Vulnerabilities & CVEs

Threat actors are actively exploiting recently disclosed vulnerabilities in PaperCut to steal credentials, with attacks observed against educational institutions in the U.S. and Europe. The Arctic Wolf Adversary Research Team reported that attackers leveraged an authentication bypass and remote code execution chain to gain a foothold in target environments. The exploitation chain involves CVE-2026-81578 and CVE-2026-82078, which together allow unauthenticated attackers to bypass authentication mechanisms and achieve remote code execution on vulnerable PaperCut servers. Once exploited, the threat actors conducted command execution and reconnaissance activities. Primary targets: Schools and universities in the U.S. and Europe Observed behavior: Command execution and network reconnaissance post-exploitation Objective: Credential theft from affected institutions Organizations running PaperCut should prioritize patching these vulnerabilities immediately and audit their environments for signs of unauthorized access or unusual command execution. Even with patches applied, reviewing authentication logs for anomalous activity is strongly advised, as credential theft may indicate that attacker access extends beyond the initial exploit point. Source: The Hacker News Have any of you seen attempted exploitation of these PaperCut flaws in your own logs, or are you holding off on patching due to operational concerns?

OpenAI has officially released GPT‑6 Astra, positioning it as its most advanced and safety-aligned model to date. The launch follows the company’s own assessment that the model crossed the "Critical" threshold for cybersecurity capabilities under its internal Preparedness Framework — a designation that signals heightened risk and increased scrutiny. Astra reportedly achieved a perfect score on ExploitBench, a benchmark designed to evaluate AI’s ability to identify and exploit real-world vulnerabilities. This places the model at the forefront of AI-driven security research, but it also raises concerns about dual-use potential. In response, OpenAI has moved to block prompt requests that attempt to generate proof-of-concept exploit code, effectively restricting the model’s offensive security output. Beyond exploit generation, the model is said to be state-of-the-art in computer use, browsing, and software engineering tasks, making it a versatile tool for both defensive and offensive security workflows. The "Critical" rating under the Preparedness Framework signals that OpenAI will continue to monitor deployment closely and may impose usage restrictions in high-risk scenarios. GPT‑6 Astra achieved 100% on ExploitBench. OpenAI blocked PoC exploit generation requests. Model crossed "Critical" cybersecurity threshold pre-launch. Excels in computer use, browsing, and software engineering. The decision to restrict exploit code requests is notable, as it acknowledges the model’s capability to produce actionable attack tools while attempting to maintain a safety boundary. Whether these restrictions are enforceable in practice remains an open question for the security community. Source: The Hacker News Is your team already testing or evaluating GPT‑6 Astra for defensive use, and how are you balancing its offensive potential against policy restrictions?

Google has rolled out a stable channel security update for Chrome, addressing a total of 12 vulnerabilities in the latest release. Among these, one high-severity flaw is confirmed to be under active exploitation in the wild. The exploited issue is a type confusion bug residing in V8, Chrome's JavaScript and WebAssembly engine. This vulnerability, tracked as CVE-2026-85046, carries a CVSS score of 8.8 and affects Chrome versions prior to 152.0.7977.82. Affected Product: Google Chrome (Windows, macOS, and Linux) Fixed Version: 152.0.7977.82 Vulnerability Type: Type confusion in V8 Severity: High (CVSS 8.8) Exploitation Status: Actively exploited Given the confirmed in-the-wild exploitation, administrators and users are strongly advised to apply the update immediately to prevent potential compromise. Standard mitigation steps include: Update Chrome to version 152.0.7977.82 or later via the browser's built-in update mechanism. Restart the browser after the update to ensure the patch is fully applied. Consider enabling automatic updates to avoid delays in receiving future security patches. Source: The Hacker News Is your organization tracking Chrome baseline versions across endpoints, and how quickly can you verify that all systems are running the patched release?

A newly identified Linux backdoor, named ted in debug strings left by its developers, was found compiled directly into trojanized builds of HAProxy on systems belonging to two South Korean organizations. The implant did not exploit any vulnerability in HAProxy itself; the attackers had already achieved code execution on the target hosts and chose this stealthy persistence method to blend in with legitimate network infrastructure. Once active, ted intercepted incoming web traffic passing through the compromised load balancers. Instead of simply monitoring data, it selectively served altered web pages to chosen visitors, suggesting a highly targeted operation aimed at delivering modified content or credentials-harvesting pages to specific users. The use of trojanized HAProxy builds is notable because it allows malicious code to evade detection by masquerading as a trusted, frequently updated system component. This discovery highlights a growing trend of threat actors abusing open-source software supply chains at the deployment stage. By embedding malicious code directly into a commonly used network tool, the attackers ensured their backdoor survived reboots and software updates, and remained invisible to traditional file-scanning solutions. Key technical details: Implant name: ted, found in debug strings. Delivery method: Compiled into HAProxy binaries, not a HAProxy vulnerability. Prerequisite for installation: Prior code execution on the host. Observed behavior: Interception of web traffic and serving of altered pages to targeted visitors. Victims: Two organizations based in South Korea. Source: The Hacker News Given that this backdoor was compiled directly into HAProxy, how is your organization verifying the integrity of open-source binaries in production, especially those handling sensitive traffic?

PostgreSQL has shipped security updates to close a 12-year-old vulnerability that could let someone with the REPLICATION attribute execute arbitrary code as the operating-system user running the database server. The bug, tracked as CVE-2026-6471 with a CVSS score of 7.2, has been lingering since logical decoding was first introduced in PostgreSQL 9.4 back in 2014. The root cause lies in how logical decoding handles certain internal operations, allowing a privileged-but-not-superuser account to escalate its control over the host system. In practical terms, an authenticated user with the replication role could drop into the underlying OS user context of the database process—effectively bypassing the intended security boundary between the database role and the host environment. The following versions are patched and should be deployed immediately: PostgreSQL 18.6 PostgreSQL 17.11 PostgreSQL 16.15 PostgreSQL 15.19 PostgreSQL 14.24 Any installations running earlier releases are exposed. If you're managing a PostgreSQL fleet, your first step should be to confirm which versions are in use, then plan an upgrade window before applying the fix. Since this flaw has been dormant for over a decade, it's also worth auditing replication-role assignments to ensure that only trusted accounts hold that privilege in the first place. Source: The Hacker News Is your team currently running any PostgreSQL instances on the older branches listed here, and how are you sequencing the patching across production and dev environments?

An anonymous security researcher operating under the alias Nightmare Eclipse has published details and a proof-of-concept for a zero-day privilege escalation exploit targeting the CrowdStrike Falcon endpoint protection platform. Dubbed FalconFlank, the exploit reportedly allows an attacker to achieve SYSTEM-level privileges on fully patched Windows environments, effectively bypassing the kernel-level protections the security software is designed to enforce. The exploit abuses a flaw in how the Falcon sensor handles specific interprocess communication, enabling a locally authenticated user to escalate their access. Given that CrowdStrike Falcon runs with the highest integrity levels on Windows, this vulnerability is particularly severe, as it can render the host’s primary defense mechanism useless after compromise. Nightmare Eclipse has stated that the issue affects current, up-to-date versions of the Falcon agent and did not provide a patch timeline, leaving enterprise defenders in a precarious position. Based on the technical write-up accompanying the release, the core issue involves a race condition within the sensor's driver interface. The researcher demonstrated that by manipulating file system redirection, an attacker can force the Falcon service to execute arbitrary code in the context of the kernel. This technique effectively neutralizes the Next-Gen AV and Endpoint Detection and Response (EDR) capabilities before any malicious activity is detected. Key threat details provided in the report include: The exploit requires local access to the machine, not remote execution. It successfully bypasses Credential Guard and other virtualization-based security features. No user interaction is required once the initial foothold (e.g., via a phishing email or a malicious download) is established. At the time of writing, CrowdStrike has not issued an official CVE identifier for this issue, nor have they released a committed fix. System administrators running Falcon are advised to monitor the Falcon console for emergency policy updates and consider restricting local admin rights to mitigate the initial attack vector. Source: Unknown Given the lack of a public CVE or vendor patch, has your team started investigating whether your existing Falcon deployment is vulnerable to this local exploit vector yet?

Attackers are now actively exploiting a critical authentication bypass vulnerability in Citrix NetScaler, according to threat intelligence from Previdian. The flaw, tracked as CVE-2026-19490, carries a critical severity rating and allows unauthenticated remote attackers to bypass authentication mechanisms on affected appliances. The vulnerability impacts NetScaler Gateway and NetScaler ADC deployments, with exploitation potentially leading to full session hijacking or unauthorized administrative access. Previdian reports observed in-the-wild activity, indicating that threat actors have moved quickly to weaponize the flaw following the release of proof-of-concept code. Citrix has released patches and strongly recommends immediate upgrades. Organisations that cannot patch right away should consider the following mitigations: Restrict access to NetScaler management interfaces and Gateway virtual servers, allowing only trusted sources. Review authentication logs for anomalous activity or unknown administrative session origins. Enforce multi-factor authentication (MFA) on all administrative and user accounts as a secondary layer. Given the public availability of technical details and active exploitation, delaying remediation significantly increases exposure risk. Administrators should verify their appliance versions against the vendor’s advisory and apply the relevant updates without waiting for the next maintenance window. Source: BleepingComputer Is your organisation running NetScaler ADC or Gateway, and have you confirmed whether your current firmware version is vulnerable to CVE-2026-19490?

Google has pushed an emergency security update for Chrome, resolving a high-severity zero-day flaw found in the V8 JavaScript engine that is already being actively exploited in real-world attacks. Alongside this critical fix, the release patches 11 additional security issues affecting the browser. This marks another instance of an in-the-wild exploit being neutralized before widespread public disclosure. The primary threat, designated as a high-severity type confusion bug in V8, allows attackers to potentially execute arbitrary code by crashing the browser's rendering process. Because exploitation has been detected, immediate action is strongly advised. The update is rolling out globally across the stable channel for Windows, macOS, and Linux users. Key technical details for administrators: The actively exploited flaw resides in the V8 JavaScript engine, enabling remote code execution. The remediation is included in the latest stable channel update, which patches 11 other security vulnerabilities in addition to the zero-day. Google has confirmed that it is aware that an exploit for this vulnerability exists in the wild. Mitigation steps: Restart the Chrome browser to automatically apply the patch, or manually navigate to Help > About Google Chrome to trigger the update check. Ensure that Chrome auto-update is enabled across all enterprise endpoints to prevent delayed patching. Review your browser version to confirm it meets the newest build number, as older iterations remain susceptible to compromise. While specific technical identifiers were not disclosed in the initial advisory, the severity rating highlights the necessity for immediate deployment. This follows a pattern of recent V8-related zero-days, emphasizing the need for vigilance regarding browser security. Source: Unknown Is your organization tracking its Chrome version rollout to ensure this patch is applied across all machines immediately, or are you relying on automatic updates?

Threat actors are actively exploiting two critical remote code execution flaws in popular WordPress plugins, Super Forms – Drag & Drop Form Builder and Elementor Pro, according to research from Wordfence. The campaign has generated over 440,000 exploit attempts, indicating a wide-scale, automated effort to compromise vulnerable sites. The first vulnerability, CVE-2026-14894 (CVSS score: 9.8), is a missing file type validation issue in Super Forms. This flaw allows unauthenticated attackers to upload files of any type, including PHP webshells, which can be leveraged to achieve full remote code execution on the underlying server. The second flaw, related to Elementor Pro, is also actively targeted in these attacks, though specific technical details were not disclosed in the report. The high CVSS score and lack of authentication requirement for the Super Forms flaw make it particularly dangerous for unpatched installations. Site administrators are urged to immediately update both plugins to their latest patched versions to mitigate the risk of compromise. Indicators of compromise may include unexpected file uploads in wp-content/uploads directories, particularly .php files, and suspicious admin user creation events. Monitor access logs for abnormal POST requests to form handlers as a precautionary measure. Source: The Hacker News Are any of your managed WordPress sites running these plugins, and have you seen any malicious file upload activity in your logs yet?

Plex is pushing administrators and desktop users to update their software immediately after shipping patches for several undisclosed security flaws. The latest releases — Plex Media Server 1.43.3 and Plex Desktop 1.115.0 — include fixes for these vulnerabilities, though the company has not yet provided technical details about the nature of the issues. According to the advisory, CVE identifiers have been requested for the flaws, but none have been officially assigned at the time of writing. Plex has stopped short of explaining the potential impact or attack vectors, which is unusual for the vendor and suggests these issues were handled with heightened caution. Plex is specifically directing all server owners and Desktop users to upgrade to the newest builds as soon as possible. Given the lack of public disclosure, there is no additional information available regarding workarounds or specific affected configurations beyond the version numbers listed. Affected products: Plex Media Server (prior to 1.43.3) and Plex Desktop (prior to 1.115.0) Action required: Upgrade to Plex Media Server 1.43.3 or Plex Desktop 1.115.0 immediately Status: CVE identifiers pending; no further technical disclosures have been made If you run a Plex instance on a NAS or an always-on home server, it is worth checking whether automatic updates have already applied, as delayed patching could leave your media library and potentially your local network exposed. Source: The Hacker News Given the lack of detail here, how is your team handling the update push for Plex installations across your user base?

Cisco has shipped patches addressing a critical vulnerability in the Nexus 9000 line, specifically impacting models built on the Silicon One architecture. The flaw, CVE-2026-20212 with a CVSS score of 9.8, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The issue stems from improper handling of certain packets, and successful exploitation could lead to a full system compromise. The advisory confirms that 10 distinct Nexus 9000 switch models are affected by this vulnerability. Cisco has also released a broader IOS XR hardening bundle which includes fixes for seven umbrella CVEs, two of which carry the maximum severity rating of 9.8. At this time, Cisco has stated there is no workaround available for any of the affected IOS XR versions; administrators are urged to apply the provided software updates as soon as possible. Key details for network administrators: Affected product line: Nexus 9000 Series switches (Silicon One-based models). Primary vulnerability: CVE-2026-20212 (CVSS 9.8). Risk: Remote code execution as root without requiring authentication. Mitigation: No workaround exists; apply the latest IOS XR patch release immediately. If you operate any of the affected switching hardware, check your current IOS XR version against the patched release notes and schedule maintenance accordingly. Source: The Hacker News Since there is no workaround for this flaw, are you planning an emergency maintenance window to patch your Nexus 9000 fleet, or have you already segmented those devices to limit exposure?

Hewlett Packard Enterprise has released security updates addressing a critical remote code execution vulnerability in ArubaOS-CX, the operating system powering its data center switch portfolio. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code on affected devices, potentially leading to full compromise of the network infrastructure. The flaw stems from improper handling of user-supplied input in the operating system. An attacker able to reach the management interface could leverage this weakness to inject and run commands with elevated privileges, bypassing authentication altogether. Administrators are urged to act quickly, as the vulnerability is rated critical in severity. HPE has not reported any active exploitation in the wild at the time of the advisory, but the attack surface is significant given the widespread deployment of ArubaOS-CX in enterprise and data center environments. The following actions are recommended for mitigation: Upgrade affected devices to the latest patched ArubaOS-CX version provided in the HPE security bulletin. Restrict access to management interfaces (SSH, HTTPS, SNMP, and CLI) to trusted administrative networks only. Disable any unused management protocols to reduce the attack surface. Monitor device logs for unusual activity or unauthorized configuration changes. Network teams running Aruba switches should verify their current firmware version and compare it against the patched release immediately. Source: BleepingComputer Has your team already checked the ArubaOS-CX version in your environment against the new advisory, and if so, are you planning a maintenance window for the upgrade this week?

A critical authentication bypass vulnerability in Elementor Pro for WordPress, tracked as CVE-2026-32475, is now being actively exploited in the wild. Attackers are leveraging the flaw to deploy webshell payloads, granting them the ability to execute arbitrary commands directly on the affected server. The flaw, which was patched in a recent update, allows unauthenticated attackers to bypass access controls and take over vulnerable WordPress sites. Successful exploitation leads to full site compromise, including the potential for data theft, malware injection, and persistent backdoor access via the injected webshell. Given the active exploitation, site administrators running Elementor Pro should verify they are on the latest patched version immediately. Affected software: Elementor Pro versions prior to the latest security release. Observed payload: Webshell that enables remote command execution. Impact: Full site takeover, arbitrary code execution, persistent backdoor access. If you manage a WordPress site, confirm that automatic updates are enabled for Elementor Pro, or manually apply the vendor’s security patch without delay. Additionally, audit your server for any suspicious files or unexpected administrator accounts that may indicate prior compromise. Source: BleepingComputer Is your organization running Elementor Pro, and how are you verifying that no unauthorized webshells or backdoors were planted before you applied the latest patch?

Plex has issued an urgent call for users to update their desktop applications and media servers, citing multiple security vulnerabilities that could expose systems to attack. The company is recommending that all users apply the latest patches without delay to mitigate potential risks. The vulnerabilities affect both the Plex Media Server and the Plex Desktop app for Windows, macOS, and Linux. According to the advisory, the flaws could allow an attacker to execute arbitrary code or gain unauthorized access to sensitive data, depending on the attack vector. While specific technical details were not fully disclosed, Plex has confirmed that the issues are addressed in the newest software releases. Affected software: Plex Media Server and Plex Desktop (all prior versions before the latest update). Recommended action: Update to the latest version available from the official Plex website or through the in-app update mechanism. Additional guidance: Users should verify that their server is not exposed directly to the internet without proper firewall rules, as this increases the attack surface. Plex has not yet provided a full list of vulnerability identifiers, but they stress that the patches are critical. Administrators running Plex on NAS devices or dedicated servers should check for updates through their device’s package manager or the Plex channel. As with any security advisory, it is wise to review access logs for unusual activity after updating. Source: Unknown Are you running Plex Media Server in your environment, and how quickly can you roll out these updates across your user base?

Analysis from Citizen Lab, working alongside the SHARE Foundation, has confirmed that the iPhone of a member of Serbia’s student protest movement was compromised with NSO Group’s Pegasus spyware. The investigation points to the use of an iMessage zero-click exploit to deliver the malware, meaning the attack required no interaction from the victim. High-confidence indicators of compromise were identified on the device, aligning with previously documented Pegasus infection vectors. The discovery underscores the continued use of commercial surveillance tools against civil society actors, particularly those involved in political activism. The infection was carried out via an iMessage zero-click exploit. The device belonged to a member of Serbia's student protest movement. The analysis was a joint effort between Citizen Lab and the SHARE Foundation. The findings highlight the risk posed by zero-click vulnerabilities in widely used messaging platforms. For organizations or individuals in high-risk professions, it is worth reviewing device security settings and considering lockdown modes where available, though the specifics of this exploit chain have not been fully disclosed. Source: The Hacker News With this level of sophistication in delivery, how is your organization approaching the threat of zero-click mobile exploits, and what mitigation steps are you prioritizing?

Security researcher Chaotic Eclipse — also operating under the aliases INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse — has publicly released a proof-of-concept for a new zero-day privilege escalation vulnerability affecting CrowdStrike Falcon. Dubbed FalconFlank, the exploit targets the endpoint protection platform's office malicious macros remediation feature. According to the researcher's GitHub README, FalconFlank abuses a flaw in how CrowdStrike Falcon Sensor handles remediation of malicious Office macros, allowing an attacker to escalate privileges on the target system. The disclosure includes a working PoC, which raises practical concerns for organizations relying on CrowdStrike's EDR product for endpoint defense. Key technical details from the advisory: The vulnerability is a local privilege escalation flaw, not a remote code execution vector. The attack chain requires an initial foothold on the affected host, such as through a standard user session or malware execution. The abuse relies on the macro remediation logic, meaning environments with strict macro-blocking policies may have a reduced attack surface, though the specific trigger conditions are not fully detailed in the public release. No vendor patch or official mitigation has been announced at the time of writing. Organizations running CrowdStrike Falcon Sensor should monitor vendor advisories and consider restricting local macro-handling features where feasible. As with any public PoC, administrators are advised to assume active exploitation attempts in the wild and review detection rules for anomalous sensor behavior. Source: The Hacker News Is your organization currently running CrowdStrike Falcon, and how are you planning to assess exposure to this local privilege escalation vector before an official patch lands?

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents, where a repository’s own Git configuration can trick the tool into executing an attacker-controlled command on the developer’s machine. The attack relies on malicious .git config files, which can name a command that the agent unknowingly runs outside its sandbox and without an approval prompt. Four of the eight flaws remain unpatched at the time of publication. The affected agents include popular tools such as Claude, Codex, and Cursor, among others. The command executes with the privileges of the logged-in user, meaning a successful exploit could lead to credential theft, data exfiltration, or full local compromise. Exploitation requires the repository to arrive on the target machine—via a cloned project, a pull request, or a compromised dependency—after which the embedded Git configuration triggers the agent into running the malicious command. The issue highlights a broader risk in AI-assisted development: the trust placed in repository metadata and the assumption that sandboxing is enforced consistently across agent implementations. Attack surface: malicious .git config files within a repository. Impact: command execution as the current user, bypassing sandbox and approval prompts. Status: four of the eight vulnerabilities are still unpatched. Source: The Hacker News Are your development teams vetting repositories before letting AI agents open them, or is that trust still assumed by default?

SonicWall has issued an urgent advisory after confirming that two previously unknown vulnerabilities in its SMA1000 series appliances are being actively exploited in the wild. The flaws are being chained together by threat actors to achieve remote code execution on unpatched devices. According to the vendor, the attack chain involves an initial access vector that leads to a remote code execution condition on the SMA1000 hardware. While specific technical details are still limited, SonicWall states that the exploitation is currently underway, prompting a critical recommendation for administrators to take immediate action. Affected product: SonicWall SMA1000 series appliances. Attack type: Chained vulnerabilities leading to remote code execution. Status: Actively exploited in the wild. SonicWall has not yet released a fully detailed breakdown of the root cause, but they are urging all customers to review their security advisories and apply any available firmware updates or mitigations without delay. Until a patch is deployed, administrators should consider restricting management access to trusted networks and monitoring for anomalous traffic patterns on their SMA1000 devices. This situation is especially serious given that SMA appliances are commonly deployed at network perimeters, providing remote access to internal resources. A successful compromise could grant attackers a foothold in the internal network, potentially enabling lateral movement and data exfiltration. Source: BleepingComputer Is your organization running SMA1000 appliances, and if so, how are you balancing the need for immediate patching against the risk of downtime in a production remote access environment?

Threat actors are actively exploiting a critical vulnerability in Sangoma Switchvox, an enterprise VoIP platform, to achieve unauthenticated remote code execution. The flaw, tracked as CVE-2026-9586 with a CVSS score of 9.3, is a critical unauthenticated SQL injection issue present in Switchvox SMB Edition 8.3 (104997). Successful exploitation allows attackers to execute arbitrary code without needing valid credentials. In observed campaigns, adversaries are leveraging this flaw to deploy reverse shells, establishing persistent remote access to affected systems. Affected product: Sangoma Switchvox SMB Edition 8.3 (104997) Vulnerability type: Unauthenticated SQL injection leading to remote code execution Observed impact: Deployment of reverse shells on compromised hosts Organizations running this specific build should consider this a high-priority exposure, especially if the management interface is reachable from untrusted networks. Since exploitation does not require authentication, exposure to the internet significantly elevates risk. Source: The Hacker News Given the unauthenticated nature of this flaw, how is your team validating that your Switchvox instances are either patched or isolated from external access?

An unauthenticated SQL injection vulnerability has been discovered in the All-in-One WP Migration and Backup plugin for WordPress, potentially exposing millions of sites to full takeover. The flaw allows attackers to execute remote code without valid credentials, effectively granting them complete control over the underlying web server and database. The issue stems from improper sanitization of user-supplied input during database restore operations. By crafting a malicious request, an unauthenticated actor can inject arbitrary SQL commands. In specific configurations—particularly when the server’s mysqld binary is accessible—this vector can be chained into arbitrary file write operations, culminating in remote code execution. The vulnerability affects all versions of the plugin prior to the latest patched release. No authentication is required to exploit the flaw. Successful exploitation can lead to site defacement, data theft, malware injection, and complete server compromise. The plugin’s widespread adoption makes this a high-risk target for automated botnets. Site administrators are strongly advised to update the plugin to the newest version immediately. Additionally, it is recommended to review server error logs for unusual database queries and to validate file integrity across the WordPress installation, especially in the wp-content directory. If any suspicious activity is detected, assume compromise and rotate all associated credentials, including database passwords and API keys. Source: Unknown With millions of potential targets, has your team already verified that your WordPress instances are running the patched version of this plugin, or are you relying on other mitigations in the interim?