Summary: Researchers are warning about a critical vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce. This flaw could allow attackers to execute arbitrary PHP code on store servers. This news discusses …
Summary: A high-severity authentication bypass and RCE vulnerability (CVE-2026-104935) has been identified in Ivanti ICS products. Due to a partial patch, this vulnerability continues to be exploited by threat actors. …
Summary: Threat actors are exploiting a critical remote code execution (RCE) flaw in the Collabora Online app for Nextcloud. This vulnerability, tracked as CVE-2026-110447, is being used to backdoor Nextcloud servers. A …
Summary: A critical security flaw was found in Drupal’s Field UI module. This vulnerability allowed attackers to execute code on the server without authentication, and patches have been released. A significant security …
Summary: A critical heap buffer overflow vulnerability (CVE-2026-39919) has been found in the Ghostscript interpreter. This flaw allows remote code execution through specially crafted PDF files. Ghostscript is a widely …
Summary: Next.js released an out-of-band security update on October 14, fixing two critical unauthenticated remote code execution (RCE) flaws. Additionally, a high-severity denial-of-service (DoS) vulnerability was also …
Summary: NGINX released versions 1.30.6 and 1.31.7 on October 14, fixing five vulnerabilities. One of these flaws had been present in every release since May 2005. NGINX, a widely used web server and reverse proxy, has …
Summary: Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day vulnerability, tracked as CVE-2026-0322, which has been exploited in attacks targeting firewalls. This flaw is actively …
Summary: A critical remote command execution vulnerability (CVE-2026-73570) has been discovered in Zimbra Collaboration Suite (ZCS). This flaw allows unauthenticated access to mailbox data and credentials via SNMP …
Summary: This week, various security threats emerged, including Adobe RCE vulnerabilities, DNS-based wallet theft, and NVIDIA container escape. A data theft tool with a victim-scaring feature also stands out among this …