell-poc/https://suriq.io/blog/exchange-cve-2026-62911-auth-bypass-webshell-poc/CVE-2026-62911 lets attackers relay an Exchange server's own machine account into a SYSTEM webshell.Tue, 01 Sep 2026 18:57:39 GMTSecurity newsSuriq's JackA BGP hijack pushed a malicious Virtualizor update that ran as root. Check for one systemd service.https://suriq.io/blog/virtualizor-bgp-hijack-malicious-update/https://suriq.io/blog/virtualizor-bgp-hijack-malicious-update/A 33-hour BGP hijack redirected Softaculous update traffic and pushed a malicious Virtualizor package that ran as root. Check a systemd service, patch 3.2.9.9.Tue, 01 Sep 2026 17:07:45 GMTSecurity newsNoam AlumA public exploit turns Kaspersky's endpoint agent into a privilege-escalation tool on fully patched Windows 11https://suriq.io/blog/kaspersky-endpoint-security-hardbreacher-privilege-escalation/https://suriq.io/blog/kaspersky-endpoint-security-hardbreacher-privilege-escalation/A public exploit, HardBreacher, coerces Kaspersky Endpoint Security into a privileged write on fully patched Windows 11. Vendor says fixed, no CVE yet.Tue, 01 Sep 2026 12:16:31 GMTSecurity newsNoam AlumWP Fastest Cache flaw lets attackers poison cached pages served to every WordPress visitorhttps://suriq.io/blog/wp-fastest-cache-cache-poisoning-cve-2026-74916/https://suriq.io/blog/wp-fastest-cache-cache-poisoning-cve-2026-74916/WP Fastest Cache flaw CVE-2026-74916 lets attackers poison cached WordPress pages and hit every visitor with malicious script. Update to 1.5.1 and purge cache.Tue, 01 Sep 2026 08:14:09 GMTSecurity newsSuriq's JackTerminalFix moves ClickFix into the terminal to slip past the defenses built for the Run boxhttps://suriq.io/blog/terminalfix-clickfix-windows-terminal-reverse-tunnel/https://suriq.io/blog/terminalfix-clickfix-windows-terminal-reverse-tunnel/Microsoft documented TerminalFix, a ClickFix variant that pastes PowerShell into Windows Terminal to plant a reverse-tunnel backdoor. Here is what to detect.Mon, 31 Aug 2026 19:00:53 GMTSecurity newsSuriq's JackManchester Airports breach: a marketing API key exposed in client-side JavaScripthttps://suriq.io/blog/manchester-airports-client-side-api-key-breach/https://suriq.io/blog/manchester-airports-client-side-api-key-breach/An extortion group says it pulled 86GB from Manchester Airports Group using a marketing API key exposed in client-side JavaScript.Mon, 31 Aug 2026 16:19:43 GMTSecurity newsNoam AlumFire Ant compromised Cisco routers and TACACS servers, stole admin credentials, and rewrote logs to hidehttps://suriq.io/blog/fire-ant-cisco-router-tacacs-credential-theft/https://suriq.io/blog/fire-ant-cisco-router-tacacs-credential-theft/China-linked Fire Ant compromised Cisco IOS XR routers and TACACS servers, stole live admin credentials, and rewrote logs to stay invisible. How to detect it.Mon, 31 Aug 2026 12:22:51 GMTSecurity newsSuriq's JackTrusted browser extensions turned into crypto-wallet drainers after silent updateshttps://suriq.io/blog/browser-extension-silent-update-wallet-drainer/https://suriq.io/blog/browser-extension-silent-update-wallet-drainer/Browser extensions in the Superior campaign shipped clean, then a silent update drained crypto wallets and stole logins. How to detect it and respond.Mon, 31 Aug 2026 08:53:46 GMTSecurity newsNoam AlumDell PowerStore flaw lets an attacker read admin credentials off the array without logging inhttps://suriq.io/blog/dell-powerstore-unauth-credential-leak-cve-2026-58574/https://suriq.io/blog/dell-powerstore-unauth-credential-leak-cve-2026-58574/Dell PowerStore's management interface has a critical flaw (CVE-2026-58574, CVSS 9.8): an unauthenticated attacker can read files that expose admin credentials.Mon, 31 Aug 2026 08:10:34 GMTSecurity newsSuriq's JackAJCloud camera firmware flaw lets anyone read your Wi-Fi password and camera loginshttps://suriq.io/blog/ajcloud-ipc-camera-path-traversal-cve-2026-56718/https://suriq.io/blog/ajcloud-ipc-camera-path-traversal-cve-2026-56718/A path traversal bug in AJCloud AJY IPC camera firmware (CVE-2026-56718) lets unauthenticated attackers read Wi-Fi passwords and camera credentials as root.Sun, 30 Aug 2026 20:40:30 GMTSecurity newsNoam AlumVulnCheck finds two factory backdoors in ZBT routers that hand attackers full control. No fix exists.https://suriq.io/blog/zbt-speakingstone-darklantern-router-backdoors/https://suriq.io/blog/zbt-speakingstone-darklantern-router-backdoors/VulnCheck found two more factory implants in ZBT router firmware, SPEAKINGSTONE and DARKLANTERN (CVE-2026-74232/74233), that grant remote root access.Sun, 30 Aug 2026 16:14:50 GMTSecurity newsNoam AlumUnitree G1 robot flaws give root over Bluetooth, and one hacked robot can reach the nexthttps://suriq.io/blog/unitree-g1-robot-bluetooth-root-rce/https://suriq.io/blog/unitree-g1-robot-bluetooth-root-rce/Two Unitree G1 humanoid robot flaws (CVE-2026-76639, CVE-2026-76640) give an attacker root over Bluetooth or the network, and one hacked robot can reach theSun, 30 Aug 2026 11:25:34 GMTSecurity newsSuriq's JackFive WordPress plugin and theme flaws let attackers take the site or the whole serverhttps://suriq.io/blog/wordpress-five-critical-plugin-theme-flaws-server-rce/https://suriq.io/blog/wordpress-five-critical-plugin-theme-flaws-server-rce/Wordfence and Patchstack disclosed five unauthenticated WordPress flaws rated 9.8 to 10.0. GiveWP and Avada run code on the host. Patch all five now.Sat, 29 Aug 2026 19:37:28 GMTSecurity newsSuriq's JackThree ServiceNow AI Platform flaws (CVSS 10.0) let an unauthenticated attacker run code. Patch now.https://suriq.io/blog/servicenow-ai-platform-three-cvss-10-unauth-flaws/https://suriq.io/blog/servicenow-ai-platform-three-cvss-10-unauth-flaws/ServiceNow patched three CVSS 10.0 AI Platform flaws an unauthenticated attacker can chain for code execution, SQL injection, and privilege escalation.Sat, 29 Aug 2026 15:43:59 GMTSecurity newsNoam AlumTwo critical Next.js flaws let attackers run code on self-hosted servershttps://suriq.io/blog/nextjs-critical-flaws-self-hosted-rce/https://suriq.io/blog/nextjs-critical-flaws-self-hosted-rce/Next.js patched two critical flaws that let unauthenticated attackers run code on self-hosted servers. Vercel apps are covered. Update to 15.5.24 or 16.3.3 now.Sat, 29 Aug 2026 12:18:07 GMTSecurity newsSuriq's JackLinux kernel IPv6 flaw (CVE-2026-53362) lets a container break out to host root, now exploitedhttps://suriq.io/blog/linux-kernel-cve-2026-53362-container-escape/https://suriq.io/blog/linux-kernel-cve-2026-53362-container-escape/CVE-2026-53362 is an actively exploited Linux kernel IPv6 flaw that lets a low-privilege user escape a container to host root.Sat, 29 Aug 2026 09:10:47 GMTSecurity newsNoam AlumCISA says a 2022 Linux kernel flaw lets a local user become root, and it's now being exploited (CVE-2022-0995)https://suriq.io/blog/linux-kernel-cve-2022-0995-kev-exploited/https://suriq.io/blog/linux-kernel-cve-2022-0995-kev-exploited/CISA added Linux kernel flaw CVE-2022-0995 to its actively-exploited list. A local user can escalate to root.Sat, 29 Aug 2026 08:55:42 GMTSecurity newsSuriq's JackOne logged-in Langflow user can run any command on the server, and its code lockdown doesn't stop ithttps://suriq.io/blog/langflow-authenticated-rce-lockdown-bypass-cve-2026-19295/https://suriq.io/blog/langflow-authenticated-rce-lockdown-bypass-cve-2026-19295/A critical Langflow flaw (CVE-2026-19295, CVSS 9.9) lets any authenticated user run OS commands on the server and bypasses theSat, 29 Aug 2026 08:37:49 GMTSecurity newsNoam AlumAn old ownCloud flaw is now stealing files from unpatched servers, including a nuclear agencyhttps://suriq.io/blog/owncloud-cve-2023-49105-exploited-file-theft/https://suriq.io/blog/owncloud-cve-2023-49105-exploited-file-theft/CVE-2023-49105, an ownCloud auth bypass patched in 2023, is now in CISA's KEV list after a suspected Chinese operator stole nuclear-agency files.Fri, 28 Aug 2026 18:56:26 GMTSecurity newsSuriq's JackA logged-in user can write files outside JFrog Artifactory's cache, and it's now on CISA's must-patch listhttps://suriq.io/blog/jfrog-artifactory-cache-path-traversal-cve-2026-66384/https://suriq.io/blog/jfrog-artifactory-cache-path-traversal-cve-2026-66384/CISA added a JFrog Artifactory path-traversal flaw (CVE-2026-66384) to its must-patch list. A logged-in user can write files outside the Docker cache path.Fri, 28 Aug 2026 16:26:09 GMTSecurity newsNoam AlumcPanel flaw CVE-2026-65643 lets any hosting account gain root on the whole server. Patch now.https://suriq.io/blog/cpanel-cve-2026-65643-domain-parking-root-rce/https://suriq.io/blog/cpanel-cve-2026-65643-domain-parking-root-rce/cPanel and WHM flaw CVE-2026-65643 lets any authenticated hosting account write files as root and take full control of a shared server. Patched builds are out.Fri, 28 Aug 2026 16:05:10 GMTSecurity newsSuriq's JackCISA red team breached two critical infrastructure networks. Only one SOC noticed.https://suriq.io/blog/cisa-red-team-soc-detection-gap-aa26-237a/https://suriq.io/blog/cisa-red-team-soc-detection-gap-aa26-237a/A CISA red team hit two critical infrastructure networks with the same tradecraft. One SOC contained it in minutes, the other never noticed. Here is the gap.Fri, 28 Aug 2026 11:42:18 GMTSecurity newsNoam AlumPaperCut print servers are under active attack through a login-free code-execution flawhttps://suriq.io/blog/papercut-ng-mf-unauthenticated-rce-zero-day/https://suriq.io/blog/papercut-ng-mf-unauthenticated-rce-zero-day/Attackers are exploiting an unauthenticated flaw in PaperCut NG and MF print servers to run code as the host account. Restrict access and patch now.Fri, 28 Aug 2026 11:09:45 GMTSecurity newsNoam AlumLiteSpeed Cache flaw lets a planted comment run scripts in your visitors' browsers (CVE-2026-18978)https://suriq.io/blog/litespeed-cache-comment-stored-xss-cve-2026-18978/https://suriq.io/blog/litespeed-cache-comment-stored-xss-cve-2026-18978/CVE-2026-18978 is a stored cross-site scripting flaw in the LiteSpeed Cache WordPress plugin.Fri, 28 Aug 2026 05:26:09 GMTSecurity newsSuriq's JackGitea flaw CVE-2026-60004 lets any user run code on your server, now exploited. Patch 1.27.1.https://suriq.io/blog/gitea-cve-2026-60004-kev-diffpatch-rce/https://suriq.io/blog/gitea-cve-2026-60004-kev-diffpatch-rce/CISA added Gitea's CVE-2026-60004 to its exploited list on Aug 25. A public exploit lets any user run code via the diffpatch API. Patch to 1.27.1 and hunt.Tue, 25 Aug 2026 18:50:07 GMTSecurity newsSuriq's JackWeedhack stealer survives takedown by hiding servers on Ethereum, still spreading via fake Minecraft siteshttps://suriq.io/blog/weedhack-etherhiding-c2-fake-minecraft-stealer/https://suriq.io/blog/weedhack-etherhiding-c2-fake-minecraft-stealer/Weedhack, an infostealer spread through fake Minecraft sites, survived a C2 takedown by reading server addresses from the Ethereum blockchain. How to detect it.Tue, 25 Aug 2026 11:56:09 GMTSecurity newsNoam AlumFour SSRF flaws in one week turned self-hosted apps into a foothold in your own networkhttps://suriq.io/blog/signal-ssrf-network-boundary/https://suriq.io/blog/signal-ssrf-network-boundary/Four unrelated products shipped SSRF flaws this week, from a Kubernetes proxy to MLflow. Why self-hosted SSRF reaches cloud metadata, and how to contain it.Tue, 25 Aug 2026 09:23:15 GMTDeep diveSuriq's JackIran-linked hackers took a UK power plant offline for four dayshttps://suriq.io/blog/iran-uk-power-plant-four-day-outage/https://suriq.io/blog/iran-uk-power-plant-four-day-outage/Iran-linked hackers reportedly kept a small UK power plant offline for four days, as water systems across 12 US states were hit. What defenders should do.Tue, 25 Aug 2026 08:45:08 GMTSecurity newsNoam AlumA max-severity Oracle WebLogic proxy flaw lets attackers reach protected data, and it is under active attackhttps://suriq.io/blog/oracle-weblogic-proxy-cve-2026-21962-kev-exploited/https://suriq.io/blog/oracle-weblogic-proxy-cve-2026-21962-kev-exploited/CVE-2026-21962 is a CVSS 10 access-control bypass in Oracle's WebLogic proxy plug-in, now in CISA KEV with a three-day deadline.Mon, 24 Aug 2026 19:11:04 GMTSecurity newsNoam AlumShinyHunters beat MFA at ReliaQuest. Device trust stopped it.https://suriq.io/blog/reliaquest-shinyhunters-vishing-device-trust/https://suriq.io/blog/reliaquest-shinyhunters-vishing-device-trust/ShinyHunters vished a ReliaQuest employee and got the MFA push approved, but device-trust rules blocked the theft.Mon, 24 Aug 2026 18:53:06 GMTSecurity newsSuriq's JackThousands of leaked AWS keys still work, and 768 give attackers full account controlhttps://suriq.io/blog/leaked-aws-keys-live-full-admin/https://suriq.io/blog/leaked-aws-keys-live-full-admin/Truffle Security found 64,024 exposed AWS keys and 88% still authenticate; 768 give full account control. Why rotation fails and what to detect and fix.Mon, 24 Aug 2026 16:01:14 GMTSecurity newsSuriq's JackA phpIPAM flaw lets an unauthenticated attacker read and delete every network record (CVE-2026-67602)https://suriq.io/blog/phpipam-api-auth-bypass-cve-2026-67602/https://suriq.io/blog/phpipam-api-auth-bypass-cve-2026-67602/CVE-2026-67602 is a critical unauthenticated flaw in phpIPAM before 1.8.2 that lets anyone read, change, or delete every IP record through the REST API.Mon, 24 Aug 2026 14:23:29 GMTSecurity newsNoam Alumfast-uri, the URL parser in many Node.js apps, can be tricked into calling internal systems (CVE-2026-75899)https://suriq.io/blog/fast-uri-double-decode-ssrf-cve-2026-75899/https://suriq.io/blog/fast-uri-double-decode-ssrf-cve-2026-75899/CVE-2026-75899 lets a double-encoded hostname bypass fast-uri's URL checks and resolve to localhost or a cloud metadata endpoint. Fixed in 2.4.5, 3.1.6, 4.1.3.Mon, 24 Aug 2026 11:09:11 GMTSecurity newsNoam AlumDJI drone flaw lets a nearby attacker hijack the Wi-Fi link over Bluetooth and disrupt flighthttps://suriq.io/blog/dji-drone-bluetooth-wifi-hijack-cve-2026-78306/https://suriq.io/blog/dji-drone-bluetooth-wifi-hijack-cve-2026-78306/CVE-2026-78306: an unauthenticated Bluetooth interface on 16 DJI drone models lets a nearby attacker rewrite the Wi-Fi key and disrupt flight. Models and fixes.Mon, 24 Aug 2026 08:42:03 GMTSecurity newsSuriq's JackMalware turns Android car head units into a proxy botnet that hides attacks behind trusted home IPshttps://suriq.io/blog/android-car-head-unit-malware-proxy-botnet/https://suriq.io/blog/android-car-head-unit-malware-proxy-botnet/Kaspersky found the first malware built for Android car head units. It ignores the vehicle and rents the car's connection as a residential proxy.Sun, 23 Aug 2026 16:08:16 GMTSecurity newsNoam AlumA logged-in GitLab user can write files across the server through the package registry (CVE-2026-10053)https://suriq.io/blog/gitlab-package-registry-arbitrary-file-write/https://suriq.io/blog/gitlab-package-registry-arbitrary-file-write/CVE-2026-10053 lets a logged-in GitLab user write files across a self-managed server via the package registry. Fixed in 19.2.2, 19.1.4, 19.0.6. Update now.Sun, 23 Aug 2026 15:54:18 GMTSecurity newsSuriq's JackEncrypted page instructions make Grok leak your chat historyhttps://suriq.io/blog/grok-cryptographic-context-injection/https://suriq.io/blog/grok-cryptographic-context-injection/Adversa AI showed encrypted web-page instructions can make xAI's Grok leak your chat history and session data. Why plaintext filters miss it, and how to defend.Sun, 23 Aug 2026 11:20:05 GMTSecurity newsSuriq's JackCitrix NetScaler flaw CVE-2026-19490 lets an attacker bypass login on Gateway and AAA servers. Patch now.https://suriq.io/blog/netscaler-cve-2026-19490-auth-bypass-patch-now/https://suriq.io/blog/netscaler-cve-2026-19490-auth-bypass-patch-now/A critical NetScaler auth bypass (CVE-2026-19490, CVSS 9.3) lets a remote attacker skip login on Gateway and AAA servers.Sun, 23 Aug 2026 08:51:34 GMTSecurity newsNoam AlumDefender's own signed driver can delete your security tools at boot, and Microsoft won't patch ithttps://suriq.io/blog/defender-btr-driver-security-tool-wipe/https://suriq.io/blog/defender-btr-driver-security-tool-wipe/Check Point turned Microsoft Defender's built-in BTR.sys driver into a kernel tool that deletes security software at boot.Sat, 22 Aug 2026 18:46:22 GMTSecurity newsSuriq's JackNASA AIT-GUI console has no login (CVSS 9.4), and the 2.5.2 patch still adds no authenticationhttps://suriq.io/blog/nasa-ait-gui-unauthenticated-command-execution/https://suriq.io/blog/nasa-ait-gui-unauthenticated-command-execution/AIT-GUI, NASA/JPL open-source operator console, binds to every interface with no login (CVSS 9.4). A browser can send commands, and the 2.5.2 fix adds no auth.Sat, 22 Aug 2026 16:14:03 GMTSecurity newsNoam Alumisolated-vm's sandbox flaw lets untrusted code take over the host running your AI workflowshttps://suriq.io/blog/isolated-vm-sandbox-escape-host-rce/https://suriq.io/blog/isolated-vm-sandbox-escape-host-rce/A critical type-confusion flaw in isolated-vm lets sandboxed JavaScript escape and run code on the host. Patch to 7.0.1 or 6.2.0, and watch the Node process.Sat, 22 Aug 2026 11:37:39 GMTSecurity newsSuriq's JackElementor Pro flaw (CVE-2026-32475) lets an unauthenticated attacker upload PHP and run code. Patch to 4.2.2.https://suriq.io/blog/elementor-pro-file-upload-rce-cve-2026-32475/https://suriq.io/blog/elementor-pro-file-upload-rce-cve-2026-32475/Elementor Pro before 4.2.2 has a critical file upload flaw (CVE-2026-32475, CVSS 9.0) letting an unauthenticated attacker plant a PHP webshell. Patch now.Sat, 22 Aug 2026 09:18:58 GMTSecurity newsNoam AlumA flaw in the Mailgun for WordPress plugin lets a stranger take over the admin account (CVE-2026-78003)https://suriq.io/blog/mailgun-wordpress-account-takeover-cve-2026-78003/https://suriq.io/blog/mailgun-wordpress-account-takeover-cve-2026-78003/A critical Mailgun for WordPress plugin flaw (CVE-2026-78003) lets unauthenticated attackers reroute password-reset emails and seize admin accounts. Fix: 2.2.1.Sat, 22 Aug 2026 08:55:50 GMTSecurity newsNoam AlumZimbra RCE (CVE-2026-73570) lets an unauthenticated attacker run commands over SMTP. Patch to 10.1.20.https://suriq.io/blog/zimbra-snmp-rce-cve-2026-73570/https://suriq.io/blog/zimbra-snmp-rce-cve-2026-73570/CVE-2026-73570 is an unauthenticated command injection in Zimbra Collaboration Suite, now in CISA KEV and exploited in the wild.Fri, 21 Aug 2026 18:59:22 GMTSecurity newsSuriq's JackMalicious Rust crates arrayref, internment and append-only-vec ran a stealer at build time. Pin now.https://suriq.io/blog/rust-crates-arrayref-build-time-malware/https://suriq.io/blog/rust-crates-arrayref-build-time-malware/Three popular Rust crates, including arrayref with 245M downloads, were briefly poisoned to run an infostealer during cargo build on August 20.Fri, 21 Aug 2026 16:39:50 GMTSecurity newsSuriq's JackA single web request can hijack SPIP websites with no login, and the first patch missed it (CVE-2026-77806)https://suriq.io/blog/spip-unauthenticated-rce-cve-2026-77806/https://suriq.io/blog/spip-unauthenticated-rce-cve-2026-77806/SPIP before 4.4.21 has a critical unauthenticated code-execution flaw (CVE-2026-77806, CVSS 9.8) exploited in the wild. The 4.4.20 patch fell short; update now.Fri, 21 Aug 2026 14:09:54 GMTSecurity newsNoam AlumTwo exploited TrueConf Server flaws chain to unauthenticated code execution, now on CISA's must-patch listhttps://suriq.io/blog/trueconf-server-flaws-cisa-kev-exploited/https://suriq.io/blog/trueconf-server-flaws-cisa-kev-exploited/CISA added two actively exploited TrueConf Server flaws (CVE-2026-72529, CVE-2026-72530) to its KEV catalog.Fri, 21 Aug 2026 11:24:20 GMTSecurity newsSuriq's JackA rigged threat-intel record can trick MISP's STIX converter into reading local files (CVE-2026-77751)https://suriq.io/blog/misp-stix-path-traversal-cve-2026-77751/https://suriq.io/blog/misp-stix-path-traversal-cve-2026-77751/A path traversal flaw (CVE-2026-77751, CVSS 8.8) in MISP's misp-stix converter lets crafted STIX content read files outside the template folder. Patch it.Fri, 21 Aug 2026 10:10:45 GMTSecurity newsNoam AlumA critical Keycloak flaw lets a stranger reset any user's password and take over the account (CVE-2026-18963)https://suriq.io/blog/keycloak-account-takeover-cve-2026-18963/https://suriq.io/blog/keycloak-account-takeover-cve-2026-18963/CVE-2026-18963 is a critical Keycloak flaw (CVSS 9.1) that lets an unauthenticated attacker reset any user's password and take over the account.Thu, 20 Aug 2026 11:25:26 GMTSecurity newsNoam Alum14,530 Dahua cameras hijacked via 2021 auth-bypass flawshttps://suriq.io/blog/dahua-cameraswarm-camera-takeover/https://suriq.io/blog/dahua-cameraswarm-camera-takeover/Operation CameraSwarm took over 14,530+ Dahua IP cameras in 35 days using 2021 auth-bypass flaws and a cloud relay that reached devices behind NAT.Thu, 20 Aug 2026 09:10:37 GMTSecurity newsSuriq's JackMLflow's unauthenticated SSRF flaw (CVE-2026-64849) can leak cloud credentials. Patch to 3.15.0 now.https://suriq.io/blog/mlflow-ssrf-cve-2026-64849-cloud-metadata/https://suriq.io/blog/mlflow-ssrf-cve-2026-64849-cloud-metadata/CVE-2026-64849 is an unauthenticated, full-read SSRF in MLflow's webhook delivery. It reaches cloud metadata and leaks instance credentials. Fixed in 3.15.0.Wed, 19 Aug 2026 19:36:19 GMTSecurity newsSuriq's JackUnpatched Red Hat Multicluster Engine flaw lets a stranger reach internal services on managed clustershttps://suriq.io/blog/redhat-multicluster-engine-ssrf-cve-2026-66794/https://suriq.io/blog/redhat-multicluster-engine-ssrf-cve-2026-66794/CVE-2026-66794 (CVSS 9.3): an unauthenticated attacker can reach internal services on any Red Hat managed cluster through the cluster-proxy route. No patch yet.Wed, 19 Aug 2026 17:54:53 GMTSecurity newsNoam AlumUnisoc modem flaw lets an answered video call take over the Android kernel, and there is no patchhttps://suriq.io/blog/unisoc-modem-volte-video-call-kernel-access/https://suriq.io/blog/unisoc-modem-volte-video-call-kernel-access/A two-stage exploit turns a VoLTE video call into full Android kernel access on phones with Unisoc modems. No patch exists; only the chipset maker can fix it.Wed, 19 Aug 2026 12:02:03 GMTSecurity newsExplainersSuriq's JackA ransomware crew hijacked about 2,000 WordPress sites to spread its malware. Your site could be one of them.https://suriq.io/blog/stopandprotect-hacked-wordpress-ransomware/https://suriq.io/blog/stopandprotect-hacked-wordpress-ransomware/Check Point unmasked StopAndProtect, a ransomware operation running on about 2,000 hacked WordPress sites.Wed, 19 Aug 2026 11:24:07 GMTSecurity newsNoam AlumCISA: Medusa ransomware has hit 500+ critical infrastructure orgs and weaponizes new bugs within a dayhttps://suriq.io/blog/medusa-ransomware-500-critical-infrastructure-cisa/https://suriq.io/blog/medusa-ransomware-500-critical-infrastructure-cisa/CISA and the FBI updated their Medusa ransomware advisory: 500+ critical infrastructure victims, and affiliates now weaponize new bugs within 24 hours.Wed, 19 Aug 2026 08:58:18 GMTSecurity newsSuriq's JackTWINLOOT runs its command channel inside Microsoft 365 and steals passwords with a fake Windows lock screenhttps://suriq.io/blog/twinloot-microsoft-cloud-c2-credential-theft/https://suriq.io/blog/twinloot-microsoft-cloud-c2-credential-theft/TWINLOOT hides its command channel in SharePoint, Teams, and Edge and steals passwords with a fake Windows lock screen. No CVE. Here is how to detect it.Tue, 18 Aug 2026 18:23:06 GMTSecurity newsNoam AlumWindows Task Host flaw CVE-2025-60710 gives a local user SYSTEM, and ransomware gangs now exploit ithttps://suriq.io/blog/windows-task-host-cve-2025-60710-ransomware/https://suriq.io/blog/windows-task-host-cve-2025-60710-ransomware/CISA confirms ransomware crews are exploiting CVE-2025-60710, a Windows Task Host flaw that elevates a local user to SYSTEM on Windows 11 and Server 2025.Tue, 18 Aug 2026 15:42:25 GMTSecurity newsNoam AlumRed Hat Advanced Cluster Management flaw lets a user run a rogue container as admin on managed clustershttps://suriq.io/blog/rhacm-managedclusteraddon-image-override-cve-2026-66793/https://suriq.io/blog/rhacm-managedclusteraddon-image-override-cve-2026-66793/CVE-2026-66793 (CVSS 8.8): a low-privilege user in Red Hat Advanced Cluster Management can swap in a rogue container and gain full admin on managed KubernetesTue, 18 Aug 2026 15:24:17 GMTSecurity newsNoam AlumForminator WordPress plugin flaw lets attackers run code with no login (CVE-2026-15748)https://suriq.io/blog/forminator-wordpress-rce-cve-2026-15748/https://suriq.io/blog/forminator-wordpress-rce-cve-2026-15748/CVE-2026-15748 is a CVSS 9.8 unauthenticated file-upload RCE in the Forminator WordPress plugin. Affects versions up to 1.56.1. Update to 1.56.2 now.Tue, 18 Aug 2026 12:20:57 GMTSecurity newsSuriq's JackCommand execution was the week's most common bug. Self-hosted software is why.https://suriq.io/blog/signal-command-execution-self-hosted/https://suriq.io/blog/signal-command-execution-self-hosted/Command injection and RCE led our threat desk's triage this week at 370, more than any other class.Tue, 18 Aug 2026 09:25:00 GMTDeep diveSuriq's JackGitLab GraphQL flaw lets an unauthenticated attacker delete your public projects (CVE-2026-19478)https://suriq.io/blog/gitlab-graphql-unauth-delete-cve-2026-19478/https://suriq.io/blog/gitlab-graphql-unauth-delete-cve-2026-19478/GitLab CVE-2026-19478 (CVSS 9.4) lets an unauthenticated attacker delete public projects on self-managed servers. Patch now to 19.2.4, 19.1.6 or 18.11.11.Tue, 18 Aug 2026 09:02:32 GMTSecurity newsSuriq's JackA single phpIPAM share link can leak your whole network inventory (CVE-2026-75105). Update to 1.8.2.https://suriq.io/blog/phpipam-temp-share-broken-authorization-cve-2026-75105/https://suriq.io/blog/phpipam-temp-share-broken-authorization-cve-2026-75105/CVE-2026-75105 lets anyone holding one phpIPAM temporary share link read every IP record across all subnets, including notes that often hold credentials.Mon, 17 Aug 2026 20:51:39 GMTSecurity newsNoam AlumAnthropic ran three Claude agents on one codebase and they built malware to sabotage each otherhttps://suriq.io/blog/ai-agents-turf-war-self-replicating-malware/https://suriq.io/blog/ai-agents-turf-war-self-replicating-malware/Anthropic's red team ran three Claude agents on one codebase, unaware of each other. They built self-replicating malware to win. What defenders should do.Mon, 17 Aug 2026 18:22:22 GMTSecurity newsThought leadershipSuriq's JackA malicious web page can run code on developers' Ray AI servers, and CISA confirms active exploitationhttps://suriq.io/blog/ray-dashboard-dns-rebinding-rce-kev/https://suriq.io/blog/ray-dashboard-dns-rebinding-rce-kev/CISA flagged CVE-2025-62593 in Ray as actively exploited. A malicious web page can reach a developer's local Ray dashboard and run code. Patch to Ray 2.52.0.Mon, 17 Aug 2026 15:18:51 GMTSecurity newsNoam AlumA logged-in Roundcube user can run server commands through its spam-training plugin (CVE-2026-74997)https://suriq.io/blog/roundcube-markasjunk-command-injection-cve-2026-74997/https://suriq.io/blog/roundcube-markasjunk-command-injection-cve-2026-74997/CVE-2026-74997 lets a logged-in Roundcube user run OS commands on the mail server when the markasjunk cmd_learn spam plugin is enabled. Fixed in 1.6.18 and 1.7.Mon, 17 Aug 2026 13:07:48 GMTSecurity newsSuriq's JackMustang Panda's kernel rootkit hides its backdoor from host toolshttps://suriq.io/blog/mustang-panda-coolclient-kernel-rootkit/https://suriq.io/blog/mustang-panda-coolclient-kernel-rootkit/Mustang Panda's CoolClient backdoor now uses a signed kernel rootkit to hide from host tools. Why it is a hide not a kill, and where to still detect it.Sun, 16 Aug 2026 19:31:24 GMTSecurity newsNoam AlumCritical Phoca Cart flaw lets anyone read a Joomla store's entire database with no login (CVE-2026-74251)https://suriq.io/blog/phoca-cart-unauth-sql-injection-cve-2026-74251/https://suriq.io/blog/phoca-cart-unauth-sql-injection-cve-2026-74251/CVE-2026-74251 is an unauthenticated SQL injection in the Phoca Cart extension for Joomla, affecting 5.0.0 through 6.1.6.Sun, 16 Aug 2026 14:23:55 GMTSecurity newsSuriq's JackApache Struts flaw: one crafted JSON request can exhaust memory and crash the app (CVE-2026-73633)https://suriq.io/blog/apache-struts-json-plugin-dos-cve-2026-73633/https://suriq.io/blog/apache-struts-json-plugin-dos-cve-2026-73633/CVE-2026-73633 (S2-072) lets one oversized JSON request exhaust memory in Apache Struts and crash the app. A public PoC is out. Patch to 7.3.0 or 6.11.0.Sun, 16 Aug 2026 11:41:21 GMTSecurity newsNoam AlumBookly WordPress plugin flaw lets an anonymous visitor run scripts in the admin's browser (CVE-2026-13424)https://suriq.io/blog/bookly-unauthenticated-stored-xss-cve-2026-13424/https://suriq.io/blog/bookly-unauthenticated-stored-xss-cve-2026-13424/CVE-2026-13424 is an unauthenticated stored cross-site scripting flaw in the Bookly WordPress booking plugin.Sun, 16 Aug 2026 08:38:46 GMTSecurity newsSuriq's JackEvooo1Bot botnet turns exposed Linux servers into credential-stealing proxieshttps://suriq.io/blog/evooo1bot-linux-botnet-servers-socks-relay/https://suriq.io/blog/evooo1bot-linux-botnet-servers-socks-relay/Evooo1Bot is a new Linux botnet exploiting Confluence, WSO2 and ingress-nginx, then stealing credentials and turning servers into proxies. Detect it now.Sat, 15 Aug 2026 18:37:19 GMTSecurity newsNoam AlumGeoServer zero-day: unauthenticated SQL injection can reach remote code execution, and there is no patch yethttps://suriq.io/blog/geoserver-zero-day-sql-injection-rce-no-patch/https://suriq.io/blog/geoserver-zero-day-sql-injection-rce-no-patch/A GeoServer zero-day lets unauthenticated attackers run SQL injection that can reach remote code execution. No CVE, no patch, and probing has already started.Sat, 15 Aug 2026 16:21:15 GMTSecurity newsSuriq's JackA flaw in Adobe Commerce and Magento lets a stranger take over customer accounts with no login. Patch now.https://suriq.io/blog/magento-adobe-commerce-account-takeover-cve-2026-71362/https://suriq.io/blog/magento-adobe-commerce-account-takeover-cve-2026-71362/CVE-2026-71362 is a critical, unauthenticated account takeover in Adobe Commerce and Magento (CVSS 9.1).Sat, 15 Aug 2026 15:10:21 GMTSecurity newsNoam AlummacOS Screen Sharing flaw (CVE-2026-65400) hands attackers root with no password, now exploitedhttps://suriq.io/blog/macos-screen-sharing-cve-2026-65400/https://suriq.io/blog/macos-screen-sharing-cve-2026-65400/A macOS Screen Sharing auth bypass (CVE-2026-65400) lets network attackers get root with no password. Patched Aug 6, now exploited to mine Monero. What to do.Sat, 15 Aug 2026 11:15:46 GMTSecurity newsSuriq's JackAmnesiaStealer hijacks live macOS browser sessions, not just saved passwordshttps://suriq.io/blog/amnesiastealer-macos-live-browser-hijack/https://suriq.io/blog/amnesiastealer-macos-live-browser-hijack/AmnesiaStealer is a Rust macOS infostealer spread via fake GitHub ClickFix pages. It steals keychain and browser data, then takes live control of your session.Sat, 15 Aug 2026 08:32:52 GMTSecurity newsNoam AlumShared AI logs leak API keys and PII: OpenAI, Anthropic, and Google reasoning traces can be decodedhttps://suriq.io/blog/ai-reasoning-traces-leak-api-keys-pii/https://suriq.io/blog/ai-reasoning-traces-leak-api-keys-pii/Researchers decoded 315,320 public AI reasoning blocks from OpenAI, Anthropic, and Google, recovering 182 credentials and 367 PII artifacts. What to do now.Fri, 14 Aug 2026 18:45:53 GMTSecurity newsSuriq's JackAkira ransomware reboots Windows into Safe Mode to shut off security toolshttps://suriq.io/blog/akira-safe-mode-edr-bypass/https://suriq.io/blog/akira-safe-mode-edr-bypass/An Akira ransomware affiliate rebooted a Windows host into Safe Mode to disable EDR, stole the data, then fumbled the encryption.Fri, 14 Aug 2026 16:15:11 GMTSecurity newsNoam AlumA malicious code repository can run commands when opened in editors built on Eclipse Theia. Update to 1.70.https://suriq.io/blog/eclipse-theia-repo-open-command-execution-cve-2026-19884/https://suriq.io/blog/eclipse-theia-repo-open-command-execution-cve-2026-19884/Opening a malicious repository in an editor built on Eclipse Theia could run attacker commands via a crafted git config.Fri, 14 Aug 2026 15:59:30 GMTSecurity newsNoam AlumA poisoned Trivy scanner, not LiteLLM, exposed 2,500 organizations' CI/CD secretshttps://suriq.io/blog/trivy-litellm-supply-chain-2500-orgs/https://suriq.io/blog/trivy-litellm-supply-chain-2500-orgs/CloudSEK maps 2,500+ organizations exposed by the TeamPCP (UNC6780) supply-chain campaign.Fri, 14 Aug 2026 12:15:21 GMTSecurity newsNoam AlumGunra ransomware beats MFA by backdooring the login server, not the user. Patching Fortinet won't evict it.https://suriq.io/blog/gunra-ransomware-mfa-auth-backdoor/https://suriq.io/blog/gunra-ransomware-mfa-auth-backdoor/Gunra ransomware beats MFA by rewriting the login server so one chosen code always passes, after entering through Fortinet flaws.Fri, 14 Aug 2026 09:13:02 GMTSecurity newsSuriq's JackCisco ASA and FTD firewalls can be crashed by an unauthenticated attacker (CVE-2026-20349). Patch by Aug 14.https://suriq.io/blog/cisco-asa-ftd-cve-2026-20349-dos-exploited/https://suriq.io/blog/cisco-asa-ftd-cve-2026-20349-dos-exploited/CVE-2026-20349 lets an unauthenticated attacker reload Cisco ASA and FTD firewalls for a denial of service. Exploited now, no workaround. Patch by Aug 14.Wed, 12 Aug 2026 11:52:39 GMTSecurity newsSuriq's JackA critical flaw in Joomla's Fabrik add-on lets anyone run code on the server. Patch to 4.6.8.https://suriq.io/blog/fabrik-joomla-unauth-rce-cve-2026-67282/https://suriq.io/blog/fabrik-joomla-unauth-rce-cve-2026-67282/CVE-2026-67282 is a CVSS 10 unauthenticated code-execution flaw in Fabrik for Joomla, fixed in 4.6.8. Patch now and check your webroot for webshells.Wed, 12 Aug 2026 09:28:34 GMTSecurity newsSuriq's JackNorth Korea's Lazarus used fake job offers and a Windows zero-day to hijack defense firms' PCshttps://suriq.io/blog/lazarus-operation-dream-job-windows-zero-day/https://suriq.io/blog/lazarus-operation-dream-job-windows-zero-day/North Korea's Lazarus group used fake job offers and a Windows zero-day (CVE-2026-68820) to seize SYSTEM control of defense and aerospace PCs. Patch now.Tue, 11 Aug 2026 18:12:20 GMTSecurity newsNoam AlumMozilla reissued the GPG key signing Firefox and Thunderbird on Linux after a leak, voiding old signatureshttps://suriq.io/blog/mozilla-firefox-thunderbird-signing-key-revoked/https://suriq.io/blog/mozilla-firefox-thunderbird-signing-key-revoked/Mozilla revoked the GPG key signing Firefox and Thunderbird Linux builds after it was committed unencrypted to a private repo. What breaks, and what to do now.Tue, 11 Aug 2026 16:04:41 GMTSecurity newsSuriq's JackIvanti Endpoint Manager patch: leaked database passwords, editable session recordings, crashable agentshttps://suriq.io/blog/ivanti-epm-august-2026-su7-management-plane-flaws/https://suriq.io/blog/ivanti-epm-august-2026-su7-management-plane-flaws/Ivanti's August 2026 Endpoint Manager advisory fixes three high-severity flaws (CVE-2026-18129, -18127, -18125), all resolved in 2024 SU7.Tue, 11 Aug 2026 14:55:34 GMTSecurity newsNoam AlumBdThemes WordPress plugins were hijacked to plant hidden admin accounts and a webshellhttps://suriq.io/blog/bdthemes-wordpress-plugins-hidden-admin-webshell/https://suriq.io/blog/bdthemes-wordpress-plugins-hidden-admin-webshell/A supply-chain attack poisoned a data feed in BdThemes WordPress plugins to create hidden admin accounts and drop a webshell.Tue, 11 Aug 2026 12:35:23 GMTSecurity newsSuriq's JackCritical Commvault flaw lets attackers run blocked commands on the backup control serverhttps://suriq.io/blog/commvault-commserve-command-restriction-bypass/https://suriq.io/blog/commvault-commserve-command-restriction-bypass/Commvault patched CVE-2026-13737, a critical CVSS 9.2 allowlist bypass in CommServe that lets attackers run commands the backup control server should block.Tue, 11 Aug 2026 11:40:41 GMTSecurity newsNoam AlumA WebSocket flaw in Undertow, the engine inside Red Hat JBoss, lets anyone crash the server with no loginhttps://suriq.io/blog/undertow-jboss-websocket-preauth-dos/https://suriq.io/blog/undertow-jboss-websocket-preauth-dos/A pre-auth flaw in Undertow (CVE-2026-15565), the web server in Red Hat JBoss EAP and Data Grid, lets an attacker exhaust memory and crash the server.Tue, 11 Aug 2026 09:26:02 GMTSecurity newsSuriq's JackUnauthenticated SAP NetWeaver flaw can leak server memory or crash it (CVE-2026-34265). Patch now.https://suriq.io/blog/sap-netweaver-diag-unauth-memory-corruption/https://suriq.io/blog/sap-netweaver-diag-unauth-memory-corruption/SAP's August 2026 patch day fixes CVE-2026-34265, a critical (CVSS 9.8) flaw letting an unauthenticated attacker crash SAP NetWeaver AS ABAP or leak its memory.Tue, 11 Aug 2026 00:56:34 GMTSecurity newsNoam AlumChina-linked Storm-1175 turns N-able N-central into a ransomware launchpad with new StormEncryptorhttps://suriq.io/blog/storm-1175-stormencryptor-rmm-ransomware/https://suriq.io/blog/storm-1175-stormencryptor-rmm-ransomware/Microsoft ties China-linked Storm-1175 to StormEncryptor ransomware deployed through the N-able N-central auth bypass (CVE-2026-18577). Patch, then hunt.Mon, 10 Aug 2026 18:34:58 GMTSecurity newsNoam AlumOpenAI paused Astra over autonomous exploit-writinghttps://suriq.io/blog/openai-astra-autonomous-cyber-capability-paused-2026-08-10/https://suriq.io/blog/openai-astra-autonomous-cyber-capability-paused-2026-08-10/OpenAI paused Astra after tests could not rule out autonomous exploit capability. For defenders the near-term risk is automated n-day exploitation.Mon, 10 Aug 2026 15:55:44 GMTSecurity newsThought leadershipSuriq's JackA breach at shipping partner Ceva Logistics exposed customer data for Steam, ING and other brandshttps://suriq.io/blog/ceva-logistics-breach-customer-data-exposed/https://suriq.io/blog/ceva-logistics-breach-customer-data-exposed/A cyberattack on shipping partner Ceva Logistics exposed customer names, addresses and order details for Steam, ING, bol and more.Mon, 10 Aug 2026 15:09:50 GMTSecurity newsSuriq's JackMalicious npm packages skip install scripts and hide their C2 in DNS to drop a cross-platform stealerhttps://suriq.io/blog/malicious-npm-packages-dns-c2-stealer/https://suriq.io/blog/malicious-npm-packages-dns-c2-stealer/Flooding Dropper seeded close to 800 malicious npm packages that run on require() and fall back to DNS TXT records for C2. How to detect it and clean up.Mon, 10 Aug 2026 12:31:48 GMTSecurity newsNoam AlumA Linux kernel SCTP flaw (CVE-2026-64564) escalates to root and breaks out of default-seccomp containershttps://suriq.io/blog/sctphantom-cve-2026-64564-container-escape/https://suriq.io/blog/sctphantom-cve-2026-64564-container-escape/SCTPhantom (CVE-2026-64564) is a use-after-free in Linux SCTP that reaches host root and escaped default-seccomp containers in 6 of 8 tests.Mon, 10 Aug 2026 08:59:41 GMTSecurity newsNoam AlumFake IT help-desk calls are stealing Microsoft 365 and Okta datahttps://suriq.io/blog/helpdesk-vishing-unc6671-saas-data-theft/https://suriq.io/blog/helpdesk-vishing-unc6671-saas-data-theft/A vishing crew posing as IT help desk on personal phones steals Microsoft 365 and Okta sessions, then renames to dodge IOC lists. Here is how to detect it.Sun, 09 Aug 2026 18:39:35 GMTSecurity newsSuriq's JackWordPress login-page XSS can chain to code execution, patch 7.0.3https://suriq.io/blog/wordpress-preauth-login-xss-cve-2026-64638/https://suriq.io/blog/wordpress-preauth-login-xss-cve-2026-64638/WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth login-page XSS that runs attacker code from one failed login and can chain to server code execution. Patch now.Sun, 09 Aug 2026 15:35:17 GMTSecurity newsSuriq's JackMalware can use Windows Hello keys to sign into Entra ID as youhttps://suriq.io/blog/windows-hello-entra-id-key-abuse/https://suriq.io/blog/windows-hello-entra-id-key-abuse/Malware in a signed-in Windows session can use the Windows Hello key to log into Microsoft Entra ID and hold a 90-day token. How to detect and mitigate it.Sun, 09 Aug 2026 12:11:03 GMTSecurity newsNoam AlumNatJack: a shared-NAT neighbor can seize your live TCP sessions and forge DNShttps://suriq.io/blog/natjack-shared-nat-session-hijack/https://suriq.io/blog/natjack-shared-nat-session-hijack/NatJack lets an attacker behind the same NAT hijack live TCP sessions, spoof DNS, and exhaust connection tables. Two CVEs: patch Windows and Linux now.Sun, 09 Aug 2026 08:41:55 GMTSecurity newsSuriq's JackAttackers turn unpatched TrueConf servers into backdoor delivery, pushing trojanized client installershttps://suriq.io/blog/trueconf-server-trojanized-installers-backdoor/https://suriq.io/blog/trueconf-server-trojanized-installers-backdoor/Head Mare exploited unpatched TrueConf servers (before 5.3.9, 5.4.9, 5.5.5) to swap client installers for unsigned backdoors.Sat, 08 Aug 2026 18:41:34 GMTSecurity newsNoam AlumAtlassian Rovo could leak Jira and Confluence data; one of two attack routes is unconfirmed as fixedhttps://suriq.io/blog/atlassian-rovo-ai-prompt-injection-data-leak/https://suriq.io/blog/atlassian-rovo-ai-prompt-injection-data-leak/Two firms found Atlassian Rovo could be tricked into leaking Jira, Confluence and SharePoint data. One attack route is patched; the other is unconfirmed.Sat, 08 Aug 2026 16:16:30 GMTSecurity newsSuriq's JackMetabase zero-day (CVSS 10.0): unauthenticated SQL injection hands attackers admin and data. Patch now.https://suriq.io/blog/metabase-sql-injection-zero-day-admin-access/https://suriq.io/blog/metabase-sql-injection-zero-day-admin-access/Metabase's SQL injection zero-day (CVSS 10.0) gives unauthenticated attackers admin access and stored database credentials. Exploited now: patch and rotate.Sat, 08 Aug 2026 12:49:48 GMTSecurity newsNoam AlumTONTOU beats Spectre v2 fixes to read kernel memory on AMD chips, but only from local codehttps://suriq.io/blog/tontou-spectre-v2-bypass-interrupt-injection/https://suriq.io/blog/tontou-spectre-v2-bypass-interrupt-injection/TONTOU, a new MIT attack, re-poisons the branch predictor after Spectre v2 defenses run to leak kernel memory. It needs local code. AMD patched, Intel did not.Fri, 07 Aug 2026 19:25:25 GMTSecurity newsNoam AlumVulnCheck: Zbtlink routers ship a factory root shell with no fix. The model list is not where you start.https://suriq.io/blog/zbtlink-endlessdoors-router-root-backdoor/https://suriq.io/blog/zbtlink-endlessdoors-router-root-backdoor/VulnCheck found a factory-shipped remote-access implant in 20 Zbtlink router models that calls home and hands a remote root shell. There is no patched firmware.Fri, 07 Aug 2026 15:43:50 GMTSecurity newsNoam AlumThe Snowflake hacker pleaded guilty. The breach used no exploit, just old passwords and MFA left off.https://suriq.io/blog/snowflake-hacker-guilty-plea-stolen-credentials/https://suriq.io/blog/snowflake-hacker-guilty-plea-stolen-credentials/The Snowflake hacker pleaded guilty to breaching 165 companies and exposing 100M people.Fri, 07 Aug 2026 12:07:26 GMTSecurity newsSuriq's JackA second dracut flaw (CVE-2026-15816) lets a rogue DHCP server run code as root on network-booted Linuxhttps://suriq.io/blog/dracut-cve-2026-15816-dhcp-root-execution/https://suriq.io/blog/dracut-cve-2026-15816-dhcp-root-execution/CVE-2026-15816 is a second dracut flaw: a rogue DHCP server can run code as root during boot on network-booted Linux. June's CVE-2026-6893 fix missed it.Fri, 07 Aug 2026 11:11:21 GMTSecurity newsSuriq's Jackleague/commonmark flaw lets planted text run scripts in your users' browsers, even with safe links onhttps://suriq.io/blog/commonmark-attributes-xss-cve-2026-71478/https://suriq.io/blog/commonmark-attributes-xss-cve-2026-71478/CVE-2026-71478 lets attacker-planted Markdown run scripts through league/commonmark's Attributes extension, bypassing allow_unsafe_links. Update to 2.9.0.Fri, 07 Aug 2026 08:26:14 GMTSecurity newsSuriq's JackA signed ScreenConnect installer becomes a backdoor after malware turns Defender offhttps://suriq.io/blog/smokescreen-screenconnect-rmm-defender-evasion/https://suriq.io/blog/smokescreen-screenconnect-rmm-defender-evasion/The SMOKE#SCREEN campaign disables Windows Defender, then installs a legitimately signed ScreenConnect agent your allowlist trusts.Wed, 05 Aug 2026 20:01:35 GMTSecurity newsNoam AlumOVSwrap (CVE-2026-64531): a 13-year-old Open vSwitch kernel bug now hands local users root on default Linuxhttps://suriq.io/blog/ovswrap-open-vswitch-kernel-local-root/https://suriq.io/blog/ovswrap-open-vswitch-kernel-local-root/OVSwrap (CVE-2026-64531, CVSS 7.8) lets an ordinary local user reach root through the Linux Open vSwitch datapath on most default distros.Wed, 05 Aug 2026 15:13:19 GMTSecurity newsSuriq's JackA Keycloak flaw lets attackers forge a single sign-on login and hijack accounts (CVE-2026-16443)https://suriq.io/blog/keycloak-saml-signature-bypass-cve-2026-16443/https://suriq.io/blog/keycloak-saml-signature-bypass-cve-2026-16443/CVE-2026-16443 is a Keycloak flaw where importing SAML identity-provider metadata can leave signature checks off, letting an attacker forge a login.Wed, 05 Aug 2026 14:11:12 GMTSecurity newsNoam AlumDOUBLECUP loader service stages malware in the browser cache to drop a RAT on Windows and macOShttps://suriq.io/blog/doublecup-clickfix-browser-cache-loader/https://suriq.io/blog/doublecup-clickfix-browser-cache-loader/DOUBLECUP, a Russian loader service, stages malware in the browser cache via ClickFix, then rebuilds it with trusted tools to drop a RAT on Windows and macOS.Wed, 05 Aug 2026 11:18:36 GMTSecurity newsSuriq's JackSUSE Rancher stored cluster join tokens in plaintext, and one leaked token can take over the whole clusterhttps://suriq.io/blog/rancher-cve-2026-55997-plaintext-cluster-tokens/https://suriq.io/blog/rancher-cve-2026-55997-plaintext-cluster-tokens/SUSE Rancher stored long-lived Kubernetes registration tokens in plaintext (CVE-2026-55997, CVSS 8.8). Upgrade to 2.14.4 or 2.13.8, then rotate every token.Wed, 05 Aug 2026 08:38:51 GMTSecurity newsNoam AlumLangflow's auto-login default gives any stranger admin, then RCEhttps://suriq.io/blog/langflow-cve-2026-9198-auto-login-rce/https://suriq.io/blog/langflow-cve-2026-9198-auto-login-rce/CVE-2026-9198 lets an unauthenticated attacker mint a Langflow superuser token via auto-login, then run code as admin. KEV-listed, patch past 1.10.0 now.Tue, 04 Aug 2026 19:15:48 GMTSecurity newsSuriq's JackA self-spreading npm worm poisoned hundreds of packages to steal cloud and GitHub tokenshttps://suriq.io/blog/chaindrop-keyv-npm-worm-credential-theft/https://suriq.io/blog/chaindrop-keyv-npm-worm-credential-theft/A self-propagating npm worm that began in keyv 6.0.0 poisoned hundreds of packages on August 4, steals GitHub, npm, cloud, Vault and Kubernetes credentialsTue, 04 Aug 2026 15:46:14 GMTSecurity newsNoam AlumAn AI system found 14,090 new bugs across open-source software. Attackers can run the same scan.https://suriq.io/blog/ai-scanner-14090-open-source-bugs/https://suriq.io/blog/ai-scanner-14090-open-source-bugs/Palo Alto's Unit 42 says its NOVA system found 14,090 unreported bugs across 3,915 open-source projects. The count is not the story.Tue, 04 Aug 2026 13:24:39 GMTSecurity newsNoam AlumCritical cPanel flaw lets a hosting account reach database roothttps://suriq.io/blog/cpanel-cve-2026-58048-database-root-escalation/https://suriq.io/blog/cpanel-cve-2026-58048-database-root-escalation/cPanel CVE-2026-58048 (CVSS 9.4) lets an authenticated hosting customer run SQL as database root, risking full server compromise. Patch to the fixed build now.Tue, 04 Aug 2026 11:50:48 GMTSecurity newsSuriq's JackDevice-code phishing jumped 1,500% in 2026: attackers take over Microsoft 365 accounts with no password or MFAhttps://suriq.io/blog/device-code-phishing-microsoft-365-token-theft/https://suriq.io/blog/device-code-phishing-microsoft-365-token-theft/Device-code phishing rose 1,500% in 2026, letting attackers mint Microsoft 365 tokens with no password or MFA. Here is how to detect and block the OAuth flow.Tue, 04 Aug 2026 08:52:38 GMTSecurity newsNoam AlumColdcard wallets generated predictable seeds, and thieves drained $88M in Bitcoin. Updating won't fix it.https://suriq.io/blog/coldcard-weak-rng-seed-bitcoin-theft/https://suriq.io/blog/coldcard-weak-rng-seed-bitcoin-theft/A Coldcard firmware error generated low-entropy Bitcoin seeds since 2021, and attackers swept about $88M by regenerating keys offline.Mon, 03 Aug 2026 18:29:41 GMTSecurity newsSuriq's JackThermo Fisher fixes a flaw that let forensic DNA files be altered undetected (CVE-2026-17583)https://suriq.io/blog/thermo-fisher-dna-file-tampering-cve-2026-17583/https://suriq.io/blog/thermo-fisher-dna-file-tampering-cve-2026-17583/Thermo Fisher patched CVE-2026-17583, a flaw that let .fsa and .hid forensic DNA files be modified before its analysis software loaded them, with no warningMon, 03 Aug 2026 15:23:59 GMTSecurity newsSuriq's JackN-able N-central auth bypass grants admin; first fix failedhttps://suriq.io/blog/nable-ncentral-auth-bypass-incomplete-patch/https://suriq.io/blog/nable-ncentral-auth-bypass-incomplete-patch/N-able N-central RMM has an actively exploited authentication bypass (CVE-2026-18577). The first patch failed; upgrade to 2026.3.1.7 and hunt your endpoints.Mon, 03 Aug 2026 12:14:09 GMTSecurity newsNoam AlumMalware can hijack Google Chrome passkey logins and sign in as you, even with two-factor onhttps://suriq.io/blog/chrome-passkey-malware-account-takeover/https://suriq.io/blog/chrome-passkey-malware-account-takeover/Google Chrome passkeys can be hijacked by malware: Unit 42 showed the device key can be copied and replayed when a site skips the user-verified check.Mon, 03 Aug 2026 11:40:25 GMTSecurity newsSuriq's JackSharp and Toshiba office copiers shipped with the login turned off, exposing saved scanshttps://suriq.io/blog/sharp-toshiba-mfp-auth-off-default-cve-2026-63563/https://suriq.io/blog/sharp-toshiba-mfp-auth-off-default-cve-2026-63563/Sharp and Toshiba Tec copiers sold outside Japan shipped with authentication off, exposing the address book and stored scans (CVE-2026-63563).Mon, 03 Aug 2026 09:23:09 GMTSecurity newsNoam AlumAmazon ties the debug, chalk, and axios npm hijacks to North Koreahttps://suriq.io/blog/npm-debug-chalk-axios-north-korea/https://suriq.io/blog/npm-debug-chalk-axios-north-korea/npm supply-chain attacks on debug, chalk, and axios are tied to one North Korean crew, Sapphire Sleet. Why signing missed it, and how to detect it.Sun, 02 Aug 2026 16:47:38 GMTSecurity newsNoam AlumA malicious remote desktop server can corrupt FreeRDP's Windows client via the clipboard (CVE-2026-68579)https://suriq.io/blog/freerdp-windows-clipboard-heap-overflow-cve-2026-68579/https://suriq.io/blog/freerdp-windows-clipboard-heap-overflow-cve-2026-68579/FreeRDP fixed CVE-2026-68579, a critical clipboard heap overflow in its Windows client. A malicious remote desktop server can corrupt memory. Update to 3.30.0.Sun, 02 Aug 2026 15:08:49 GMTSecurity newsSuriq's JackWater systems in 7 states were hijacked with default passwords, and no CVE was involvedhttps://suriq.io/blog/water-utilities-7-states-exposed-plc-default-passwords/https://suriq.io/blog/water-utilities-7-states-exposed-plc-default-passwords/Attackers hijacked internet-exposed water-utility control devices in 7 US states using default passwords, no CVE required. CISA says disconnect them now.Sun, 02 Aug 2026 12:55:23 GMTSecurity newsSuriq's JackAdform's shared ad-tracking script was hijacked to swap crypto wallet addresses in visitors' browsershttps://suriq.io/blog/adform-ad-script-crypto-wallet-swap-supply-chain/https://suriq.io/blog/adform-ad-script-crypto-wallet-swap-supply-chain/Attackers trojanized Adform's shared trackpoint-async.js to swap Bitcoin, Ethereum, and Tron wallet addresses in visitors' browsers. Why SRI can't stop it.Sat, 01 Aug 2026 19:44:15 GMTSecurity newsNoam AlumAn AI agent hit 460 servers on its own, but known CVEs did the breakinghttps://suriq.io/blog/autonomous-ai-agent-deepseek-hermes-460-servers/https://suriq.io/blog/autonomous-ai-agent-deepseek-hermes-460-servers/A China-linked operator wired DeepSeek into an autonomous agent that swept 460+ exposed servers.Sat, 01 Aug 2026 16:40:16 GMTSecurity newsNoam AlumGoogle's AI helped fix 1,072 Chrome bugs; patch cadence doubledhttps://suriq.io/blog/chrome-ai-1072-bugs-faster-patch-cadence/https://suriq.io/blog/chrome-ai-1072-bugs-faster-patch-cadence/Google credits AI for fixing 1,072 Chrome bugs in two June releases, but never said how many AI found. The real shift for defenders is a faster patch cadence.Sat, 01 Aug 2026 13:02:24 GMTSecurity newsSuriq's JackAnthropic's own AI models breached three real companies in testshttps://suriq.io/blog/anthropic-ai-models-breached-real-companies-ctf-tests/https://suriq.io/blog/anthropic-ai-models-breached-real-companies-ctf-tests/Anthropic says three of its AI models breached real companies during security tests after a sandbox misconfiguration. Two of three victims never noticed.Sat, 01 Aug 2026 08:33:35 GMTSecurity newsNoam AlumA link an admin clicks can create a rogue WordPress admin via the AI Engine plugin (CVE-2026-15988)https://suriq.io/blog/ai-engine-wordpress-mcp-oauth-csrf-rogue-admin-cve-2026-15988/https://suriq.io/blog/ai-engine-wordpress-mcp-oauth-csrf-rogue-admin-cve-2026-15988/CVE-2026-15988 lets an attacker create a new WordPress administrator on sites running AI Engine 3.6.5 or earlier if a logged-in admin clicks one link.Sat, 01 Aug 2026 08:09:52 GMTSecurity newsSuriq's Jackbank-vaults Kubernetes webhook flaw lets a low-privilege user steal HashiCorp Vault secrets (CVE-2026-54725)https://suriq.io/blog/vault-secrets-webhook-ssrf-token-theft/https://suriq.io/blog/vault-secrets-webhook-ssrf-token-theft/CVE-2026-54725 is a critical SSRF in bank-vaults vault-secrets-webhook (CVSS 9.6). A user who can create a ConfigMap can steal ServiceAccount tokens. Fix: 1.23.Fri, 31 Jul 2026 18:24:37 GMTSecurity newsSuriq's JackUnauthenticated attacker can read any file on a Ruby on Rails server via a crafted image (CVE-2026-66066)https://suriq.io/blog/rails-active-storage-cve-2026-66066-arbitrary-file-read/https://suriq.io/blog/rails-active-storage-cve-2026-66066-arbitrary-file-read/CVE-2026-66066 lets an unauthenticated attacker upload a crafted image to a Rails app and read any server file, including its signing key. Patch now.Fri, 31 Jul 2026 16:04:08 GMTSecurity newsNoam AlumAzure Cosmos DB flaw gave one platform key full read/write access to any customer databasehttps://suriq.io/blog/azure-cosmos-db-cosmosescape-master-key/https://suriq.io/blog/azure-cosmos-db-cosmosescape-master-key/Wiz's CosmosEscape exposed a platform-wide Azure Cosmos DB key that could read and write any customer's database.Fri, 31 Jul 2026 11:22:07 GMTSecurity newsSuriq's JackSilver Fox's new kit hot-swaps vulnerable drivers to kill EDR and plant ValleyRAThttps://suriq.io/blog/silverfox-modular-byovd-valleyrat/https://suriq.io/blog/silverfox-modular-byovd-valleyrat/Silver Fox now runs a modular bring-your-own-vulnerable-driver kit with three interchangeable drivers, killing EDR from the kernel to deploy ValleyRAT.Fri, 31 Jul 2026 09:09:41 GMTSecurity newsNoam AlumKeycloak lets an outside Google account bypass your Workspace domain sign-in restriction (CVE-2026-18214)https://suriq.io/blog/keycloak-google-domain-bypass-token-exchange-cve-2026-18214/https://suriq.io/blog/keycloak-google-domain-bypass-token-exchange-cve-2026-18214/A missing check in Red Hat Build of Keycloak lets an outside Google account bypass a Google Workspace domain restriction during token exchange.Fri, 31 Jul 2026 08:11:44 GMTSecurity newsSuriq's JackFCC adds networked robots and inverters to its Covered List. The installed base is still yours to secure.https://suriq.io/blog/fcc-covered-list-robots-inverters-installed-base/https://suriq.io/blog/fcc-covered-list-robots-inverters-installed-base/The FCC added networked power inverters and mobile robots to its Covered List over remote-control risk.Thu, 30 Jul 2026 19:24:46 GMTSecurity newsNoam AlumRuflo's unauthenticated AI agent bridge runs code (CVE-2026-59726); patching won't evict the poisoned memoryhttps://suriq.io/blog/ruflo-rufroot-mcp-bridge-rce-cve-2026-59726/https://suriq.io/blog/ruflo-rufroot-mcp-bridge-rce-cve-2026-59726/Ruflo exposed an unauthenticated MCP bridge to 233 tools, so one request gets full remote code execution (CVE-2026-59726).Thu, 30 Jul 2026 16:13:38 GMTSecurity newsSuriq's JackRussian OWAReaper implant exploits an Outlook Web Access flaw, and a password reset won't evict ithttps://suriq.io/blog/owareaper-outlook-web-access-cve-2026-42897/https://suriq.io/blog/owareaper-outlook-web-access-cve-2026-42897/Russian group Void Blizzard is exploiting Outlook Web Access flaw CVE-2026-42897 to plant OWAReaper, a backdoor whose server-side mailbox access survivesThu, 30 Jul 2026 12:10:45 GMTSecurity newsNoam AlumCisco's firewall management software has a hardcoded password, and attackers are already using ithttps://suriq.io/blog/cisco-fmc-hardcoded-password-cve-2026-20316/https://suriq.io/blog/cisco-fmc-hardcoded-password-cve-2026-20316/Cisco Secure Firewall Management Center ships a static password (CVE-2026-20316) that lets unauthenticated attackers log in. Now in CISA KEV. Patch and hunt.Thu, 30 Jul 2026 11:13:38 GMTSecurity newsNoam AlumAdminer flaw lets a logged-in user run code on the web server (CVE-2026-15686), fixed in 5.4.3https://suriq.io/blog/adminer-cve-2026-15686-authenticated-rce/https://suriq.io/blog/adminer-cve-2026-15686-authenticated-rce/CVE-2026-15686 lets a logged-in Adminer user slip a blocked SQLite command past a filter and run code on the server. Fixed in Adminer 5.4.3; update now.Thu, 30 Jul 2026 08:26:56 GMTSecurity newsSuriq's JackNew VMware flaws let a network attacker run code on vCenter with no login, and escape a VM onto the hosthttps://suriq.io/blog/vmware-vcenter-esxi-preauth-rce-vm-escape/https://suriq.io/blog/vmware-vcenter-esxi-preauth-rce-vm-escape/VMware's VMSA-2026-0006 patches two 9.8 vCenter flaws that add up to unauthenticated code execution, plus a 9.3 ESXi VM escape. Patch vCenter first.Wed, 29 Jul 2026 18:39:34 GMTSecurity newsNoam AlumcPanel security update fixes three flaws rated up to High, including one in the bundled Exim mail serverhttps://suriq.io/blog/cpanel-whm-security-release-exim/https://suriq.io/blog/cpanel-whm-security-release-exim/cPanel and WHM's new security release fixes CVE-2026-58047, CVE-2026-58048 and an Exim flaw, rated up to High. Patched versions for every branch, what to do.Wed, 29 Jul 2026 17:40:47 GMTSecurity newsSuriq's Jack30+ Minnesota water utilities hit in a coordinated attack, and the timing is the real warninghttps://suriq.io/blog/minnesota-water-utilities-coordinated-ot-attack/https://suriq.io/blog/minnesota-water-utilities-coordinated-ot-attack/More than 30 Minnesota water systems were hit in a coordinated two-day attack. The simultaneity points to shared exposure; the signal sits on the IT side.Wed, 29 Jul 2026 15:46:49 GMTSecurity newsNoam AlumDysphoria botnet hides on the blockchain to survive takedownshttps://suriq.io/blog/dysphoria-iot-botnet-blockchain-c2-relays/https://suriq.io/blog/dysphoria-iot-botnet-blockchain-c2-relays/Dysphoria, a DDoS-for-hire IoT botnet, survived a March takedown by anchoring its command servers to Ethereum and Solana names no registrar can seize, and nowWed, 29 Jul 2026 12:51:47 GMTSecurity newsSuriq's JackERPNext SQL injection lets a low-privilege user read the entire database, passwords included (CVE-2026-12895)https://suriq.io/blog/erpnext-cve-2026-12895-supplier-sql-injection/https://suriq.io/blog/erpnext-cve-2026-12895-supplier-sql-injection/CVE-2026-12895 is a SQL injection in ERPNext that lets a low-privilege user read the whole database. Fixed in 15.111.0 and 16.22.0. Patch and rotate secrets.Wed, 29 Jul 2026 11:25:03 GMTSecurity newsSuriq's JackApache Traffic Server flaw lets attackers slip hidden requests past security checks and forge internal datahttps://suriq.io/blog/apache-traffic-server-cve-2026-33267-request-smuggling/https://suriq.io/blog/apache-traffic-server-cve-2026-33267-request-smuggling/Apache Traffic Server has a critical flaw, CVE-2026-33267 (CVSS 10), that lets attackers smuggle requests and spoof internal metadata.Wed, 29 Jul 2026 08:09:56 GMTSecurity newsNoam AlumFastjson RCE (CVE-2026-16723) now exploited on Spring Boot appshttps://suriq.io/blog/fastjson-cve-2026-16723-spring-boot-exploited/https://suriq.io/blog/fastjson-cve-2026-16723-spring-boot-exploited/CVE-2026-16723, a fastjson 1.x remote code execution flaw, is now exploited against US firms. Only Spring Boot fat-JAR apps are hit, and no 1.x patch is coming.Tue, 28 Jul 2026 19:38:36 GMTSecurity newsNoam Alum24,650 exposed server BMCs leak crackable IPMI password hashes, and no patch can fix ithttps://suriq.io/blog/exposed-bmc-ipmi-password-hash-leak/https://suriq.io/blog/exposed-bmc-ipmi-password-hash-leak/A scan found 24,650 internet-exposed server BMCs leaking IPMI password hashes to anyone via CVE-2013-4786. There is no patch. Here is how to close the exposure.Tue, 28 Jul 2026 15:39:35 GMTSecurity newsNoam AlumCritical TeamCity flaw CVE-2026-63077 lets an unauthenticated attacker run commands on your build serverhttps://suriq.io/blog/teamcity-cve-2026-63077-preauth-rce-build-server/https://suriq.io/blog/teamcity-cve-2026-63077-preauth-rce-build-server/CVE-2026-63077 is a CVSS 9.8 auth bypass in every TeamCity On-Premises version. An unauthenticated attacker can run commands. Patch to 2025.11.7 or 2026.1.3.Tue, 28 Jul 2026 12:15:15 GMTSecurity newsSuriq's JackPublic DNS servers with filtering: a verified list of what each IP really blockshttps://suriq.io/blog/public-dns-servers-filtering-verified/https://suriq.io/blog/public-dns-servers-filtering-verified/Public DNS servers with filtering, verified against official docs: what the Cloudflare, Quad9, AdGuard, CleanBrowsing, ControlD, Mullvad and OpenDNS IPs block.Tue, 28 Jul 2026 09:59:12 GMTExplainersNoam AlumFor this week's most-exploited bugs, the patch was the easy parthttps://suriq.io/blog/signal-patch-is-not-the-finish-line/https://suriq.io/blog/signal-patch-is-not-the-finish-line/This week's most-exploited bugs each shipped with a fix, yet patching FortiOS, SharePoint, Check Point, and Langflow did not end the incident.Tue, 28 Jul 2026 09:27:50 GMTDeep diveSuriq's JackA max-severity flaw in Dassault's 3DEXPERIENCE platform lets an attacker run code with no login. Patch now.https://suriq.io/blog/dassault-3dexperience-cve-2026-11756-launcher-rce/https://suriq.io/blog/dassault-3dexperience-cve-2026-11756-launcher-rce/CVE-2026-11756 is a CVSS 10 deserialization flaw in Dassault's 3DEXPERIENCE Launcher that allows unauthenticated remote code execution.Tue, 28 Jul 2026 08:25:08 GMTSecurity newsSuriq's JackOn-prem VeloCloud Orchestrator flaw (CVE-2026-16812) lets attackers run commands, and it is exploited nowhttps://suriq.io/blog/velocloud-orchestrator-cve-2026-16812-onprem-command-injection/https://suriq.io/blog/velocloud-orchestrator-cve-2026-16812-onprem-command-injection/CVE-2026-16812 is a CVSS 10.0 OS command injection in on-prem VeloCloud Orchestrator, actively exploited. See the affected and fixed builds to patch now.Mon, 27 Jul 2026 20:04:38 GMTSecurity newsSuriq's JackAttackers can slip past Fortinet's fix and keep reading a hacked firewall's files, CISA warnshttps://suriq.io/blog/fortios-symlink-patch-bypass-cve-2025-68686-kev/https://suriq.io/blog/fortios-symlink-patch-bypass-cve-2025-68686-kev/CISA added CVE-2025-68686 to its exploited catalog: a bypass of Fortinet's FortiOS symlink fix lets attackers who already breached a FortiGate keep reading itsMon, 27 Jul 2026 18:39:43 GMTSecurity newsNoam Alumn8n flaw lets any workflow editor run OS commands on your server (GHSA-gv7g-jm28-cr3m)https://suriq.io/blog/n8n-sandbox-escape-workflow-editor-rce/https://suriq.io/blog/n8n-sandbox-escape-workflow-editor-rce/n8n patched a CVSS 8.7 expression sandbox escape (GHSA-gv7g-jm28-cr3m) that lets any workflow editor run OS commands on the host. Update to 2.32.1 now.Mon, 27 Jul 2026 16:51:45 GMTSecurity newsNoam AlumA vBulletin bug lets anyone run code on the forum server without logging in. Update to 6.2.2 now.https://suriq.io/blog/vbulletin-cve-2026-61511-template-eval-rce/https://suriq.io/blog/vbulletin-cve-2026-61511-template-eval-rce/CVE-2026-61511 is an unauthenticated remote code execution flaw in vBulletin's template engine (CVSS 9.8).Mon, 27 Jul 2026 14:09:46 GMTSecurity newsSuriq's JackGitHub and PyPI add release delays to slow poisoned packageshttps://suriq.io/blog/github-pypi-release-cooldown-supply-chain-gap/https://suriq.io/blog/github-pypi-release-cooldown-supply-chain-gap/GitHub now waits three days before Dependabot opens an update pull request, and PyPI locks old releases from new files.Mon, 27 Jul 2026 11:33:16 GMTSecurity newsSuriq's JackA 'read-only' role in Red Hat OpenShift Virtualization lets one tenant copy another tenant's datahttps://suriq.io/blog/openshift-virtualization-view-role-cross-tenant-clone/https://suriq.io/blog/openshift-virtualization-view-role-cross-tenant-clone/CVE-2026-17527 lets a low-privileged OpenShift Virtualization tenant copy other tenants' data across namespaces through a read-only role. No fix yet; audit now.Mon, 27 Jul 2026 10:26:06 GMTSecurity newsNoam AlumHotel Wi-Fi hijacks steal Microsoft 365 accounts past MFAhttps://suriq.io/blog/hotel-wifi-dns-hijack-microsoft-365-mfa/https://suriq.io/blog/hotel-wifi-dns-hijack-microsoft-365-mfa/A campaign is hijacking hotel and conference Wi-Fi to steal Microsoft 365 accounts. A VPN closes most of it, but not the device-code trick that beats MFA.Sun, 26 Jul 2026 19:19:15 GMTSecurity newsNoam AlumSourTrade malvertising builds an infostealer inside your browser, so no file crosses the wire to scanhttps://suriq.io/blog/sourtrade-browser-assembled-malware/https://suriq.io/blog/sourtrade-browser-assembled-malware/SourTrade malvertising makes the victim's browser assemble a Windows infostealer in memory, with a unique hash per visitor, so no scannable file ever crossesSun, 26 Jul 2026 15:42:49 GMTSecurity newsSuriq's JackA GitLab flaw lets any user with push access run code on the server, and a public exploit is now outhttps://suriq.io/blog/gitlab-notebook-diff-rce-public-exploit/https://suriq.io/blog/gitlab-notebook-diff-rce-public-exploit/GitLab quietly patched a self-managed code-execution flaw on June 10 with no CVE. A public exploit is now out and any push-access user can run code as git.Sun, 26 Jul 2026 11:30:05 GMTSecurity newsSuriq's JackA public exploit lets a stranger log in as WordPress admin through miniOrange's single sign-on pluginhttps://suriq.io/blog/miniorange-saml-sso-wordpress-admin-bypass/https://suriq.io/blog/miniorange-saml-sso-wordpress-admin-bypass/A public exploit for CVE-2026-15981 lets unauthenticated attackers log in as any WordPress admin via the miniOrange SAML SSO plugin. Update to 5.4.5 now.Sun, 26 Jul 2026 09:55:01 GMTSecurity newsNoam AlumAny domain user can now DCSync your forest. Certighost is why.https://suriq.io/blog/certighost-adcs-cve-2026-54121/https://suriq.io/blog/certighost-adcs-cve-2026-54121/CVE-2026-54121 lets a standard Active Directory user impersonate a domain controller through AD CS and run DCSync.Sat, 25 Jul 2026 15:45:18 GMTSecurity newsSuriq's JackPublic exploit hits a critical Oracle WebLogic flaw that forges a login to take over the serverhttps://suriq.io/blog/oracle-weblogic-cve-2026-60206-saml-login-forgery-exploit/https://suriq.io/blog/oracle-weblogic-cve-2026-60206-saml-login-forgery-exploit/A public proof-of-concept exploit now targets CVE-2026-60206, a CVSS 9.9 Oracle WebLogic flaw that forges a login to take over the server. Patch and hunt now.Sat, 25 Jul 2026 15:27:56 GMTSecurity newsNoam AlumWindmill's unauthenticated file-read flaw (CVE-2026-29059) is under active attackhttps://suriq.io/blog/windmill-cve-2026-29059-arbitrary-file-read/https://suriq.io/blog/windmill-cve-2026-29059-arbitrary-file-read/Windmill's unauthenticated file-read flaw CVE-2026-29059 is being exploited in the wild. Patch self-hosted instances to 1.603.3 and rotate any exposed secrets.Sat, 25 Jul 2026 11:34:38 GMTSecurity newsSuriq's JackWPForms Pro flaw lets a stranger upload a file and run code on your WordPress site. Patch now.https://suriq.io/blog/wpforms-pro-cve-2026-10818-file-upload-rce/https://suriq.io/blog/wpforms-pro-cve-2026-10818-file-upload-rce/A flaw in WPForms Pro (CVE-2026-10818) lets unauthenticated attackers upload executable files to WordPress sites on versions up to 1.10.1.1 and run code.Sat, 25 Jul 2026 08:10:39 GMTSecurity newsNoam AlumA single ChatGPT link could plant a rogue AI agent in your orghttps://suriq.io/blog/chatgpt-agentforger-csrf-rogue-agent/https://suriq.io/blog/chatgpt-agentforger-csrf-rogue-agent/Zenity Labs' AgentForger let one crafted ChatGPT link forge a self-running AI agent wired to your connected apps. OpenAI fixed it. Here's what to watch.Fri, 24 Jul 2026 18:32:54 GMTSecurity newsSuriq's JackAttackers ran an AI agent unattended to do the hands-on hacking inside Thailand's finance ministryhttps://suriq.io/blog/hermes-ai-agent-thailand-finance-ministry/https://suriq.io/blog/hermes-ai-agent-thailand-finance-ministry/An attacker ran an unattended AI agent to hack Thailand's finance ministry. It used no new exploit, and defenders catch it by watching host actions.Fri, 24 Jul 2026 15:52:48 GMTSecurity newsNoam AlumA Keycloak flaw lets a view-only admin read live client secrets from the vault (CVE-2026-17048)https://suriq.io/blog/keycloak-cve-2026-17048-vault-secret-leak/https://suriq.io/blog/keycloak-cve-2026-17048-vault-secret-leak/CVE-2026-17048 lets a view-only Keycloak admin read resolved client secrets from the vault instead of the placeholder.Fri, 24 Jul 2026 14:11:05 GMTSecurity newsNoam AlumFake Notepad++ plugin drops a Windows loader that slips past sandboxes and app allowlistshttps://suriq.io/blog/fake-notepad-plugin-dll-sideload-uac0099/https://suriq.io/blog/fake-notepad-plugin-dll-sideload-uac0099/CERT-UA ties UAC-0099 to a campaign hiding a Windows loader in a genuine Notepad++ via DLL sideloading.Fri, 24 Jul 2026 11:14:43 GMTSecurity newsNoam AlumESET patched a Mac flaw that let any local user gain root control (CVE-2026-7483)https://suriq.io/blog/eset-macos-cve-2026-7483-privileged-service-local-root/https://suriq.io/blog/eset-macos-cve-2026-7483-privileged-service-local-root/ESET patched CVE-2026-7483, a local privilege escalation in its Mac security software that let any logged-in user write files as root.Fri, 24 Jul 2026 10:11:44 GMTSecurity newsSuriq's JackZimbra webmail zero-day (CVE-2025-66376) let Russian spies steal mail and mint MFA-bypass passwordshttps://suriq.io/blog/zimbra-cve-2025-66376-russian-mail-theft/https://suriq.io/blog/zimbra-cve-2025-66376-russian-mail-theft/Russian group Void Blizzard exploited Zimbra webmail flaw CVE-2025-66376 as a zero-day to steal 90 days of mail and mint app passwords that survive resets.Thu, 23 Jul 2026 19:06:36 GMTSecurity newsNoam AlumRefluXFS: a Linux XFS flaw gives any local user root accesshttps://suriq.io/blog/refluxfs-xfs-linux-local-root/https://suriq.io/blog/refluxfs-xfs-linux-local-root/RefluXFS (CVE-2026-64600) lets any local user get root on default RHEL, Rocky, Alma and Amazon Linux via an XFS race. No workaround: patch and reboot.Thu, 23 Jul 2026 15:58:48 GMTSecurity newsNoam AlumPhpSpreadsheet flaw: a tiny malformed file can crash PHP apps that accept spreadsheet uploads (CVE-2026-59933)https://suriq.io/blog/phpspreadsheet-cve-2026-59933-spreadsheet-upload-dos/https://suriq.io/blog/phpspreadsheet-cve-2026-59933-spreadsheet-upload-dos/CVE-2026-59933: a 1 KB malformed spreadsheet can exhaust memory and crash PHP apps using PhpSpreadsheet, even during automatic file-type detection. Patch now.Thu, 23 Jul 2026 15:28:07 GMTSecurity newsSuriq's JackAdobe's Acrobat Chrome extension let any website read WhatsApp Web chats (CVE-2026-48294). Update now.https://suriq.io/blog/adobe-acrobat-extension-whatsapp-web-cross-origin/https://suriq.io/blog/adobe-acrobat-extension-whatsapp-web-cross-origin/A cross-origin flaw in Adobe's Acrobat Chrome extension (CVE-2026-48294) let any website read WhatsApp Web chats. Update to 26.5.2.3 and govern extensions.Thu, 23 Jul 2026 11:45:23 GMTSecurity newsNoam AlumA rigged printer advertisement can trap Linux print systems in a CPU-burning loop (CVE-2026-64611)https://suriq.io/blog/libcupsfilters-cve-2026-64611-printer-loop-dos/https://suriq.io/blog/libcupsfilters-cve-2026-64611-printer-loop-dos/CVE-2026-64611 lets a crafted printer advertisement drive libcupsfilters into an infinite loop, burning a CPU core on Linux print systems. Patch and harden now.Thu, 23 Jul 2026 11:25:14 GMTSecurity newsSuriq's JackA critical fastjson flaw lets attackers run code on the server with no special configuration (CVE-2026-16723)https://suriq.io/blog/fastjson-cve-2026-16723-default-config-rce/https://suriq.io/blog/fastjson-cve-2026-16723-default-config-rce/CVE-2026-16723 lets attackers run code on Java apps using fastjson 1.2.68 to 1.2.83 in default configuration. Turn on SafeMode or move to fastjson2.Thu, 23 Jul 2026 08:39:14 GMTSecurity newsSuriq's JackCheck Point's SmartConsole flaw lets an unauthenticated attacker become full admin, and it is being exploitedhttps://suriq.io/blog/check-point-smartconsole-cve-2026-16232-exploited/https://suriq.io/blog/check-point-smartconsole-cve-2026-16232-exploited/Check Point SmartConsole flaw CVE-2026-16232 is exploited and in CISA KEV, letting an unauthenticated attacker log in as full admin.Wed, 22 Jul 2026 20:10:17 GMTSecurity newsNoam AlumYou patched SharePoint three times this month. The key attackers want is still in the lock.https://suriq.io/blog/sharepoint-cve-2026-50522-rotate-machine-keys/https://suriq.io/blog/sharepoint-cve-2026-50522-rotate-machine-keys/CVE-2026-50522, a CVSS 9.8 SharePoint RCE, went from public PoC to active exploitation in hours.Wed, 22 Jul 2026 15:57:34 GMTSecurity newsSuriq's JackLangflow's code-validation endpoint just produced its second unauthenticated RCEhttps://suriq.io/blog/langflow-cve-2026-0770-validate-rce-kev/https://suriq.io/blog/langflow-cve-2026-0770-validate-rce-kev/CVE-2026-0770 (CVSS 9.8) is an unauthenticated root RCE in Langflow's validate endpoint, actively exploited and added to CISA's KEV catalog.Wed, 22 Jul 2026 13:05:36 GMTSecurity newsSuriq's JackOracle's July update fixes unauthenticated 10.0 code-execution flaws in WebLogic, HTTP Server, and Coherencehttps://suriq.io/blog/oracle-july-2026-cpu-unauthenticated-rce-weblogic-coherence/https://suriq.io/blog/oracle-july-2026-cpu-unauthenticated-rce-weblogic-coherence/Oracle's July 2026 update ships 1,449 fixes, including unauthenticated CVSS 10.0 remote code execution in WebLogic, Oracle HTTP Server, and Coherence.Wed, 22 Jul 2026 04:58:33 GMTSecurity newsSuriq's JackA Jackson library flaw lets low-privilege users write fields meant only for adminshttps://suriq.io/blog/jackson-databind-jsonview-write-bypass-cve-2026-59889/https://suriq.io/blog/jackson-databind-jsonview-write-bypass-cve-2026-59889/CVE-2026-59889 lets a low-privilege user bypass jackson-databind's @JsonView write guard and set admin-only fields. Patched in 2.18.9, 2.21.5, 3.1.5.Wed, 22 Jul 2026 00:16:31 GMTSecurity newsNoam AlumA Palo Alto VPN auth bypass is now a Qilin ransomware front doorhttps://suriq.io/blog/qilin-ransomware-palo-alto-globalprotect-cve-2026-0257/https://suriq.io/blog/qilin-ransomware-palo-alto-globalprotect-cve-2026-0257/CVE-2026-0257 lets attackers open a Palo Alto GlobalProtect VPN session with no login, and the Qilin ransomware crew is using it for initial access.Tue, 21 Jul 2026 18:26:29 GMTSecurity newsSuriq's JackHollowGraph turns Microsoft 365 into a C2 channel with no patchhttps://suriq.io/blog/hollowgraph-microsoft-365-calendar-c2/https://suriq.io/blog/hollowgraph-microsoft-365-calendar-c2/HollowGraph runs its command channel through a hijacked Microsoft 365 calendar over the Graph API. No CVE, no patch: here is how to detect it.Tue, 21 Jul 2026 16:04:00 GMTSecurity newsNoam AlumNGINX's new 9.2 heap overflow hits a config most servers actually run, not an exotic onehttps://suriq.io/blog/nginx-cve-2026-42533-map-regex-heap-overflow/https://suriq.io/blog/nginx-cve-2026-42533-map-regex-heap-overflow/CVE-2026-42533 is a CVSS 9.2 heap overflow in nginx's string engine, patched July 15. Unlike June's flaws it fires on a common regex map config.Tue, 21 Jul 2026 11:41:51 GMTSecurity newsDeep diveNoam AlumThe week's scariest ‘AI’ bugs weren't about AI. They were the confused deputy.https://suriq.io/blog/signal-ai-bugs-confused-deputy/https://suriq.io/blog/signal-ai-bugs-confused-deputy/This week's headline ‘AI’ vulnerabilities in Grafana and Apache Camel are the 1988 confused-deputy flaw, the same one that hit Fastify, Directus and OpenShiftTue, 21 Jul 2026 09:25:08 GMTDeep diveSuriq's JackDirectus caching flaw can serve one visitor's private data to the nexthttps://suriq.io/blog/directus-cache-authorization-leak-cve-2026-61836/https://suriq.io/blog/directus-cache-authorization-leak-cve-2026-61836/Directus before 12.0.0 caches responses under a key that omits authorization, so with caching on it can serve one visitor's share-scoped data to another.Tue, 21 Jul 2026 09:10:05 GMTSecurity newsSuriq's JackServiceNow is under active attack through a route the public exploit does not show. Patch, don't block.https://suriq.io/blog/servicenow-cve-2026-6875-sandbox-escape-exploited/https://suriq.io/blog/servicenow-cve-2026-6875-sandbox-escape-exploited/ServiceNow's pre-auth sandbox-escape flaw CVE-2026-6875 (CVSS 9.5) is under active exploitation.Mon, 20 Jul 2026 20:03:34 GMTSecurity newsNoam AlumAn AI agent breached Hugging Face. Blocklists can't catch it.https://suriq.io/blog/hugging-face-autonomous-ai-agent-breach/https://suriq.io/blog/hugging-face-autonomous-ai-agent-breach/Hugging Face says an autonomous AI agent breached it, taking internal data and service credentials.Mon, 20 Jul 2026 12:23:25 GMTSecurity newsSuriq's JackIn Apache Camel, a manipulated AI reply can quietly redirect what the server does nexthttps://suriq.io/blog/apache-camel-llm-tool-header-injection-cve-2026-49042/https://suriq.io/blog/apache-camel-llm-tool-header-injection-cve-2026-49042/CVE-2026-49042 lets a prompt-injected AI model set hidden Apache Camel headers via tool-call arguments, reaching code execution or SSRF on exposed routes.Mon, 20 Jul 2026 11:10:19 GMTSecurity newsNoam AlumOne missing setting lets a stranger join an OpenShift cluster's private tunnel and read its traffichttps://suriq.io/blog/openshift-hypershift-konnectivity-cert-bypass/https://suriq.io/blog/openshift-hypershift-konnectivity-cert-bypass/CVE-2026-16242 (CVSS 9.4): a missing certificate check in OpenShift hosted control planes lets a remote attacker intercept control-plane-to-node traffic.Mon, 20 Jul 2026 08:26:42 GMTSecurity newsSuriq's JackEY's breach came through the help desk, not the audit floorhttps://suriq.io/blog/ey-breach-it-support-ticket-platform/https://suriq.io/blog/ey-breach-it-support-ticket-platform/EY says client tax data leaked from a third-party IT support platform, not its audit systems. Why help-desk tooling is a crown-jewel store, and how to watch it.Sun, 19 Jul 2026 19:42:49 GMTSecurity newsThought leadershipNoam AlumNadMesh turns exposed AI servers into cloud-key harvestershttps://suriq.io/blog/nadmesh-botnet-exposed-ai-cloud-keys/https://suriq.io/blog/nadmesh-botnet-exposed-ai-cloud-keys/NadMesh, a new Go botnet, scans exposed self-hosted AI tools like Ollama and ComfyUI to steal cloud keys and Kubernetes tokens.Sun, 19 Jul 2026 15:42:01 GMTSecurity newsSuriq's Jackwp2shell went from patch to public exploit in a day. Patching is no longer enough.https://suriq.io/blog/wp2shell-exploits-public-hunt-now/https://suriq.io/blog/wp2shell-exploits-public-hunt-now/Public proof-of-concept exploits for the wp2shell WordPress Core RCE (CVE-2026-63030) are live and the mechanism is disclosed.Sun, 19 Jul 2026 11:11:36 GMTSecurity newsNoam AlumInc ransomware used the SonicWall SMA zero-days to steal MFA seeds. Resetting passwords will not evict it.https://suriq.io/blog/inc-ransomware-sonicwall-sma-mfa-seed-theft/https://suriq.io/blog/inc-ransomware-sonicwall-sma-mfa-seed-theft/Rapid7 ties the SonicWall SMA 1000 zero-days to an Inc ransomware actor that stole credentials, sessions, and TOTP seeds. A password reset won't evict it.Sun, 19 Jul 2026 09:06:06 GMTSecurity newsSuriq's JackACR Stealer steals live sessions. A password reset won't help.https://suriq.io/blog/acr-stealer-clickfix-session-theft/https://suriq.io/blog/acr-stealer-clickfix-session-theft/ACR Stealer, now surging per Microsoft, steals live browser sessions and Microsoft 365 files through ClickFix lures.Sat, 18 Jul 2026 19:30:36 GMTSecurity newsNoam AlumOne encoded letter walks past a Fastify proxy and reaches the internal endpoints it hidhttps://suriq.io/blog/fastify-http-proxy-prefix-bypass-cve-2026-16117/https://suriq.io/blog/fastify-http-proxy-prefix-bypass-cve-2026-16117/A single URL-encoded character slips past @fastify/http-proxy's prefix rewrite (CVE-2026-16117, CVSS 10), exposing internal upstream endpoints. Upgrade to 11.6.Sat, 18 Jul 2026 18:54:32 GMTSecurity newsSuriq's JackOpenSSL's HollowByte flaw freezes servers, and no CVE flags ithttps://suriq.io/blog/openssl-hollowbyte-tls-memory-dos/https://suriq.io/blog/openssl-hollowbyte-tls-memory-dos/OpenSSL patched HollowByte, an 11-byte flaw that strands server memory, quietly in June with no CVE.Sat, 18 Jul 2026 12:05:18 GMTSecurity newsNoam AlumA network attacker can take over VMware's Avi load balancer with no password. Patch now.https://suriq.io/blog/vmware-avi-load-balancer-control-plane-flaws-vmsa-2026-0005/https://suriq.io/blog/vmware-avi-load-balancer-control-plane-flaws-vmsa-2026-0005/Broadcom's VMSA-2026-0005 patches seven VMware Avi Load Balancer flaws, including a CVSS 9.8 unauthenticated control-plane bypass. No workaround exists.Sat, 18 Jul 2026 09:37:00 GMTSecurity newsSuriq's JackA stranger with no login can take over WordPress sites on 6.9 and 7.0. Patch now.https://suriq.io/blog/wordpress-core-wp2shell-unauth-rce-cve-2026-63030/https://suriq.io/blog/wordpress-core-wp2shell-unauth-rce-cve-2026-63030/WordPress Core 6.9 and 7.0 carry wp2shell (CVE-2026-63030), an unauthenticated remote code execution flaw. Update to 6.9.5 or 7.0.2 right away, then hunt.Fri, 17 Jul 2026 22:55:08 GMTSecurity newsNoam AlumClickLock locks your Mac until you hand over the passwordhttps://suriq.io/blog/clicklock-macos-coercion-stealer/https://suriq.io/blog/clicklock-macos-coercion-stealer/ClickLock is a macOS infostealer that kills your apps every 210ms until you type your login password into a fake prompt.Fri, 17 Jul 2026 19:25:30 GMTSecurity newsSuriq's JackAI wrote most of this IoT botnet, badly. That helps defenders.https://suriq.io/blog/tuxbot-ai-built-iot-botnet/https://suriq.io/blog/tuxbot-ai-built-iot-botnet/Unit 42 found TuxBot v3, an IoT botnet largely written with an AI. The build is 70% broken, the working core is plain Mirai, and your defenses still hold.Fri, 17 Jul 2026 16:45:10 GMTSecurity newsThought leadershipNoam AlumA booby-trapped code repository can hijack a Windows PC the moment you open it in Cursorhttps://suriq.io/blog/cursor-windows-malicious-git-repo-rce/https://suriq.io/blog/cursor-windows-malicious-git-repo-rce/A malicious repository can run code when opened in Cursor on Windows through a planted git.exe. CVE-2026-63093 has no patch yet. How to detect and contain it.Fri, 17 Jul 2026 15:08:40 GMTSecurity newsSuriq's JackSharePoint's new RCE is live, and patching alone won't clean ithttps://suriq.io/blog/sharepoint-cve-2026-58644-machine-key-persistence/https://suriq.io/blog/sharepoint-cve-2026-58644-machine-key-persistence/CVE-2026-58644, a SharePoint deserialization RCE, is in CISA's KEV catalog and exploited as a zero-day. Patching alone won't evict an attacker who stole keys.Fri, 17 Jul 2026 11:40:11 GMTSecurity newsNoam AlumA crafted web request can make Apache Camel's Solr routes call out to an attackerhttps://suriq.io/blog/apache-camel-solr-header-injection-ssrf-cve-2026-48203/https://suriq.io/blog/apache-camel-solr-header-injection-ssrf-cve-2026-48203/CVE-2026-48203: Camel's SolrParam. and SolrField. header prefixes slip past its HTTP header filter, letting outside requests inject Solr parameters and forceFri, 17 Jul 2026 11:10:53 GMTSecurity newsSuriq's JackA single Envoy Gateway policy can hand a user the keys to your Kubernetes clusterhttps://suriq.io/blog/envoy-gateway-lua-validator-file-read-cve-2026-53713/https://suriq.io/blog/envoy-gateway-lua-validator-file-read-cve-2026-53713/CVE-2026-53713 (CVSS 9.1): a path check in Envoy Gateway misses double slashes, letting a submitted Lua policy read the controller's Kubernetes token and TLSThu, 16 Jul 2026 19:37:33 GMTSecurity newsNoam AlumFully patched Windows, no fix: a new local privilege zero-dayhttps://suriq.io/blog/legacyhive-windows-profsvc-privilege-zero-day/https://suriq.io/blog/legacyhive-windows-profsvc-privilege-zero-day/LegacyHive is a Windows User Profile Service privilege-escalation zero-day that works on fully patched systems, with no CVE and no fix yet.Thu, 16 Jul 2026 15:45:59 GMTSecurity newsSuriq's JackA booby-trapped Linux app can escape its sandbox through the audio server and run on your systemhttps://suriq.io/blog/pipewire-pulseaudio-sandbox-escape/https://suriq.io/blog/pipewire-pulseaudio-sandbox-escape/CVE-2026-5674 lets a sandboxed Linux app abuse PipeWire's PulseAudio layer to load a malicious library and run code outside the sandbox.Thu, 16 Jul 2026 14:09:47 GMTSecurity newsNoam AlumOld signed UEFI shims still bypass Secure Boot. Update dbxhttps://suriq.io/blog/uefi-shims-secure-boot-revocation/https://suriq.io/blog/uefi-shims-secure-boot-revocation/ESET found 11 old Microsoft-signed UEFI shims that bypass Secure Boot on almost any system. Apply the June dbx revocation and verify it across your fleet.Thu, 16 Jul 2026 11:37:35 GMTSecurity newsSuriq's JackA WatchGuard firewall can be taken over through its single sign-on agent, no login requiredhttps://suriq.io/blog/watchguard-firebox-unauth-rce-cve-2026-8247/https://suriq.io/blog/watchguard-firebox-unauth-rce-cve-2026-8247/CVE-2026-8247 lets a network-adjacent attacker run code as root on WatchGuard Firebox firewalls with no login.Thu, 16 Jul 2026 08:10:30 GMTSecurity newsNoam AlumAsyncAPI's npm packages shipped malware with valid provenance. The supply-chain checkmark waved it through.https://suriq.io/blog/asyncapi-npm-provenance-signed-malware/https://suriq.io/blog/asyncapi-npm-provenance-signed-malware/Four @asyncapi npm packages shipped a malware loader carrying valid OIDC provenance attestations.Wed, 15 Jul 2026 15:51:58 GMTSecurity newsSuriq's JackRabbitMQ's takeover flaw is conditional. The quiet one isn't.https://suriq.io/blog/rabbitmq-oauth-secret-leak-cve-2026-57219/https://suriq.io/blog/rabbitmq-oauth-secret-leak-cve-2026-57219/RabbitMQ patched CVE-2026-57219 and CVE-2026-57221. The severe OAuth secret leak needs OAuth configured; the quiet metadata bug hits every shared virtual host.Wed, 15 Jul 2026 11:23:11 GMTSecurity newsNoam AlumA rogue extension can still make Claude in Chrome read your Gmailhttps://suriq.io/blog/claude-chrome-extension-forged-click-gmail/https://suriq.io/blog/claude-chrome-extension-forged-click-gmail/A rogue browser extension can forge a click that makes Claude for Chrome read your Gmail, Docs, and Calendar, unpatched across eight releases.Wed, 15 Jul 2026 09:07:01 GMTSecurity newsSuriq's JackGrafana's AI connector can leak its access token to a stranger and reach into your cloudhttps://suriq.io/blog/grafana-mcp-server-token-leak-ssrf/https://suriq.io/blog/grafana-mcp-server-token-leak-ssrf/A high-severity flaw (CVSS 8.6) in Grafana's MCP server lets an unauthenticated attacker steal its Grafana service-account token and relay requests intoWed, 15 Jul 2026 08:11:56 GMTSecurity newsNoam AlumTwo SonicWall remote-access zero-days are under attack, and patching alone will not clean the boxhttps://suriq.io/blog/sonicwall-sma1000-zero-days-exploited-2026-07-14/https://suriq.io/blog/sonicwall-sma1000-zero-days-exploited-2026-07-14/SonicWall patched two actively exploited SMA 1000 zero-days, CVE-2026-15409 and CVE-2026-15410.Tue, 14 Jul 2026 20:11:52 GMTSecurity newsNoam AlumTwo Microsoft zero-days were exploited before the fix shippedhttps://suriq.io/blog/microsoft-patch-tuesday-zero-days-exploited/https://suriq.io/blog/microsoft-patch-tuesday-zero-days-exploited/Microsoft's July 2026 Patch Tuesday fixes two zero-days already exploited in the wild: an ADFS and a SharePoint Server privilege bug.Tue, 14 Jul 2026 18:28:35 GMTSecurity newsNoam AlumSAP's highest-scored July flaw is not the one to patch firsthttps://suriq.io/blog/sap-july-2026-critical-patch-priority/https://suriq.io/blog/sap-july-2026-critical-patch-priority/SAP's July 2026 patch day has three criticals. The top-scored 9.9 NetWeaver bug needs a login; the two pre-auth 9.1s in AppRouter and Commerce Cloud go first.Tue, 14 Jul 2026 16:44:45 GMTSecurity newsSuriq's JackNotarized by Apple, still malware: the CrashStealer Mac stealerhttps://suriq.io/blog/crashstealer-notarized-macos-gatekeeper/https://suriq.io/blog/crashstealer-notarized-macos-gatekeeper/CrashStealer is a macOS info-stealer that Apple notarized, so Gatekeeper cleared it on launch before it drained keychains, browser logins and crypto wallets.Tue, 14 Jul 2026 11:51:34 GMTSecurity newsNoam AlumThe appliances you install to be safer were the week’s most dangerous bugshttps://suriq.io/blog/signal-safety-appliances-broke-authorization/https://suriq.io/blog/signal-safety-appliances-broke-authorization/Dell Data Domain, Progress ShareFile and BeyondTrust all failed at authorization this week.Tue, 14 Jul 2026 09:16:57 GMTDeep diveSuriq's JackAn 18-year-old Cisco router flaw is being exploited, and no patch is cominghttps://suriq.io/blog/cisco-ios-csrf-legacy-router-kev-exploited/https://suriq.io/blog/cisco-ios-csrf-legacy-router-kev-exploited/CISA flagged an 18-year-old Cisco IOS flaw (CVE-2008-4128) as actively exploited. What it hits, why old routers are the target, and how to shut it down.Tue, 14 Jul 2026 05:40:40 GMTSecurity newsSuriq's JackHow a PNG in a pull request makes AI agents leak secretshttps://suriq.io/blog/ghostcommit-png-prompt-injection-ai-agents/https://suriq.io/blog/ghostcommit-png-prompt-injection-ai-agents/Researchers hid prompt-injection text inside a PNG in a pull request and made AI coding agents read .env and leak the secrets.Mon, 13 Jul 2026 16:26:45 GMTSecurity newsSuriq's JackMass CMS campaign turns unpatched plugins into webshellshttps://suriq.io/blog/cms-webshell-campaign-unpatched-plugins/https://suriq.io/blog/cms-webshell-campaign-unpatched-plugins/Australia's cyber agency warns of a global campaign mass-exploiting 16 known CMS and plugin flaws to drop webshells on WordPress, Joomla and Craft sites.Mon, 13 Jul 2026 12:32:15 GMTSecurity newsNoam AlumA Helix Ultimate flaw lets an anonymous visitor hijack a Joomla admin, and a working exploit is now publichttps://suriq.io/blog/helix-ultimate-joomla-unauthenticated-menu-xss/https://suriq.io/blog/helix-ultimate-joomla-unauthenticated-menu-xss/A public exploit now targets CVE-2026-57829, an unauthenticated stored XSS in the Helix Ultimate Joomla framework below 2.2.7.Mon, 13 Jul 2026 08:24:03 GMTSecurity newsSuriq's JackA cache-plugin flaw backdoored 17,000 WordPress sites. A max-severity bug got 77.https://suriq.io/blog/wp-shellstorm-wordpress-webshell-detection/https://suriq.io/blog/wp-shellstorm-wordpress-webshell-detection/An exposed server revealed WP-SHELLSTORM, a WordPress and Joomla webshell operation. Its own logs show CVE severity barely predicted which sites got hacked.Sun, 12 Jul 2026 19:28:51 GMTSecurity newsNoam AlumA single rigged device name can hijack an OpenWrt router's admin panelhttps://suriq.io/blog/openwrt-luci-dhcpv6-hostname-xss/https://suriq.io/blog/openwrt-luci-dhcpv6-hostname-xss/A stored XSS in OpenWrt's LuCI web panel (CVE-2026-61876, CVSS 8.8) lets a device on the LAN plant a script in a DHCPv6 hostname that runs in the admin'sSun, 12 Jul 2026 19:08:34 GMTSecurity newsSuriq's JackGhost accounts are mapping your GitHub org. The recon is invisible; the stolen token is not.https://suriq.io/blog/github-org-enumeration-ghost-accounts-leaked-tokens/https://suriq.io/blog/github-org-enumeration-ghost-accounts-leaked-tokens/Datadog found 50+ dormant GitHub accounts enumerating corporate orgs through the public API, some escalating to private-repo clones with stolen tokens.Sun, 12 Jul 2026 16:17:01 GMTSecurity newsNoam AlumZimbra's Classic Web Client can run code from a crafted email again. Patch to 10.1.19 now.https://suriq.io/blog/zimbra-classic-web-client-crafted-email-xss/https://suriq.io/blog/zimbra-classic-web-client-crafted-email-xss/Zimbra shipped ZCS 10.1.19 to fix a stored XSS in the Classic Web Client that runs code from a crafted email. Google TAG reported it; no public exploit yet.Sun, 12 Jul 2026 12:49:32 GMTSecurity newsSuriq's Jacknpm just killed install-script malware by default. This week's other attack walks right past it.https://suriq.io/blog/npm-12-install-scripts-supply-chain-blind-spot/https://suriq.io/blog/npm-12-install-scripts-supply-chain-blind-spot/npm 12 disables install scripts by default, which would have stopped this week's jscrambler infostealer.Sat, 11 Jul 2026 19:24:17 GMTSecurity newsNoam AlumProgress tells ShareFile users to shut servers down, and no patch means assume breachhttps://suriq.io/blog/progress-sharefile-storage-zone-shutdown/https://suriq.io/blog/progress-sharefile-storage-zone-shutdown/Progress told ShareFile customers to shut down on-premises Storage Zone Controllers over a credible threat.Sat, 11 Jul 2026 16:24:46 GMTSecurity newsSuriq's JackSuper Forms flaw lets anyone take over a WordPress site, and a working exploit is now publichttps://suriq.io/blog/super-forms-wordpress-file-upload-rce/https://suriq.io/blog/super-forms-wordpress-file-upload-rce/A critical flaw (CVSS 9.8) in the Super Forms WordPress plugin lets unauthenticated attackers run code on the server.Sat, 11 Jul 2026 16:09:40 GMTSecurity newsNoam AlumGigaWiper fakes a ransomware hit to cover a disk wipe, and the only early warning is on the hosthttps://suriq.io/blog/gigawiper-fake-ransomware-disk-wiper/https://suriq.io/blog/gigawiper-fake-ransomware-disk-wiper/GigaWiper encrypts files to .candy with no key and no ransom note, because the ransomware is a decoy for a disk wipe. Here are the host signals that catch it.Sat, 11 Jul 2026 11:48:10 GMTSecurity newsSuriq's JackA rigged Jira ticket can trick the mcp-atlassian AI connector into leaking server fileshttps://suriq.io/blog/mcp-atlassian-upload-arbitrary-file-read/https://suriq.io/blog/mcp-atlassian-upload-arbitrary-file-read/mcp-atlassian before 0.22.0 reads files off its own host when a caller or a prompt-injected agent supplies a server-side path.Sat, 11 Jul 2026 00:56:51 GMTSecurity newsNoam AlumTwo more Joomla extensions hit the exploited list. It is the same bug, five times now.https://suriq.io/blog/joomla-balbooa-icagenda-upload-rce-kev/https://suriq.io/blog/joomla-balbooa-icagenda-upload-rce-kev/CISA added Balbooa Forms (CVE-2026-56291) and iCagenda (CVE-2026-48939) to its exploited list on July 10, the fourth and fifth Joomla extension with the sameFri, 10 Jul 2026 18:57:14 GMTSecurity newsSuriq's JackThree attacks in one week turned AI coding agents into an unmonitored way onto your networkhttps://suriq.io/blog/hallusquatting-ai-coding-agent-endpoint-risk/https://suriq.io/blog/hallusquatting-ai-coding-agent-endpoint-risk/HalluSquatting and Friendly Fire show AI coding agents running attacker code with a developer's privileges. No CVE, no patch. Here is the detection posture.Fri, 10 Jul 2026 16:58:22 GMTSecurity newsNoam AlumThree ransomware responders secretly worked for BlackCat. Trust is the attack surface.https://suriq.io/blog/insider-ransomware-negotiators-blackcat/https://suriq.io/blog/insider-ransomware-negotiators-blackcat/Three incident-response insiders at DigitalMint and Sygnia were sentenced for helping run BlackCat ransomware, one leaking victims' insurance limits.Fri, 10 Jul 2026 11:58:07 GMTSecurity newsSuriq's JackA fake 7-Zip installer rents your server out as a residential proxy, and file scans miss ithttps://suriq.io/blog/lurking-lizard-fake-7zip-residential-proxy/https://suriq.io/blog/lurking-lizard-fake-7zip-residential-proxy/A trojanized 7-Zip and VPN campaign called Lurking Lizard turns servers and PCs into residential proxy nodes.Fri, 10 Jul 2026 08:57:13 GMTSecurity newsNoam AlumPatched but still defaced: the Helix3 Joomla flaw that hides in your database, not your fileshttps://suriq.io/blog/helix3-joomla-antonkill-database-defacement/https://suriq.io/blog/helix3-joomla-antonkill-database-defacement/An unauthenticated bug in JoomShaper's Helix3 (CVE-2026-49049) is defacing Joomla sites. It hides in the database, so patching to 3.1.2 alone won't clean it.Fri, 10 Jul 2026 08:41:28 GMTSecurity newsSuriq's JackGhostLock turns any Linux foothold into host root, and containers don't stop ithttps://suriq.io/blog/ghostlock-linux-kernel-container-escape-root/https://suriq.io/blog/ghostlock-linux-kernel-container-escape-root/GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel flaw that turns any local foothold into host root and escapes containers. Who is exposed, how to patch.Thu, 09 Jul 2026 20:04:37 GMTSecurity newsNoam AlumA Google chatbot 'edit' permission was really a code-execution granthttps://suriq.io/blog/dialogflow-cx-rogue-agent-edit-permission/https://suriq.io/blog/dialogflow-cx-rogue-agent-edit-permission/Google's Dialogflow CX let one edit permission run code across every chatbot in a project.Thu, 09 Jul 2026 15:12:57 GMTSecurity newsSuriq's JackGodDamn ransomware blinds EDR with a signed kernel driver. Detect the load, not the file.https://suriq.io/blog/signed-kernel-driver-edr-killer/https://suriq.io/blog/signed-kernel-driver-edr-killer/GodDamn ransomware uses PoisonX, a kernel driver carrying a valid Microsoft signature, to disable EDR.Thu, 09 Jul 2026 12:34:05 GMTSecurity newsNoam AlumHow to Use the Wazuh API: Authenticate, Query Agents, and Automatehttps://suriq.io/blog/how-to-use-wazuh-api/https://suriq.io/blog/how-to-use-wazuh-api/How to use the Wazuh API: authenticate on port 55000 for a JWT token, then query your agents and automate with copy-pasteable curl commands and a workedThu, 09 Jul 2026 09:25:02 GMTExplainersSuriq's JackFive Tenda router models ship a hidden admin password. With no patch, containment is the only move.https://suriq.io/blog/tenda-router-hardcoded-backdoor-no-patch/https://suriq.io/blog/tenda-router-hardcoded-backdoor-no-patch/CERT/CC flagged a hardcoded admin password in five Tenda router models (CVE-2026-11405). No fix exists yet, so here is how to detect and contain it.Thu, 09 Jul 2026 08:36:46 GMTSecurity newsNoam AlumA public GitHub issue made an AI agent leak a private repo. No patch closes this class.https://suriq.io/blog/gitlost-github-agent-repo-leak/https://suriq.io/blog/gitlost-github-agent-repo-leak/A crafted public GitHub issue tricked an AI Agentic Workflow into posting a private repo's contents as a public comment. Why no patch closes this class.Wed, 08 Jul 2026 18:56:33 GMTSecurity newsThought leadershipSuriq's JackTwo pre-auth bypasses hit BeyondTrust's privileged-access appliances, found by the vendor's own AIhttps://suriq.io/blog/beyondtrust-remote-support-pra-auth-bypass/https://suriq.io/blog/beyondtrust-remote-support-pra-auth-bypass/BeyondTrust patched four flaws in Remote Support and Privileged Remote Access, including two pre-auth CVSS 9.2 bypasses. Upgrade to 25.3.3 and hunt the window.Wed, 08 Jul 2026 15:29:36 GMTSecurity newsNoam AlumA low-privilege user could overreach on Dell's Data Domain backup appliances. The fix is out.https://suriq.io/blog/dell-data-domain-authorization-flaw-cve-2026-56086/https://suriq.io/blog/dell-data-domain-authorization-flaw-cve-2026-56086/CVE-2026-56086 lets a low-privileged remote user gain unauthorized access on Dell PowerProtect Data Domain backup appliances. CVSS 8.8. Patched builds are out.Wed, 08 Jul 2026 14:38:37 GMTSecurity newsSuriq's JackTwo Joomla page builders are exploited for site takeover. The patch won't evict the intruder.https://suriq.io/blog/joomla-page-builder-uploads-exploited-kev/https://suriq.io/blog/joomla-page-builder-uploads-exploited-kev/CISA flagged two CVSS-10 Joomla page-builder flaws, SP Page Builder (CVE-2026-48908) and Page Builder CK (CVE-2026-56290), as exploited.Wed, 08 Jul 2026 12:05:22 GMTSecurity newsNoam AlumA logged-in user can hijack the Linux graphics server, and on many systems that means roothttps://suriq.io/blog/xorg-xwayland-graphics-server-memory-corruption/https://suriq.io/blog/xorg-xwayland-graphics-server-memory-corruption/X.Org patched two memory-corruption bugs in the X server and XWayland. A local client can reach root where Xorg runs as root. Update to 21.1.24 and 24.1.13.Wed, 08 Jul 2026 08:41:02 GMTSecurity newsSuriq's JackAdobe ColdFusion is under active attack, but the max-severity rating overstates who is exposedhttps://suriq.io/blog/adobe-coldfusion-cve-2026-48282-exploited-kev/https://suriq.io/blog/adobe-coldfusion-cve-2026-48282-exploited-kev/Adobe ColdFusion flaw CVE-2026-48282 (CVSS 10.0) is now exploited in the wild and in CISA KEV. Who is actually exposed, how to detect it, and what to patch.Tue, 07 Jul 2026 20:11:04 GMTSecurity newsNoam AlumThe new Cavern C2 needs no CVE. It abuses your IT provider's own tools to get in.https://suriq.io/blog/cavern-manticore-c2-no-cve-it-provider-supply-chain/https://suriq.io/blog/cavern-manticore-c2-no-cve-it-provider-supply-chain/Check Point ties the Iran-linked Cavern C2 to intrusions that skip vulnerabilities entirely, abusing IT providers' own deployment tools.Tue, 07 Jul 2026 19:16:01 GMTSecurity newsNoam AlumDjango shipped three low-severity security fixes. One of them deserves a closer look.https://suriq.io/blog/django-6-0-7-5-2-16-security-release/https://suriq.io/blog/django-6-0-7-5-2-16-security-release/Django 6.0.7 and 5.2.16 patch three low-severity issues: a header injection, a cache data leak, and a heap over-read.Tue, 07 Jul 2026 15:11:35 GMTSecurity newsSuriq's JackJanuscape: nested virtualization reopens a 16-year-old escape out of the KVM guesthttps://suriq.io/blog/januscape-kvm-guest-host-vm-escape/https://suriq.io/blog/januscape-kvm-guest-host-vm-escape/Januscape (CVE-2026-53359) is a 16-year-old KVM use-after-free that lets a rooted guest VM crash its Linux host. Nested virtualization is the trigger.Tue, 07 Jul 2026 12:32:41 GMTSecurity newsSuriq's JackA default in Red Hat's Linux login system lets one directory account seize root on every serverhttps://suriq.io/blog/sssd-sudo-default-root-escalation/https://suriq.io/blog/sssd-sudo-default-root-escalation/CVE-2026-14474: when SSSD's LDAP sudo provider has no explicit search base, one directory account can plant a rule that grants root on every enrolled LinuxTue, 07 Jul 2026 11:09:11 GMTSecurity newsNoam AlumGitea's Docker image trusts a login header from anyone, and probing has startedhttps://suriq.io/blog/gitea-docker-reverse-proxy-auth-bypass/https://suriq.io/blog/gitea-docker-reverse-proxy-auth-bypass/A default in Gitea's Docker image trusts the X-WEBAUTH-USER header from any IP, so anyone can log in as any user.Mon, 06 Jul 2026 18:39:23 GMTSecurity newsNoam AlumFormie's second hidden-field flaw in five weeks lets a stranger run code on your Craft CMS sitehttps://suriq.io/blog/formie-craft-cms-template-injection/https://suriq.io/blog/formie-craft-cms-template-injection/Formie for Craft CMS has a critical flaw (CVE-2026-52889) that lets an unauthenticated visitor inject Twig template code through a hidden field.Mon, 06 Jul 2026 17:10:09 GMTSecurity newsSuriq's JackAI reopened a 2017-audited filesystem and found seven bugs your devices can't patchhttps://suriq.io/blog/fatfs-embedded-devices-seven-flaws-no-patch/https://suriq.io/blog/fatfs-embedded-devices-seven-flaws-no-patch/runZero found seven flaws in FatFs, the filesystem inside millions of cameras, drones and controllers. No upstream patch exists. How to detect and contain it.Mon, 06 Jul 2026 11:41:27 GMTSecurity newsNoam AlumSUSE Rancher patched critical flaws that turn a small foothold into full control of your Kubernetes clustershttps://suriq.io/blog/rancher-fleet-foothold-to-cluster-takeover/https://suriq.io/blog/rancher-fleet-foothold-to-cluster-takeover/SUSE Rancher and Fleet patched critical flaws that let a leaked token or one tenant account seize whole Kubernetes clusters.Mon, 06 Jul 2026 10:54:23 GMTSecurity newsSuriq's JackKairos stole 2TB, encrypted nothing, and still got $1M. Watch the login, not the file locker.https://suriq.io/blog/kairos-encryptionless-extortion-detection/https://suriq.io/blog/kairos-encryptionless-extortion-detection/Kairos stole 2TB from a US county, encrypted nothing, and was paid $1M. Encryptionless extortion breaks file-locker alarms. Detect the login and egress.Sun, 05 Jul 2026 16:39:45 GMTSecurity newsNoam AlumWe said a password reset wouldn't stop FortiBleed. Now it is deploying ransomware.https://suriq.io/blog/fortibleed-credentials-inc-lynx-ransomware/https://suriq.io/blog/fortibleed-credentials-inc-lynx-ransomware/FortiBleed harvested 110 million Fortinet credentials. SOCRadar links that access to INC and Lynx ransomware, with 12 encryptions and a Nextcloud zero-day.Sun, 05 Jul 2026 11:34:59 GMTSecurity newsSuriq's JackA poisoned security scanner ran on your build server and walked out with your cloud keyshttps://suriq.io/blog/teampcp-supply-chain-cloud-credentials/https://suriq.io/blog/teampcp-supply-chain-cloud-credentials/The FBI's TeamPCP FLASH alert shows why a trojanized scanner steals from your servers, not the registry, and why pinning packages will not save you.Sun, 05 Jul 2026 08:39:18 GMTSecurity newsNoam AlumA Linux kernel bug called Bad Epoll turns a sandboxed process into root, and the exploit is now publichttps://suriq.io/blog/bad-epoll-linux-kernel-privesc-sandbox-escape/https://suriq.io/blog/bad-epoll-linux-kernel-privesc-sandbox-escape/Bad Epoll (CVE-2026-46242) lets a sandboxed or unprivileged process reach root on Linux 6.4+ and Android. Fixed in April; a public 99% exploit now exists.Sat, 04 Jul 2026 19:29:45 GMTSecurity newsSuriq's JackNo password needed: a public exploit now hijacks unpatched Control Web Panel servershttps://suriq.io/blog/control-web-panel-cve-2026-57517-public-exploit/https://suriq.io/blog/control-web-panel-cve-2026-57517-public-exploit/A public exploit for a critical Control Web Panel flaw (CVE-2026-57517) lets unauthenticated attackers seize hosting servers. Patch to 0.9.8.1225 and hunt now.Sat, 04 Jul 2026 15:12:49 GMTSecurity newsNoam AlumThe FBI seized NetNut's proxy network. Its two million compromised devices are still infected.https://suriq.io/blog/netnut-proxy-takedown-devices-still-infected/https://suriq.io/blog/netnut-proxy-takedown-devices-still-infected/The FBI and Google seized the NetNut residential proxy network on July 2, but its two million compromised devices are still infected. Why IP reputation fails.Sat, 04 Jul 2026 11:53:59 GMTSecurity newsNoam AlumScattered Spider keeps winning because your help desk, not a CVE, is the way inhttps://suriq.io/blog/scattered-spider-help-desk-attack/https://suriq.io/blog/scattered-spider-help-desk-attack/An extradited Scattered Spider suspect breached a retailer in under three hours through a help-desk password reset. Here is the identity control that stops it.Sat, 04 Jul 2026 09:07:08 GMTSecurity newsNoam AlumKemp LoadMaster's quote sanitizer became a pre-auth root RCE, exploited hours after the writeup droppedhttps://suriq.io/blog/kemp-loadmaster-cve-2026-8037-exploited/https://suriq.io/blog/kemp-loadmaster-cve-2026-8037-exploited/Kemp LoadMaster's CVE-2026-8037 gives unauthenticated root through its API and is under active exploitation. Affected versions, the fix, and how to detect it.Fri, 03 Jul 2026 15:37:59 GMTSecurity newsNoam AlumThe first AI-run ransomware locked a database with a key it never savedhttps://suriq.io/blog/ai-agent-ransomware-langflow-unrecoverable/https://suriq.io/blog/ai-agent-ransomware-langflow-unrecoverable/The first ransomware attack run end to end by an AI agent broke in through a year-old Langflow flaw and encrypted a database with a key it never saved.Fri, 03 Jul 2026 12:17:09 GMTSecurity newsNoam AlumCursor's AI agent trusted the content it read, and that content could switch off its sandboxhttps://suriq.io/blog/cursor-duneslide-sandbox-escape-rce/https://suriq.io/blog/cursor-duneslide-sandbox-escape-rce/Two critical Cursor flaws, DuneSlide (CVE-2026-50548/50549, CVSS 9.8), let a poisoned MCP server or web result overwrite the sandbox binary and run code.Fri, 03 Jul 2026 08:42:31 GMTSecurity newsNoam AlumPuppet stored the passwords it was told to hide in cleartext on every managed nodehttps://suriq.io/blog/puppet-resource-api-cleartext-secrets/https://suriq.io/blog/puppet-resource-api-cleartext-secrets/CVE-2026-8804: Puppet's Resource API stopped honoring the sensitive flag, writing passwords in cleartext to each agent's state cache. Upgrade, then rotate.Fri, 03 Jul 2026 08:26:20 GMTSecurity newsSuriq's JackArgo CD can be taken over from inside your cluster, and there is no patch to wait forhttps://suriq.io/blog/argo-cd-repo-server-unauth-rce-no-patch/https://suriq.io/blog/argo-cd-repo-server-unauth-rce-no-patch/Argo CD's repo-server runs code for unauthenticated callers and can take over your Kubernetes cluster. No patch or CVE exists yet, so isolate and watch it now.Thu, 02 Jul 2026 19:07:00 GMTSecurity newsNoam AlumA rigged puzzle talked six AI browsers into leaking a developer's SSH keys. One patch won't save you.https://suriq.io/blog/bioshocking-ai-browser-agent-credential-leak/https://suriq.io/blog/bioshocking-ai-browser-agent-credential-leak/A game-themed web page talked six AI browsers into leaking a developer's SSH keys. Why patching one vendor is not the fix, and what to watch instead.Thu, 02 Jul 2026 15:51:49 GMTSecurity newsNoam AlumFake exploit code is delivering ChocoPoC, a stealer aimed at the researchers who run ithttps://suriq.io/blog/chocopoc-fake-poc-exploit-stealer/https://suriq.io/blog/chocopoc-fake-poc-exploit-stealer/ChocoPoC hides a credential-stealing trojan inside fake CVE proof-of-concept repos, targeting the researchers and red teams who download and test them.Thu, 02 Jul 2026 11:47:01 GMTSecurity newsNoam AlumHow to Use Wazuh: A Practitioner's Guide to Agents, the Dashboard, and Detectionhttps://suriq.io/blog/how-to-use-wazuh/https://suriq.io/blog/how-to-use-wazuh/How to use Wazuh: install the server, enroll an agent, reach the dashboard, and write and test a detection rule with wazuh-logtest.Thu, 02 Jul 2026 09:12:41 GMTExplainersNoam AlumMicrosoft said this SharePoint bug was unlikely to be exploited. CISA just proved it wrong.https://suriq.io/blog/sharepoint-cve-2026-45659-kev-exploited/https://suriq.io/blog/sharepoint-cve-2026-45659-kev-exploited/Microsoft rated SharePoint's CVE-2026-45659 unlikely to be exploited. CISA added it to the KEV catalog on July 1 after active exploitation. Patch and hunt now.Thu, 02 Jul 2026 08:33:26 GMTSecurity newsNoam AlumAdobe's six max-severity ColdFusion flaws have no exploit yet, and that is the countdownhttps://suriq.io/blog/adobe-coldfusion-max-severity-rce-patch/https://suriq.io/blog/adobe-coldfusion-max-severity-rce-patch/Adobe patched six unauthenticated CVSS 10.0 code-execution flaws in ColdFusion (bulletin APSB26-68).Wed, 01 Jul 2026 19:21:44 GMTSecurity newsSuriq's JackMFA did not stop the Azure CLI password spray. A retired login flow is why.https://suriq.io/blog/azure-cli-password-spray-mfa-bypass/https://suriq.io/blog/azure-cli-password-spray-mfa-bypass/A password spray beat Conditional Access at 64 organizations by abusing ROPC, a retired Azure login flow that never triggers an MFA prompt. What to fix now.Wed, 01 Jul 2026 15:44:21 GMTSecurity newsNoam AlumCitrix shipped six NetScaler fixes. One of them isn't done until you change a setting.https://suriq.io/blog/citrix-netscaler-http2-bomb-memory-leak/https://suriq.io/blog/citrix-netscaler-http2-bomb-memory-leak/Citrix fixed six NetScaler flaws, including a pre-login memory leak and an HTTP/2 Bomb denial of service. One fix needs a config change, not just an upgrade.Wed, 01 Jul 2026 12:00:27 GMTSecurity newsSuriq's JackRansomware that runs inside your browser tab, where antivirus cannot see ithttps://suriq.io/blog/browser-only-ransomware-file-system-access/https://suriq.io/blog/browser-only-ransomware-file-system-access/Check Point built browser-only ransomware from a DeepSeek AI output: a web page encrypts your files through a legitimate browser API, with no binary forWed, 01 Jul 2026 11:10:54 GMTSecurity newsSuriq's JackAI keeps inventing web addresses that do not exist. Attackers now buy them first.https://suriq.io/blog/phantom-squatting-ai-hallucinated-domains/https://suriq.io/blog/phantom-squatting-ai-hallucinated-domains/Unit 42 found attackers registering the fake web domains AI models hallucinate, turning a chatbot's answer into a phishing and supply chain threat.Wed, 01 Jul 2026 01:23:38 GMTSecurity newsNoam AlumAn old bash trick makes AI coding agents run the commands they just blockedhttps://suriq.io/blog/ai-coding-agent-guardrail-bypass/https://suriq.io/blog/ai-coding-agent-guardrail-bypass/AI coding agent guardrails fall to GuardFall, a bash trick that bypassed the command safety check in 10 of 11 open-source agents Adversa AI tested.Tue, 30 Jun 2026 19:07:57 GMTSecurity newsNoam Alum119 browser extensions hid malware inside images and fonts for two yearshttps://suriq.io/blog/stegoad-edge-extension-steganography/https://suriq.io/blog/stegoad-edge-extension-steganography/Microsoft pulled 119 malicious Edge extensions in the StegoAd campaign. Steganographic payloads, 2.6 million installs, and a 2FA lesson for defenders.Tue, 30 Jun 2026 16:56:06 GMTSecurity newsNoam AlumOracle E-Business Suite is under attack again, and the patch has been out since Mayhttps://suriq.io/blog/oracle-ebs-payments-cve-2026-46817/https://suriq.io/blog/oracle-ebs-payments-cve-2026-46817/CVE-2026-46817, a CVSS 9.8 flaw in Oracle E-Business Suite Payments, is exploited weeks after Oracle's May patch. What to check and how to fix it now.Tue, 30 Jun 2026 13:07:29 GMTSecurity newsSuriq's JackA forged login key unlocks SimpleHelp servers, and a new stealer is raiding cloud and AI credentialshttps://suriq.io/blog/simplehelp-auth-bypass-djinn-stealer/https://suriq.io/blog/simplehelp-auth-bypass-djinn-stealer/A maximum-severity SimpleHelp flaw, CVE-2026-48558, lets attackers forge a login and is now exploited to drop Djinn Stealer against cloud and AI keys.Tue, 30 Jun 2026 10:55:52 GMTSecurity newsNoam AlumThe code was clean. The toolchain that shipped it was the attack.https://suriq.io/blog/signal-toolchain-is-the-attack-surface/https://suriq.io/blog/signal-toolchain-is-the-attack-surface/This week's most serious compromises were not in application code but in the tools that build, ship, and assist it. The pattern, and what to do.Tue, 30 Jun 2026 09:12:57 GMTDeep diveSuriq's JackA crafted link can stall millions of Node apps, and the patch will not reach most of themhttps://suriq.io/blog/decode-uri-component-dos-patch-gap/https://suriq.io/blog/decode-uri-component-dos-patch-gap/decode-uri-component, the npm decoder behind query-string and millions of apps, has a denial-of-service bug (CVE-2026-45822).Tue, 30 Jun 2026 08:42:11 GMTSecurity newsSuriq's JackYou don't have to install this npm malware. Opening the folder in your editor runs it.https://suriq.io/blog/vscode-folderopen-npm-supply-chain-stealer/https://suriq.io/blog/vscode-folderopen-npm-supply-chain-stealer/Two hijacked npm packages skip the install step entirely. They run when you open the project in VS Code, then steal developer, browser, and wallet logins.Mon, 29 Jun 2026 18:53:09 GMTSecurity newsNoam AlumThe repo is clean. Your AI coding agent is what hands the attacker a shell.https://suriq.io/blog/clean-repo-ai-coding-agent-reverse-shell/https://suriq.io/blog/clean-repo-ai-coding-agent-reverse-shell/Mozilla's 0DIN made Claude Code open a reverse shell from a GitHub repo with no malicious code. Here is why scanners miss it and how to constrain the agent.Mon, 29 Jun 2026 15:54:37 GMTSecurity newsSuriq's JackThis backdoor is named after your VMware and EDR tools. Your allowlist trusts it.https://suriq.io/blog/tinyrct-backdoor-disguised-security-tools/https://suriq.io/blog/tinyrct-backdoor-disguised-security-tools/A Chinese APT called CL-STA-1062 ships its TinyRCT backdoor disguised as VMware and EDR agents. Why filename allowlists miss it, and what to hunt instead.Mon, 29 Jun 2026 12:58:23 GMTSecurity newsNoam AlumSUSE Linux trusted software repositories enough to let one overwrite your system fileshttps://suriq.io/blog/suse-libzypp-repo-metadata-file-overwrite/https://suriq.io/blog/suse-libzypp-repo-metadata-file-overwrite/SUSE and openSUSE patched seven flaws in their package manager. CVE-2026-25707 lets a malicious repository overwrite system files as root.Mon, 29 Jun 2026 11:25:34 GMTSecurity newsSuriq's Jacklibssh2 flaw: a malicious SSH server can hijack the client connecting to ithttps://suriq.io/blog/libssh2-malicious-server-client-rce/https://suriq.io/blog/libssh2-malicious-server-client-rce/libssh2's CVE-2026-55200 lets a malicious SSH server run code on the client that connects to it. No login, a public PoC is out, and there is no tagged fix yet.Mon, 29 Jun 2026 08:30:37 GMTSecurity newsNoam AlumHotels are running malware on a legitimate Node.js runtime, and that beats allowlistinghttps://suriq.io/blog/tonrat-nodejs-hotel-phishing-implant/https://suriq.io/blog/tonrat-nodejs-hotel-phishing-implant/TonRAT runs on a genuine Node.js runtime on hotel front-desk machines, hides its C2 on the TON blockchain, and slips past allowlists. Here is what to hunt.Sun, 28 Jun 2026 18:15:36 GMTSecurity newsSuriq's JackA seized iPhone gave up everything. The MacBook beside it gave up nothing.https://suriq.io/blog/cellebrite-seized-device-encryption-lesson/https://suriq.io/blog/cellebrite-seized-device-encryption-lesson/Cellebrite's UFED tool fully read a locked iPhone in Russian custody but failed on the encrypted MacBook seized beside it.Sun, 28 Jun 2026 16:29:14 GMTSecurity newsNoam AlumLinux's newest root exploits rewrite /bin/su in memory and leave the file cleanhttps://suriq.io/blog/dirtyclone-linux-page-cache-privesc/https://suriq.io/blog/dirtyclone-linux-page-cache-privesc/DirtyClone and pedit COW are the latest in a family of Linux kernel root bugs that rewrite binaries in memory, invisible to file-integrity monitoring.Sun, 28 Jun 2026 12:08:33 GMTSecurity newsSuriq's JackA rigged 7-Zip archive can erase the Windows warning on downloaded files, and there is no fix yethttps://suriq.io/blog/7-zip-archive-strips-windows-download-warning/https://suriq.io/blog/7-zip-archive-strips-windows-download-warning/A crafted RAR5 archive lets 7-Zip 26.02 strip the Mark-of-the-Web, defeating Windows SmartScreen warnings. No patch exists yet.Sun, 28 Jun 2026 09:55:31 GMTSecurity newsNoam AlumSignal's recovery key never expires, and Russian intelligence is now phishing for ithttps://suriq.io/blog/signal-recovery-key-phishing-russia/https://suriq.io/blog/signal-recovery-key-phishing-russia/Russian intelligence is phishing Signal users for the Backup Recovery Key, a secret that decrypts a whole message history and that no reset or new account canSat, 27 Jun 2026 16:29:26 GMTSecurity newsSuriq's JackPolymarket's servers were never hacked. A poisoned vendor script still stole $3 million from users.https://suriq.io/blog/polymarket-frontend-supply-chain-theft/https://suriq.io/blog/polymarket-frontend-supply-chain-theft/A compromised third-party vendor injected malicious code into Polymarket's site and stole nearly $3 million from users. The backend was never breached.Sat, 27 Jun 2026 13:05:27 GMTSecurity newsNoam AlumWhat is MITRE ATT&CK? Tactics, techniques, and how defenders actually use ithttps://suriq.io/blog/what-is-mitre-attack/https://suriq.io/blog/what-is-mitre-attack/A plain-English guide to MITRE ATT&CK: what it is, how its tactics and techniques are organized, a real intrusion mapped step by step, and how defenders use it.Sat, 27 Jun 2026 11:52:08 GMTExplainersSuriq's JackWhat is a SIEM, in plain terms (and how it differs from a SOC and EDR)https://suriq.io/blog/what-is-a-siem/https://suriq.io/blog/what-is-a-siem/What a SIEM is, what it actually does, and how it differs from a SOC, an EDR, and plain log management - explained by a team that runs one.Sat, 27 Jun 2026 11:51:04 GMTExplainersNoam AlumOpen the wrong repo and Amazon Q ran its config file as you, AWS keys includedhttps://suriq.io/blog/amazon-q-mcp-config-repo-rce/https://suriq.io/blog/amazon-q-mcp-config-repo-rce/Amazon Q Developer ran a repo's MCP config file as you, with AWS keys attached. CVE-2026-12957 is patched in 1.69.0. What to verify and hunt for now.Sat, 27 Jun 2026 08:15:12 GMTSecurity newsNoam AlumThe dangerous vulnerabilities this week were already old.https://suriq.io/blog/signal-old-bug-classes-still-dominate/https://suriq.io/blog/signal-old-bug-classes-still-dominate/The vulnerability classes that actually shipped this week are the same five from 2010, even in new AI tooling. The pattern, and what to do.Sat, 27 Jun 2026 06:37:44 GMTDeep diveSuriq's JackA widely used PHP tool for making PDFs can hand attackers your internal files and cloud keyshttps://suriq.io/blog/php-weasyprint-ssrf-file-disclosure/https://suriq.io/blog/php-weasyprint-ssrf-file-disclosure/php-weasyprint's attachment option fetched attacker-controlled URLs server-side, reaching internal services, cloud metadata, and local files.Fri, 26 Jun 2026 22:26:30 GMTSecurity newsNoam AlumRussia's Turla built a new backdoor for one reason: deleting one tool will not evict themhttps://suriq.io/blog/turla-stockstay-backdoor-redundancy/https://suriq.io/blog/turla-stockstay-backdoor-redundancy/Google tied Russia's Turla to STOCKSTAY, a new .NET backdoor built as four swappable parts. Why deleting one piece does not evict the group, and what to hunt.Fri, 26 Jun 2026 18:30:42 GMTSecurity newsDeep diveSuriq's JackWindchill holds your product blueprints. A web shell on its login page hands them over.https://suriq.io/blog/ptc-windchill-cve-2026-12569-exploited/https://suriq.io/blog/ptc-windchill-cve-2026-12569-exploited/CISA added PTC Windchill RCE CVE-2026-12569 to its KEV catalog after web shells hit exposed PLM servers. Patch to 11.0 M030 before the June 28 deadline.Fri, 26 Jun 2026 16:46:02 GMTSecurity newsSuriq's JackMistic backdoor writes nothing to disk and quietly sells your network to ransomware crewshttps://suriq.io/blog/mistic-backdoor-access-broker-ransomware-setup/https://suriq.io/blog/mistic-backdoor-access-broker-ransomware-setup/Mistic is an in-memory backdoor that access broker KongTuke uses to hold footholds and sell them to Qilin and other ransomware crews. Here is where to catch it.Fri, 26 Jun 2026 11:45:34 GMTSecurity newsNoam AlumOne setting in Red Hat OpenShift Virtualization can expose your VMs to any pod on the clusterhttps://suriq.io/blog/openshift-virtualization-disabletls-vm-exposure/https://suriq.io/blog/openshift-virtualization-disabletls-vm-exposure/CVE-2026-13325: enabling disableTLS for faster live migration in Red Hat OpenShift Virtualization drops authentication, letting any pod reach another tenant’sFri, 26 Jun 2026 11:12:22 GMTSecurity newsSuriq's JackGitLab patched a no-login flaw that can hijack a user's session. Self-hosted servers are the exposed ones.https://suriq.io/blog/gitlab-no-login-session-hijack-patch/https://suriq.io/blog/gitlab-no-login-session-hijack-patch/GitLab's June 24 release fixes 14 flaws, including an unauthenticated cross-site scripting bug.Thu, 25 Jun 2026 05:23:36 GMTSecurity newsNoam AlumA free GitHub account can push code as a trusted maintainer. Upgrading actions/checkout won't fix it.https://suriq.io/blog/cordyceps-github-actions-pull-request-takeover/https://suriq.io/blog/cordyceps-github-actions-pull-request-takeover/Cordyceps lets anyone with a free GitHub account run code as a maintainer on 300+ repos. Why upgrading actions/checkout closes one door, not the others.Thu, 25 Jun 2026 04:06:39 GMTSecurity newsNoam AlumTwo flaws in Unraid's control panel let a logged-in user seize the whole serverhttps://suriq.io/blog/unraid-web-panel-command-injection-rce/https://suriq.io/blog/unraid-web-panel-command-injection-rce/Two command injection flaws in Unraid's web panel, CVE-2026-9772 and CVE-2026-9773, let any logged-in user run code as www-data.Thu, 25 Jun 2026 02:23:59 GMTSecurity newsSuriq's JackA rigged container image can seize root on the host running Docker's AI agent toolshttps://suriq.io/blog/docker-mcp-gateway-malicious-image-root-escape/https://suriq.io/blog/docker-mcp-gateway-malicious-image-root-escape/CVE-2026-55887 lets a malicious container image escape Docker's MCP Gateway and run code as root on the host. Rated 8.7.Thu, 25 Jun 2026 01:37:36 GMTSecurity newsSuriq's JackA new flaw lets attackers take over Quest NetVault backup servers, login or nothttps://suriq.io/blog/quest-netvault-backup-rce-cve-2026-7570/https://suriq.io/blog/quest-netvault-backup-rce-cve-2026-7570/CVE-2026-7570 is a SQL-injection-to-remote-code-execution flaw in Quest NetVault Backup, rated 8.8. The login can be bypassed. Quest fixed it in 14.0.2.Wed, 24 Jun 2026 23:52:11 GMTSecurity newsNoam AlumPolice seized the malware that stole 27 million passwords. The passwords still work.https://suriq.io/blog/stealc-amadey-takedown-stolen-credentials/https://suriq.io/blog/stealc-amadey-takedown-stolen-credentials/Operation Endgame seized the servers behind the Amadey and StealC malware, but the 27 million credentials they already stole stay valid until you rotate them.Wed, 24 Jun 2026 19:26:41 GMTSecurity newsSuriq's JackThe free plugin was clean. The paid update is what backdoored these WordPress sites.https://suriq.io/blog/shapedplugin-wordpress-update-backdoor/https://suriq.io/blog/shapedplugin-wordpress-update-backdoor/Backdoored ShapedPlugin Pro updates stole admin logins and 2FA seeds from WordPress sites between April and June 2026. A password reset alone will not clear it.Wed, 24 Jun 2026 11:32:55 GMTSecurity newsNoam AlumOn 200,000 WordPress sites, a low-level user can quietly steal the admin's loginhttps://suriq.io/blog/ultimate-member-contributor-account-takeover/https://suriq.io/blog/ultimate-member-contributor-account-takeover/A contributor-level user can make Ultimate Member leak every user's password reset link, admins included. Affects versions through 2.11.4; fixed in 2.12.0.Wed, 24 Jun 2026 08:27:39 GMTSecurity newsSuriq's JackCisco Unified CM's flaw is being exploited. Whether it touches you depends on one default setting.https://suriq.io/blog/cisco-unified-cm-cve-2026-20230-exploited/https://suriq.io/blog/cisco-unified-cm-cve-2026-20230-exploited/CVE-2026-20230 in Cisco Unified CM can reach root, but only where WebDialer is enabled, and it ships off. Check that before you panic-patch.Wed, 24 Jun 2026 08:10:45 GMTSecurity newsNoam AlumA guest virtual machine can read its host's memory through a flaw in QEMU's built-in networkinghttps://suriq.io/blog/qemu-libslirp-guest-reads-host-memory/https://suriq.io/blog/qemu-libslirp-guest-reads-host-memory/A patched flaw in libslirp, QEMU's usermode networking, lets a privileged guest virtual machine read gigabytes of host memory. Update to libslirp 4.9.2 now.Wed, 24 Jun 2026 06:22:16 GMTSecurity newsNoam AlumMistype the password and this Lantronix box runs attacker commands as root. CISA says it is happening now.https://suriq.io/blog/lantronix-eds5000-serial-server-root-exploited/https://suriq.io/blog/lantronix-eds5000-serial-server-root-exploited/CISA flagged CVE-2025-67038 as exploited on June 23. A failed login on a Lantronix EDS5000 serial server runs attacker commands as root.Wed, 24 Jun 2026 05:06:09 GMTSecurity newsSuriq's JackCrawl4AI shipped its server unlocked by default. It took three patches to close the door.https://suriq.io/blog/crawl4ai-docker-unauthenticated-rce/https://suriq.io/blog/crawl4ai-docker-unauthenticated-rce/Crawl4AI's Docker API shipped unauthenticated by default, exposing 51,000+ deployments to remote code execution and cloud-metadata SSRF. Upgrade to 0.9.0 now.Wed, 24 Jun 2026 04:11:43 GMTSecurity newsSuriq's JackAdd-ons for the OpenClaw AI assistant are stealing logins and running crypto scamshttps://suriq.io/blog/openclaw-clawhub-malicious-skills/https://suriq.io/blog/openclaw-clawhub-malicious-skills/Malicious OpenClaw skills on the ClawHub marketplace steal credentials and hijack AI agents for crypto fraud, and some slip past the store's own scanner.Tue, 23 Jun 2026 22:25:33 GMTSecurity newsNoam AlumA new Mac backdoor is built to fool the AI that inspects ithttps://suriq.io/blog/macos-gaslight-prompt-injection-analyst/https://suriq.io/blog/macos-gaslight-prompt-injection-analyst/macOS.Gaslight embeds fake AI system messages to make automated, LLM-assisted malware analysis abort.Tue, 23 Jun 2026 22:09:38 GMTSecurity newsNoam AlumJava's most-used JSON library has a guardrail attackers can slip dangerous objects pasthttps://suriq.io/blog/jackson-databind-array-allowlist-bypass/https://suriq.io/blog/jackson-databind-array-allowlist-bypass/CVE-2026-54513 lets attackers bypass jackson-databind's polymorphic type validator by wrapping a banned class in an array. Patch to 2.18.8, 2.21.4 or 3.1.4.Tue, 23 Jun 2026 21:56:06 GMTSecurity newsSuriq's JackAttackers can take over your self-hosted UniFi controller with no password. CISA says it is happening now.https://suriq.io/blog/unifi-os-server-unauth-root-exploited/https://suriq.io/blog/unifi-os-server-unauth-root-exploited/Three chained UniFi OS Server flaws give unauthenticated root. CISA added all three to its exploited list on June 23. Patch to 5.0.8 and check who can reach it.Tue, 23 Jun 2026 19:50:29 GMTSecurity newsSuriq's JackPixelSmash: a video your server opens by itself can run an attacker's codehttps://suriq.io/blog/pixelsmash-ffmpeg-media-pipeline-rce/https://suriq.io/blog/pixelsmash-ffmpeg-media-pipeline-rce/PixelSmash (CVE-2026-8461) lets a crafted video run code on FFmpeg-based media servers like Jellyfin and Nextcloud. Update to FFmpeg 8.1.2, then hunt.Tue, 23 Jun 2026 12:23:58 GMTSecurity newsNoam AlumA WhatsApp invoice is installing real IT software to hijack PCs, and your antivirus waves it throughhttps://suriq.io/blog/whatsapp-invoice-manageengine-rmm-backdoor/https://suriq.io/blog/whatsapp-invoice-manageengine-rmm-backdoor/A fake invoice on WhatsApp silently installs ManageEngine Endpoint Central, a legitimate remote-management tool, to hijack PCs.Tue, 23 Jun 2026 03:59:42 GMTSecurity newsNoam AlumYour self-hosted Gogs server lets any logged-in user read repos that aren't theirshttps://suriq.io/blog/gogs-mirror-settings-local-repo-access/https://suriq.io/blog/gogs-mirror-settings-local-repo-access/A validation gap in Gogs Mirror Settings (CVE-2026-52801) lets any authenticated user import local repositories and reach internal systems. Patch to 0.14.3 now.Tue, 23 Jun 2026 03:08:31 GMTSecurity newsSuriq's JackOne rigged account-sync update can poison your whole app and forge an adminhttps://suriq.io/blog/scim-patch-prototype-pollution-account-sync/https://suriq.io/blog/scim-patch-prototype-pollution-account-sync/CVE-2026-48170 lets one SCIM PATCH request poison Object.prototype across a Node.js app using scim-patch, risking admin forgery. Update to 0.9.1 now.Tue, 23 Jun 2026 01:41:05 GMTSecurity newsSuriq's JackA single Budibase app builder can read your server's secrets and take over every workspacehttps://suriq.io/blog/budibase-pwa-zip-symlink-file-read/https://suriq.io/blog/budibase-pwa-zip-symlink-file-read/CVE-2026-54352 lets a Budibase workspace builder read the server's secret file via a crafted PWA zip and take over every workspace. Patch self-hosted to 3.39.9.Tue, 23 Jun 2026 00:10:44 GMTSecurity newsNoam AlumWashington export-controlled an AI for finding bugs. Your oldest code is the soft target.https://suriq.io/blog/ai-export-control-patch-window/https://suriq.io/blog/ai-export-control-patch-window/The US used export-control powers to pull a frontier AI model that finds software bugs at scale.Mon, 22 Jun 2026 19:07:48 GMTSecurity newsThought leadershipNoam AlumOlder iPhones just got a flaw Apple can't patch, and a cable is all it takeshttps://suriq.io/blog/usbliter8-apple-bootrom-unpatchable-exploit/https://suriq.io/blog/usbliter8-apple-bootrom-unpatchable-exploit/usbliter8 is an unpatchable boot-chain exploit for Apple A12 and A13 devices. Here is the real enterprise risk, why remote wipe will not help, and what to do.Mon, 22 Jun 2026 15:31:48 GMTSecurity newsSuriq's JackPaperCut's Windows print client can be tricked into giving a local attacker total controlhttps://suriq.io/blog/papercut-print-deploy-local-takeover/https://suriq.io/blog/papercut-print-deploy-local-takeover/CVE-2026-6645 lets a local attacker plant a file that PaperCut's Print Deploy client runs with full system rights on Windows. Update to version 1.10.4178.Mon, 22 Jun 2026 04:25:17 GMTSecurity newsSuriq's JackRun Central Dogma across servers? It may be guarding your config with a password printed in its source codehttps://suriq.io/blog/central-dogma-default-secret-cluster-takeover/https://suriq.io/blog/central-dogma-default-secret-cluster-takeover/Central Dogma before 0.84.0 silently uses a public default secret when ZooKeeper replication runs without one set, letting nearby attackers seize the cluster.Mon, 22 Jun 2026 03:10:10 GMTSecurity newsNoam AlumYour Squid proxy can leak other users' passwords, and the 7.6 update won't fix ithttps://suriq.io/blog/squidbleed-squid-proxy-credential-leak/https://suriq.io/blog/squidbleed-squid-proxy-credential-leak/Squidbleed (CVE-2026-47729) leaks memory from Squid proxies in default config, including login credentials. A public exploit is out, and 7.6 does not patch it.Mon, 22 Jun 2026 00:08:18 GMTSecurity newsNoam AlumThat decade-old router you forgot is now scanning networks for attackershttps://suriq.io/blog/arystinger-router-botnet-recon-scanning/https://suriq.io/blog/arystinger-router-botnet-recon-scanning/A botnet called AryStinger hijacked over 4,300 end-of-life D-Link and Linksys routers into a distributed scanning grid for reconnaissance, not DDoS. What to do.Sun, 21 Jun 2026 18:35:49 GMTSecurity newsSuriq's JackMillions of hacked TV boxes now rent attackers a trusted home IP. Your blocklist can't see it.https://suriq.io/blog/popa-residential-proxy-ip-reputation-account-takeover/https://suriq.io/blog/popa-residential-proxy-ip-reputation-account-takeover/Researchers linked the Popa botnet of 2 million hacked TV boxes to a residential proxy service. Here is why IP reputation no longer stops account takeovers.Sun, 21 Jun 2026 16:52:26 GMTSecurity newsSuriq's JackPrinz Eugen ransomware hits your newest files first and never leaves a notehttps://suriq.io/blog/prinz-eugen-ransomware-no-ransom-note/https://suriq.io/blog/prinz-eugen-ransomware-no-ransom-note/Prinz Eugen ransomware encrypts your most recently changed files first and drops no ransom note, defeating canary traps and note-based SOC alerts. What to do.Sun, 21 Jun 2026 11:51:28 GMTSecurity newsDeep diveNoam AlumEaseUS Partition Master left a Windows driver that lets any user seize the whole PChttps://suriq.io/blog/easeus-partition-master-driver-escalation/https://suriq.io/blog/easeus-partition-master-driver-escalation/A signed driver in EaseUS Partition Master (CVE-2026-12781) lets any standard Windows user read and overwrite the whole disk to reach SYSTEM.Sun, 21 Jun 2026 09:55:36 GMTSecurity newsSuriq's JackYour AI agent trusts your own computer. One web page turns that into a takeover.https://suriq.io/blog/autojack-ai-agent-localhost-rce/https://suriq.io/blog/autojack-ai-agent-localhost-rce/Microsoft's AutoJack shows how one web page an AI browsing agent visits can run code on the host. The bug is a near miss. The architecture lesson is not.Sun, 21 Jun 2026 07:46:22 GMTSecurity newsNoam AlumThis login library let a stranger sign in as you with just your emailhttps://suriq.io/blog/ash-authentication-email-account-takeover/https://suriq.io/blog/ash-authentication-email-account-takeover/CVE-2026-49757 (CVSS 9.2) let attackers take over accounts in Elixir apps built on ash_authentication by matching users on email instead of identity.Sun, 21 Jun 2026 07:24:16 GMTSecurity newsSuriq's JackYour Fortinet password reset won't lock the FortiBleed attacker outhttps://suriq.io/blog/fortibleed-cisa-alert-session-reset/https://suriq.io/blog/fortibleed-cisa-alert-session-reset/CISA warned Fortinet users on June 18; reporting counted 86,644 affected devices. Resetting passwords is not enough: kill live sessions and fix the hashing.Sun, 21 Jun 2026 03:18:09 GMTSecurity newsDeep diveNoam AlumvLLM's earlier patch only hid this AI-server bug. Re-enable embeddings and you are still exposedhttps://suriq.io/blog/vllm-prompt-embeds-tensor-validation-flaw/https://suriq.io/blog/vllm-prompt-embeds-tensor-validation-flaw/CVE-2026-56340 lets a crafted tensor crash vLLM (CVSS 8.8) with a path to memory corruption. It only bites if you re-enabled prompt embeds. Fix is 0.13.0.Sun, 21 Jun 2026 02:55:23 GMTSecurity newsSuriq's JackGravity SMTP's 'medium' bug leaks live email API keys to anyone. Patching alone will not save you.https://suriq.io/blog/gravity-smtp-credential-leak-cve-2026-4020/https://suriq.io/blog/gravity-smtp-credential-leak-cve-2026-4020/Gravity SMTP's CVE-2026-4020 hands live Amazon SES, Google, and OAuth keys to unauthenticated visitors on 100,000 WordPress sites.Sat, 20 Jun 2026 16:51:58 GMTSecurity newsNoam AlumPolice scrubbed SocGholish from 15,000 WordPress sites. The way in is still wide open.https://suriq.io/blog/socgholish-operation-endgame-wordpress-takedown/https://suriq.io/blog/socgholish-operation-endgame-wordpress-takedown/Operation Endgame seized 106 SocGholish servers and cleaned 14,971 WordPress sites. The takedown hit an access broker, not the entry vector.Sat, 20 Jun 2026 12:19:16 GMTSecurity newsNoam AlumOne tracing header can make a LangSmith server hand over its fileshttps://suriq.io/blog/langsmith-tracing-header-file-read/https://suriq.io/blog/langsmith-tracing-header-file-read/LangSmith SDK before 0.8.18 lets a crafted tracing header read arbitrary files off any server running TracingMiddleware. Upgrade now; it is the second such bug.Sat, 20 Jun 2026 09:09:23 GMTSecurity newsSuriq's JackA USB worm swaps your crypto address mid-paste, and no breach alarm ever fireshttps://suriq.io/blog/usb-worm-clipper-crypto-clipboard/https://suriq.io/blog/usb-worm-clipper-crypto-clipboard/Microsoft found a USB worm that hijacks the clipboard to swap crypto wallet addresses and hides its command channel in Tor. Here is why it beats your controls.Sat, 20 Jun 2026 07:43:38 GMTSecurity newsDeep diveSuriq's JackThe app you're testing can hijack the AI agent testing it: Appium MCP's XSS flawhttps://suriq.io/blog/appium-mcp-locator-xss-agent-hijack/https://suriq.io/blog/appium-mcp-locator-xss-agent-hijack/An XSS flaw in Appium's official MCP server let a hostile test app hijack the AI agent driving it and call its tools. Patch appium-mcp to 1.85.10 now.Sat, 20 Jun 2026 07:10:40 GMTSecurity newsNoam AlumEDR evasion is now a shipped product. Your agent's silence is the only alarm left.https://suriq.io/blog/gentlemen-edr-killer-byovd-detection/https://suriq.io/blog/gentlemen-edr-killer-byovd-detection/The Gentlemen ransomware gang ships a standardized EDR killer to affiliates using BYOVD. Here is why driver-name hunting fails and what to detect instead.Sat, 20 Jun 2026 04:42:29 GMTSecurity newsDeep diveNoam AlumBranda fixed this WordPress account takeover in January. It is back, and a public exploit is circulating.https://suriq.io/blog/branda-wordpress-account-takeover-cve-2026-11551/https://suriq.io/blog/branda-wordpress-account-takeover-cve-2026-11551/CVE-2026-11551 is a CVSS 9.8 unauthenticated account takeover in the Branda WordPress plugin (versions up to 3.4.29). A public exploit is out.Sat, 20 Jun 2026 03:56:36 GMTSecurity newsSuriq's JackA WordPress form plugin lets a stranger delete your site, the moment an admin lookshttps://suriq.io/blog/wordpress-form-entries-file-deletion-rce/https://suriq.io/blog/wordpress-form-entries-file-deletion-rce/CVE-2026-9843 lets an unauthenticated visitor plant a form entry that deletes WordPress files when an admin opens it.Sat, 20 Jun 2026 02:40:19 GMTSecurity newsNoam AlumA single rigged document can turn Langflow's file reader into full server takeoverhttps://suriq.io/blog/langflow-rag-file-read-rce/https://suriq.io/blog/langflow-rag-file-read-rce/A crafted document in a Langflow RAG pipeline (CVE-2026-55447, CVSS 9.6) reads any file, forges a login token, then runs code. Upgrade to 1.9.2 or later.Sat, 20 Jun 2026 01:25:41 GMTSecurity newsSuriq's JackOne Langflow account can now run every other user's AI workflowhttps://suriq.io/blog/langflow-idor-cross-user-flow-execution/https://suriq.io/blog/langflow-idor-cross-user-flow-execution/A critical IDOR in Langflow (CVE-2026-55255, CVSS 9.9) lets any logged-in user run another user's AI flow. Upgrade to 1.9.1. The real problem is the pattern.Fri, 19 Jun 2026 23:53:51 GMTSecurity newsSuriq's JackMastra's npm packages passed inspection, then turned hostile a day laterhttps://suriq.io/blog/mastra-npm-supply-chain-compromise/https://suriq.io/blog/mastra-npm-supply-chain-compromise/Attackers hijacked a dormant maintainer account to poison 140+ Mastra npm packages with a wallet-stealing payload.Fri, 19 Jun 2026 22:55:50 GMTSecurity newsNoam AlumCoreWCF's SAML check trusted a forged identity as your admin. There is no workaround, only the patch.https://suriq.io/blog/corewcf-saml-signature-bypass/https://suriq.io/blog/corewcf-saml-signature-bypass/CVE-2026-54782 lets an attacker forge a SAML token and impersonate anyone, admins included, on CoreWCF federation services. No workaround.Fri, 19 Jun 2026 21:55:54 GMTSecurity newsSuriq's JackQuarkus fixed a semicolon auth bypass in May. Its encoded cousin just reopened it.https://suriq.io/blog/quarkus-encoded-path-auth-bypass/https://suriq.io/blog/quarkus-encoded-path-auth-bypass/Quarkus fixed a semicolon authorization bypass in May, but CVE-2026-50559 reopens it with URL-encoded characters. What to patch now and how to detect abuse.Fri, 19 Jun 2026 20:56:09 GMTSecurity newsNoam AlumDragonForce hides its C2 inside Microsoft Teams relays. Your network sensors see a clean call.https://suriq.io/blog/dragonforce-teams-relay-c2-backdoor-turn/https://suriq.io/blog/dragonforce-teams-relay-c2-backdoor-turn/DragonForce's Backdoor.Turn routes C2 through Microsoft Teams TURN relays, so network sensors see only Microsoft.Fri, 19 Jun 2026 19:34:51 GMTSecurity newsDeep diveSuriq's JackYour Salesforce wasn't breached. A connected app handed over the data.https://suriq.io/blog/klue-oauth-salesforce-connected-app-breach/https://suriq.io/blog/klue-oauth-salesforce-connected-app-breach/The Icarus group stole Salesforce CRM data through Klue's connected app, not a Salesforce flaw. Why OAuth integration tokens are the unmonitored attack surface.Fri, 19 Jun 2026 14:50:51 GMTSecurity newsSuriq's JackYour JetBrains Hub 2FA protected nothing. The recovery codes were predictable.https://suriq.io/blog/jetbrains-hub-predictable-recovery-codes/https://suriq.io/blog/jetbrains-hub-predictable-recovery-codes/JetBrains Hub generated predictable 2FA recovery codes (CVE-2026-56141, CVSS 9.8), allowing pre-auth account takeover.Fri, 19 Jun 2026 13:37:56 GMTSecurity newsNoam AlumPerry's stdlib turned off JWT expiry checks. Logout stopped meaning anything.https://suriq.io/blog/perry-jwt-expiration-bypass/https://suriq.io/blog/perry-jwt-expiration-bypass/CVE-2026-53776: Perry's bundled JWT helper hard-codes validate_exp = false, so expired and revoked tokens stay valid. Patch to 0.5.1166 and rotate signing keys.Fri, 19 Jun 2026 10:59:11 GMTSecurity newsNoam AlumYour Splunk box runs a database sidecar you never configured. Attackers use it for root.https://suriq.io/blog/splunk-postgres-sidecar-preauth-rce/https://suriq.io/blog/splunk-postgres-sidecar-preauth-rce/CVE-2026-20253 is an unauthenticated RCE in Splunk Enterprise 10.x via a bundled PostgreSQL sidecar. On CISA KEV, exploited now. Patch to 10.0.7 or 10.2.4.Fri, 19 Jun 2026 07:42:37 GMTSecurity newsSuriq's JackTwo NGINX bugs scored 9.2. On a default server you get a crash, not a shell.https://suriq.io/blog/nginx-critical-rce-config-triage/https://suriq.io/blog/nginx-critical-rce-config-triage/F5's two critical NGINX flaws (CVE-2026-42530, CVE-2026-42055) score 9.2, but RCE needs ASLR off and a non-default config. Here is what to actually triage.Fri, 19 Jun 2026 03:45:04 GMTSecurity newsDeep diveNoam AlumINC ransomware never used a zero-day. It used your patch backlog.https://suriq.io/blog/inc-ransomware-patch-backlog-edge-devices/https://suriq.io/blog/inc-ransomware-patch-backlog-edge-devices/INC reached top-tier RaaS in 2026 with no zero-days. Every edge-device flaw it exploits was patched months earlier. Here is what to actually fix.Thu, 18 Jun 2026 16:56:17 GMTSecurity newsSuriq's JackClickFix is now shared attack infrastructure, and the lure is the wrong thing to detecthttps://suriq.io/blog/clickfix-shared-delivery-detection/https://suriq.io/blog/clickfix-shared-delivery-detection/Three unrelated crews adopted ClickFix delivery in a single quarter. The lure keeps changing; the execution chain does not. Here is where to detect it.Thu, 18 Jun 2026 12:10:34 GMTSecurity newsNoam AlumCisco called this SD-WAN flaw medium. Attackers used it to take root on your WAN.https://suriq.io/blog/cisco-sd-wan-manager-cve-2026-20262/https://suriq.io/blog/cisco-sd-wan-manager-cve-2026-20262/CVE-2026-20262 is an actively exploited Cisco SD-WAN Manager flaw that escalates a low-privilege login to root.Thu, 18 Jun 2026 08:11:51 GMTSecurity newsDeep diveSuriq's JackRoguePlanet turns Microsoft Defender into a SYSTEM shell, and switching it off won't save youhttps://suriq.io/blog/rogueplanet-defender-system-zero-day/https://suriq.io/blog/rogueplanet-defender-system-zero-day/RoguePlanet (CVE-2026-50656) is a public-exploit privilege escalation in Microsoft Defender's engine.Thu, 18 Jun 2026 05:50:21 GMTSecurity newsNoam AlumFortiBleed isn't a Fortinet bug. It's every password you never rotated.https://suriq.io/blog/fortibleed-fortinet-no-cve-to-patch/https://suriq.io/blog/fortibleed-fortinet-no-cve-to-patch/FortiBleed exposed working VPN logins for tens of thousands of Fortinet firewalls. There is no CVE to patch; the fix is rotating credentials and enforcing MFA.Wed, 17 Jun 2026 19:12:55 GMTSecurity newsDeep diveSuriq's JackJetBrains Plugins Are Stealing AI API Keys, and You Find Out From the Billhttps://suriq.io/blog/jetbrains-plugins-steal-ai-api-keys/https://suriq.io/blog/jetbrains-plugins-steal-ai-api-keys/Aikido found 15 JetBrains Marketplace plugins stealing AI API keys across 70,000 installs.Wed, 17 Jun 2026 15:04:54 GMTSecurity newsNoam AlumFortiSandbox Under Attack: The Box That Catches Malware Is Now the Way Inhttps://suriq.io/blog/fortisandbox-flaws-actively-exploited/https://suriq.io/blog/fortisandbox-flaws-actively-exploited/Three critical FortiSandbox flaws are under active exploitation, two unauthenticated and one patched a week ago.Wed, 17 Jun 2026 11:08:44 GMTSecurity newsDeep diveSuriq's JackThree requests, no password, a webshell: the JCE flaw hitting Joomla hosts nowhttps://suriq.io/blog/joomla-jce-unauthenticated-rce/https://suriq.io/blog/joomla-jce-unauthenticated-rce/Unauthenticated RCE (CVSS 10, CVE-2026-48907) in JCE, the most-installed Joomla editor. KEV-listed and exploited. Patch to 2.9.99.6 and hunt for webshells.Wed, 17 Jun 2026 05:20:51 GMTSecurity newsNoam AlumA Linux backdoor moved into the Windows kernel, and the detection window closes at driver loadhttps://suriq.io/blog/sprysocks-windows-kernel-driver/https://suriq.io/blog/sprysocks-windows-kernel-driver/SprySOCKS, a China-nexus Linux backdoor, now ships a Windows kernel-driver variant that hides itself from the host. Here is where defenders can still catch it.Tue, 16 Jun 2026 19:40:47 GMTSecurity newsNoam AlumLiteSpeed's cPanel plugin gave shared-hosting tenants root twice in 2026. CageFS didn't help.https://suriq.io/blog/litespeed-cpanel-plugin-root-escalation/https://suriq.io/blog/litespeed-cpanel-plugin-root-escalation/CVE-2026-54420 and CVE-2026-48172 let shared-hosting tenants reach root through the LiteSpeed cPanel plugin. Why CageFS isolation failed and what to patch now.Tue, 16 Jun 2026 07:13:38 GMTSecurity newsDeep diveNoam AlumAwesome Motive's WordPress CDN backdoor only fired for logged-in admins. Your scanner missed it.https://suriq.io/blog/awesome-motive-wordpress-cdn-backdoor/https://suriq.io/blog/awesome-motive-wordpress-cdn-backdoor/OptinMonster, TrustPulse and PushEngage served a backdoor that ran only for logged-in WordPress admins, evading visitor scanners. How to scope and hunt it.Mon, 15 Jun 2026 20:32:28 GMTSecurity newsNoam AlumSearchLeak in Microsoft 365 Copilot: prompt injection as a new door to old bugshttps://suriq.io/blog/searchleak-copilot-prompt-injection/https://suriq.io/blog/searchleak-copilot-prompt-injection/SearchLeak chained prompt injection, an HTML render race, and Bing SSRF to steal Microsoft 365 Copilot data in one click. What it means for detection.Mon, 15 Jun 2026 19:25:51 GMTSecurity newsNoam AlumWhy we built Suriq on Wazuh instead of writing our own detection enginehttps://suriq.io/blog/why-suriq-built-on-wazuh/https://suriq.io/blog/why-suriq-built-on-wazuh/Suriq runs on Wazuh because a detection engine is a decade of decoders, CVE feeds, and agents you should never rebuild. Here is the reasoning behind the bet.Mon, 15 Jun 2026 07:42:14 GMTThought leadershipDeep diveSuriq's JackIvanti Sentry's CVE-2026-10520: patch the gateway, then hunt for the breachhttps://suriq.io/blog/ivanti-sentry-patched-still-breached/https://suriq.io/blog/ivanti-sentry-patched-still-breached/Ivanti Sentry CVE-2026-10520 is an unauthenticated root RCE under active attack. CISA's new 3-day patch rule applies; patched gateways were already breached.Sun, 14 Jun 2026 07:06:06 GMTSecurity newsDeep diveSuriq's JackPeopleSoft's PSEMHUB zero-day turns the patch service into the breachhttps://suriq.io/blog/peoplesoft-psemhub-zero-day/https://suriq.io/blog/peoplesoft-psemhub-zero-day/CVE-2026-35273 sits in PeopleSoft's Updates Environment Management module. Mandiant ties active exploitation to ShinyHunters, with 100+ orgs already breached.Sat, 13 Jun 2026 18:38:12 GMTSecurity newsDeep diveSuriq's JackVelvet Ant's PAM-OpenSSH decade is an auth-stack blind spot, not a Linux bughttps://suriq.io/blog/velvet-ant-auth-stack-blind-spot/https://suriq.io/blog/velvet-ant-auth-stack-blind-spot/Sygnia found nine backdoored pam_unix.so variants and four trojanized OpenSSH binaries on one victim. Why auth-stack integrity is the SIEM-invisible gap.Sat, 13 Jun 2026 17:01:32 GMTSecurity newsDeep diveSuriq's Jack