Tag: flaw
-
Palo Alto Networks PAN-OS flaw exploited for remote code execution
Palo Alto Networks warns of a critical PAN-OS flaw (CVE-2026-0300) that is under active attack, allowing unauthenticated remote code execution. Palo Alto Networks has warned that a critical PAN-OS vulnerability, tracked as CVE-2026-0300 (CVSS score of 9.3), is actively exploited in the wild. The flaw is a buffer overflow that allows unauthenticated remote code execution,…
-
Argo CD ServerSideDiff Flaw Allows Attackers to Extract Kubernetes Secrets
A critical vulnerability has been identified in Argo CD that could allow attackers with minimal privileges to extract highly sensitive Kubernetes Secrets directly from etcd clusters. Tracked as CVE-2026-42880 and rated 9.6, this severe security flaw exposes a missing authorisation and data-masking gap within the platform. According to the disclosure, this exposure primarily affects environments…
-
Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution
Tags: access, advisory, authentication, cve, cvss, exploit, flaw, Internet, network, remote-code-execution, software, vulnerabilityPalo Alto Networks has released an advisory warning that a critical buffer overflow vulnerability in its PAN-OS software has been exploited in the wild.The vulnerability, tracked as CVE-2026-0300, has been described as a case of unauthenticated remote code execution. It carries a CVSS score of 9.3 if the User-ID Authentication Portal is configured to enable…
-
Critical Palo Alto Firewall Vulnerability Enables Attackers to Gain Root Privileges
Palo Alto Networks has issued an urgent security advisory concerning a critical vulnerability affecting its PAN-OS software. Tracked as CVE-2026-0300, this high-severity security flaw carries a CVSS 4.0 base score of 9.3 and is currently experiencing limited active exploitation in the wild. The vulnerability allows unauthenticated, remote attackers to execute arbitrary code with full root…
-
CISA mulls new three-day remediation deadline for critical flaws
Tags: api, ceo, cisa, exploit, flaw, government, kev, msp, penetration-testing, technology, update, vulnerability, vulnerability-managementTight window: A CISA spokesperson declined to comment on the Reuters report, but security experts were more forthcoming, with most believing the idea is simply an acknowledgement that modern vulnerability management is evolving.One source of anxiety was that a three-day timeline would leave little time for meaningful testing, normally a time-consuming and complex undertaking that…
-
New WhatsApp Flaws Could Affect Billions of Users After Meta Security Patch
Meta patched two WhatsApp flaws affecting iOS, Android, and Windows users, including bugs tied to risky files, links, and Reels previews. The post New WhatsApp Flaws Could Affect Billions of Users After Meta Security Patch appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-whatsapp-users-update-meta-security-flaws/
-
Google Update: Android Flaw Could Put Billions of Devices at Risk
Google patched an Android zero-click RCE flaw affecting multiple versions. Here’s what IT teams should know and how to reduce mobile risk. The post Google Update: Android Flaw Could Put Billions of Devices at Risk appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-android-zero-click-rce-patch/
-
CISA mulls new three-day remediation deadline for critical flaws
Tags: api, ceo, cisa, exploit, flaw, government, kev, msp, penetration-testing, technology, update, vulnerability, vulnerability-managementTight window: A CISA spokesperson declined to comment on the Reuters report, but security experts were more forthcoming, with most believing the idea is simply an acknowledgement that modern vulnerability management is evolving.One source of anxiety was that a three-day timeline would leave little time for meaningful testing, normally a time-consuming and complex undertaking that…
-
New WhatsApp Flaws Could Affect Billions of Users After Meta Security Patch
Meta patched two WhatsApp flaws affecting iOS, Android, and Windows users, including bugs tied to risky files, links, and Reels previews. The post New WhatsApp Flaws Could Affect Billions of Users After Meta Security Patch appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-whatsapp-users-update-meta-security-flaws/
-
Google Update: Android Flaw Could Put Billions of Devices at Risk
Google patched an Android zero-click RCE flaw affecting multiple versions. Here’s what IT teams should know and how to reduce mobile risk. The post Google Update: Android Flaw Could Put Billions of Devices at Risk appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-android-zero-click-rce-patch/
-
New WhatsApp Flaws Could Affect Billions of Users After Meta Security Patch
Meta patched two WhatsApp flaws affecting iOS, Android, and Windows users, including bugs tied to risky files, links, and Reels previews. The post New WhatsApp Flaws Could Affect Billions of Users After Meta Security Patch appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-whatsapp-users-update-meta-security-flaws/
-
Google Update: Android Flaw Could Put Billions of Devices at Risk
Google patched an Android zero-click RCE flaw affecting multiple versions. Here’s what IT teams should know and how to reduce mobile risk. The post Google Update: Android Flaw Could Put Billions of Devices at Risk appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-android-zero-click-rce-patch/
-
Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
The Apache Software Foundation (ASF) has released security updates to address several security vulnerabilities in the HTTP Server, including a severe vulnerability that could potentially lead to remote code execution (RCE).The vulnerability, tracked as CVE-2026-23918 (CVSS score: 8.8), has been described as a case of “double free and possible RCE” in the HTTP/2 protocol handling.…
-
Attackers are cashing in on fresh ‘CopyFail’ Linux flaw
Researchers dropped a reliable root exploit and it didn’t sit idle for long First seen on theregister.com Jump to article: www.theregister.com/2026/05/05/cisa_sounds_the_alarm_on/
-
Critical Android vulnerability CVE-2026-0073 fixed by Google
Google patched a critical Android flaw (CVE”‘2026″‘0073) that lets attackers run code remotely without user action. Google released a security update for Android to address a critical remote code execution flaw, tracked as CVE”‘2026″‘0073, in the System component. The bug allowed attackers to run code as the shell user without needing extra permissions, or any…
-
Unpatched flaws turn Ollama’s auto-updater into a persistent RCE vector, researchers say
Researchers at Striga have disclosed two vulnerabilities (CVE-2026-42248, CVE-2026-42249) in Ollama’s Windows auto-updater that, when chained together, may allow an … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/05/ollama-windows-vulnerabilities-cve-2026-42248-cve-2026-42249/
-
Android Zero-Click RCE Vulnerability Enables Remote Shell Access
A patched Android RCE flaw allows nearby attackers to gain zero-click remote shell access. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/android-zero-click-rce-vulnerability-enables-remote-shell-access/
-
MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks
Tags: attack, cve, exploit, flaw, injection, open-source, remote-code-execution, threat, vulnerabilityThreat actors are actively exploiting a critical security flaw impacting an open-source content management system (CMS) known as MetInfo, according to new findings from VulnCheck.The vulnerability in question is CVE-2026-29014 (CVSS score: 9.8), a code injection flaw that could result in arbitrary code execution.”MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code…
-
Critical Weaver E-cology RCE Exploit Raises Alarm for Enterprise Systems
Tags: automation, cve, cvss, cyber, exploit, flaw, office, rce, remote-code-execution, vulnerabilityA critical unauthenticated remote code execution vulnerability in Weaver (Fanwei) E-cology is being actively exploited in the wild, with real-world intrusion activity traced back to mid-March 2026, weeks before public awareness. Tracked as CVE-2026-22679 with a CVSS score of 9.8, this flaw exposes enterprise office automation systems to full OS-level compromise without requiring any authentication. Vulnerability Overview CVE-2026-22679…
-
AI finds 20-year-old bugs in PostgreSQL and MariaDB
Tags: ai, breach, credentials, cve, exploit, flaw, github, injection, nist, rce, remote-code-execution, sql, vulnerabilityInadequate JSON parsing allowed RCE on the MariaDB server: In MariaDB, a buffer overflow bug, tracked as CVE-2026-32710, was found in the JSON_SCHEMA_VALID() function using Xint Code. The vulnerability allows an authenticated user to trigger a crash, which, under controlled conditions, could be escalated into remote code execution.Compared to the PostgreSQL flaws, exploitation here is…
-
Google now offers up to $1.5 million for some Android exploits
Google overhauls its Android and Chrome vulnerability rewards programs, offering bounties of up to $1.5 million for the most difficult exploits while scaling back payouts for flaws that artificial intelligence (AI) has made easier to find. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-now-offers-up-to-15-million-for-some-android-exploits/
-
WhatsApp Security Flaw Enables Malicious URL Execution Through Instagram Reels
WhatsApp has recently patched two notable security vulnerabilities that could have allowed attackers to execute malicious links and disguise dangerous files. The most alarming discovery involves a flaw in how WhatsApp processes Instagram Reels. This vulnerability allows remote threat actors to trigger arbitrary URLs on a victim’s device by exploiting unvalidated message elements. Meta’s latest…
-
Critical Android Zero-Click Vulnerability Enables Remote Shell Access
Google has released the Android Security Bulletin for May 2026, addressing a highly critical vulnerability that allows attackers to execute code remotely without any user interaction. Published on May 4, 2026, the latest security update focuses heavily on a severe flaw located within the Android System component. Threat actors can exploit this vulnerability to gain…
-
Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API
A critical security vulnerability in Weaver (Fanwei) E-cology, an enterprise office automation (OA) and collaboration platform, has come under active exploitation in the wild.The vulnerability (CVE-2026-22679, CVSS score: 9.8) relates to a case of unauthenticated remote code execution affecting Weaver E-cology 10.0 versions prior to 20260312. The issue resides in the “/papi/esearch/data/devops/ First seen on…
-
Microsoft Edge Found Storing Saved Passwords in Cleartext Memory at Startup
A new security finding reveals that Microsoft Edge loads every saved password into its process memory as cleartext the moment the browser launches. Even more surprising to security professionals is Microsoft’s official response to the disclosure, which states that this insecure behavior is entirely >>by design.<< How the Memory Flaw Works According to a recent…
-
Apache HTTP Server Vulnerability Exposes Millions to Remote Code Execution Threats
Tags: apache, cve, cyber, flaw, malicious, remote-code-execution, software, threat, update, vulnerabilityThe Apache Software Foundation has released an urgent security update for the Apache HTTP Server to patch a severe vulnerability. Tracked as CVE-2026-23918, this flaw could allow attackers to execute malicious code remotely on affected web servers, putting millions of websites at risk. Understanding the Vulnerability The newly discovered security flaw is classified as a…
-
Hackers target governments and MSPs via critical cPanel flaw CVE-2026-41940
Attackers exploit a critical cPanel flaw to target government and MSP networks across Southeast Asia and several countries, including the U.S. and Canada. A threat actor is exploiting critical cPanel vulnerability CVE-2026-41940 to target government and military organizations in Southeast Asia, along with MSPs and hosting providers in countries like the Philippines, Laos, Canada, South…
-
Exploit Cyber-Frenzy Threatens Millions via Critical cPanel Vulnerability
Shortly after the authentication-bypass flaw was disclosed multiple proof-of-concept exploits appeared, and one researcher claims there’s been zero-day activity for at least a month. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/exploit-cyber-frenzy-critical-cpanel-vulnerability
-
Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass
Progress Software has released updates to address two security flaws in MOVEit Automation, including a critical bug that could result in an authentication bypass.MOVEit Automation (formerly Central) is a secure, server-based managed file transfer (MFT) solution used to schedule and automate file movement workflows in enterprise environments without requiring any custom scripts. The First seen…