Vulnerabilities & CVEs

Threat actors are actively exploiting a critical vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with more than 6,000 active installs. According to Wordfence, the flaw allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. This makes it a serious risk for any site running the affected plugin, as a successful exploit can hand full control of the server to the attacker. Key facts: The plugin affected is WooCommerce Wholesale Lead Capture. The vulnerability permits unauthenticated arbitrary file uploads, leading to PHP web shell deployment and remote code execution. Wordfence reports that it has blocked over a number of exploit attempts, though the article text is truncated at that point. If your organization runs this plugin, treat it as urgent: verify whether it is installed and updated, and check for signs of compromise such as unexpected PHP files in upload directories. Given the active exploitation, patching or disabling the plugin until a fix is confirmed is the safest immediate step. Source: The Hacker News Is your organization running WooCommerce Wholesale Lead Capture, and if so, have you already patched or removed it?

Google has rolled out its September 2026 security update for Pixel devices, patching a total of 110 vulnerabilities. Among them is one zero-day flaw that has been actively exploited in targeted attacks. The update addresses issues across multiple components of the Android platform, though the actively exploited vulnerability is the most urgent concern for Pixel owners. Google has not publicly detailed the specific exploitation chain, but the confirmation of in-the-wild activity makes prompt patching essential. Affected users should take the following steps: Check for the September 2026 security update via Settings > System > System update Install the patch immediately if available Verify your device has received the latest build for your model Monitor Google's security bulletin for any further guidance Given that the flaw is under active exploitation, delaying the update leaves devices exposed to targeted attacks. There is currently no indication that non-Pixel Android devices are affected by this specific patch cycle, but users of other Android devices should watch for corresponding updates from their manufacturers. Source: BleepingComputer Has your organization already pushed this month's Pixel patches, or are you waiting on carrier approval before rolling them out?

New research from Sysdig highlights how quickly a skilled human attacker can move after landing initial access, even as AI continues to compress the window between vulnerability discovery and exploitation. In one case, the operator pivoted from a vulnerable Marimo notebook to an SSH bastion in just eight seconds. The findings underline that speed is not solely the domain of automated tooling. While much of the current discussion focuses on AI lowering the barrier to entry for less capable actors, Sysdig's telemetry shows that experienced human operators remain capable of extremely fast lateral movement once they gain a foothold. Key points from the report: The initial access vector was a remote code execution flaw in Marimo, an open-source Python notebook. From that foothold, the attacker reached an SSH bastion in roughly eight seconds. The case demonstrates how rapidly post-exploitation activity can unfold when a knowledgeable operator is at the keyboard. Sysdig's broader point is that defenders should not assume fast breakout times are always the signature of automation. Human-driven intrusions can be just as swift, which shortens the window for detection and response. Source: The Hacker News Does your environment expose notebook platforms like Marimo to untrusted networks, and how are you segmenting them from critical assets such as SSH bastions?

Acronis has disclosed a high-severity local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk, and warns that the flaw may already be exploited in the wild. The issue affects Linux systems running the plugin, allowing an attacker to escalate privileges locally on an affected host. According to the disclosure, the vulnerability is under active exploitation attempts, which raises the urgency for administrators managing shared hosting environments to patch immediately. Because the plugin integrates directly with control panels commonly used by hosting providers, a successful exploit could give an attacker elevated access on servers hosting many customer accounts. Affected deployments include those running the Acronis backup plugin on cPanel, WHM, or Plesk for Linux. Administrators should treat any server with the plugin installed as potentially at risk until the vendor-provided fix is applied. Mitigation guidance: Update the Acronis backup plugin for cPanel, WHM, and Plesk to the latest version as soon as possible. Verify the plugin version installed on each server and confirm it against Acronis's official advisory. Restrict local access to hosting servers where feasible, since the flaw requires local privilege escalation. Review server logs for signs of unauthorized privilege escalation or suspicious local activity. Server operators running shared hosting infrastructure should prioritize this update, as local privilege escalation flaws on multi-tenant systems can expose numerous customer environments at once. Source: BleepingComputer Has your organization already patched the Acronis backup plugin across its cPanel, WHM, or Plesk servers?

Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress, using it to upload a PHP backdoor to vulnerable sites. The plugin is a third-party extension used to build wholesale ordering and lead capture functionality on WooCommerce stores. The flaw allows unauthenticated attackers to upload malicious PHP files, which can then be executed to establish persistent remote access. Once the backdoor is in place, an attacker can run arbitrary code, steal data, or pivot further into the hosting environment. Because the plugin is a premium, third-party product, it is not covered by WordPress core security updates and site owners must obtain a fix directly from the vendor. Reported details include: The vulnerability is rated critical and is being exploited in the wild. The attack vector is an unauthenticated file upload leading to remote code execution via a PHP backdoor. Site owners running the WooCommerce Wholesale Lead Capture plugin should check for available updates from the vendor and apply them immediately. Investigators recommend reviewing upload directories and server files for unexpected PHP files, and rotating credentials if a compromise is suspected. No specific CVE identifier was provided in the source report, so no CVE number is cited here. If you run this plugin, treat any unexplained PHP files as suspicious, audit your logs for unexpected POST requests to plugin endpoints, and consider temporarily disabling the plugin until it can be patched. Keeping a clean backup and monitoring for outbound connections from your web server are also sensible precautions. Source: BleepingComputer Has your organization deployed this plugin, and if so, have you already applied the vendor's fix?

AI is compressing the window between vulnerability disclosure and active exploitation, and defenders can no longer afford to wait for a patch or a public proof-of-concept before taking action. According to Picus Security, this shift demands a different approach to zero-day response, one built on validating exploitability, testing security controls, and using autonomous pentesting to close exposure gaps before attackers get there. The core problem is timing. When exploitation follows disclosure faster than patching cycles can keep up, the traditional playbook of "wait, then patch" leaves organizations exposed during the most dangerous period. Instead of assuming a control will stop an attack, teams should verify whether it actually does, and identify where coverage breaks down. Key capabilities Picus Security highlights for post-Mythos zero-day response: Exploitability validation to confirm whether a given vulnerability can realistically be exploited in your environment Security control testing to check whether existing defenses actually block the attack path Autonomous pentesting to continuously probe for gaps and surface exposure before adversaries do The takeaway is that reducing exposure time matters more than reacting quickly after the fact, and validating your defenses ahead of an attack is central to that. Source: BleepingComputer Does your organization validate exploitability and test controls before patching, or is patching still the first line of response?

CISA is warning that ransomware operators have joined the active exploitation of a critical VMware vCenter remote code execution vulnerability that was patched back in July. The flaw allows an unauthenticated attacker to execute code on exposed vCenter servers, and it has already been targeted in ongoing attacks prior to the ransomware groups picking it up. Key points for defenders: The vulnerability affects VMware vCenter Server and carries a critical severity rating. A patch was released in July — organizations that have not yet applied it remain at risk. CISA confirms ransomware gangs are now among the threat actors exploiting the flaw. Internet-exposed vCenter instances are the primary target, so restricting access is essential. If you manage vCenter in your environment, prioritize patching immediately and audit for signs of compromise. Isolate management interfaces from the public internet wherever possible, and review logs for unusual activity on any system that was exposed while unpatched. Source: BleepingComputer Has your organization already patched vCenter, or are you still working through the backlog?

A critical vulnerability in LiteSpeed Web Server Enterprise could allow a low-privilege website user to obtain root access on a shared-hosting server, according to an advisory from cPanel published on September 14. Shared hosting environments run many customers' sites on a single machine. Because of this, an attacker who controls even one hosting account could exploit the flaw to access or alter other sites hosted on the same server, as well as the server itself. At this time, no specific CVE ID or advisory identifier has been provided in the available reporting, so administrators should refer to the vendor's official channels for tracking details. Details on affected versions, indicators of compromise, and mitigation steps were not included in the source material. Source: The Hacker News If your organization runs shared hosting on LiteSpeed Enterprise, have you already applied mitigations or are you waiting on further guidance?

Cisco has issued a warning about a critical zero-day vulnerability in its Secure Email Gateway product, confirming that threat actors have already exploited the flaw in active attacks. The vulnerability allows attackers to execute commands as root, making it a serious risk for organizations running the affected software. Administrators should treat this as an urgent patching priority, especially since exploitation has been observed in the wild. Cisco has released fixes, and applying them as soon as possible is the recommended course of action. Apply the latest patches from Cisco for Secure Email Gateway Monitor for signs of compromise on internet-facing email gateway appliances Restrict management access where possible until patching is complete Given active exploitation, delaying remediation significantly increases exposure. Source: Publication Name Has your organization already patched its Secure Email Gateway, or are you still assessing exposure?

Cisco has issued a warning that a critical vulnerability in AsyncOS Software for Cisco Secure Email Gateway is being actively exploited in the wild. The flaw, tracked as CVE-2026-76461, carries a CVSS score of 9.8 out of a maximum of 10.0. According to Cisco, the issue stems from insufficient validation in the email parsing logic, which could allow an unauthenticated, remote attacker to exploit the affected system. Organizations running Cisco Secure Email Gateway with vulnerable AsyncOS versions should treat this as a high-priority patching item given the active exploitation and the maximum-severity CVSS rating. Cisco has published guidance on the vulnerability, and administrators are advised to review the advisory and apply available fixes or mitigations as soon as possible. Affected product: Cisco Secure Email Gateway running AsyncOS Software Vulnerability type: insufficient validation in email parsing logic Attack vector: unauthenticated, remote Severity: CVSS 9.8 Status: actively exploited in the wild If you manage email security infrastructure, check your exposure now and confirm whether your version is affected before applying the vendor's remediation steps. Source: The Hacker News Has your organization already patched this, and if not, what's blocking the update?

The Homebrew package manager has reached version 7.0.0, bringing a set of security-focused upgrades alongside the full release of its native graphical interface. The headline addition is a built-in vulnerability scanner that checks installed packages for known security issues. The release also introduces stronger security controls overall and ships BrewUI, Homebrew's native GUI, out of preview and into general availability. Key points in this release: Built-in vulnerability scanner for installed packages Stronger security controls across the package manager Full release of the native BrewUI graphical interface Version bump to 7.0.0 For developers and admins running Homebrew on macOS or Linux, the built-in scanner means one less external tool to wire into your workflow, though it is worth validating how it integrates with any existing dependency and patch management processes. Source: BleepingComputer Are you planning to enable the new vulnerability scanner in your Homebrew environments, or will you stick with your current tooling?

There's a lot of noise surrounding AI and cybersecurity at the moment, but the core issue is simpler than the hype suggests. Vulnerability discovery is accelerating and happening at a much larger scale, while defenders are still left figuring out which findings genuinely warrant action. The numbers illustrate the pressure. In the first half of 2026, 35,853 CVEs were published, roughly 49% more than the same period a year earlier. That surge in volume makes it increasingly difficult for security teams to separate what matters from what can wait. The takeaway for defenders is that exposure management can't rely on the same validation approach it used before. When discovery outpaces the ability to triage, prioritization and validation become the bottlenecks that determine whether a finding turns into a real incident. Source: The Hacker News Has the rise in CVE volume changed how your team prioritizes and validates findings?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity GitLab vulnerability to its list of known exploited vulnerabilities, confirming that attackers are actively weaponizing the flaw in the wild. The vulnerability carries a CVSS score of 10.0, the highest possible severity rating, indicating it can be exploited remotely with no authentication and requires no user interaction. Details on the specific weakness and affected versions are limited in the source report, but the critical takeaway is that exploitation is confirmed and ongoing. Administrators running GitLab should treat this as urgent. Recommended actions include: Apply the latest security patches from GitLab immediately Check whether your instance is exposed to the internet and restrict access where possible Review logs for signs of exploitation and unusual activity Monitor CISA's Known Exploited Vulnerabilities catalog for updates Given that CISA has flagged this as actively exploited, organizations with internet-facing GitLab deployments should prioritize patching over standard change-control timelines. Source: BleepingComputer Is your organization running GitLab, and have you already patched or restricted access in response to this advisory?

CISA has added a maximum-severity vulnerability affecting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-86218, carries a CVSS score of 10.0, and federal agencies have been given until September 11, 2026 to apply the available fixes. The vulnerability is a pre-authentication remote code execution (RCE) issue in N-able's remote monitoring and management platform. It has reportedly been exploited in the wild, which is why it was added to the KEV catalog. Key points: Product: N-able N-central Vulnerability: Pre-auth RCE CVE ID: CVE-2026-86218 CVSS Score: 10.0 (maximum severity) Exploitation status: Exploited in the wild CISA KEV deadline for FCEB agencies: September 11, 2026 Administrators running N-central should prioritize patching. The KEV listing also means federal agencies must remediate the flaw by the mandated deadline. Source: The Hacker News Does your organization run N-able N-central, and if so, have you already applied the patch?

Microsoft has released its largest Patch Tuesday update on record, addressing 974 vulnerabilities across its software portfolio. Among the fixes are two flaws that Microsoft says have been actively exploited in the wild. The update breakdown is as follows: 723 flaws in Windows 111 in Office and Office 2016 62 in SQL 22 in Developer Tools More than 110 of the addressed vulnerabilities carry a critical severity rating. Given the scale of this release and the confirmed active exploitation of two zero-days, administrators should prioritize testing and deployment rather than waiting for the next cycle. Source: The Hacker News Is your organization planning to accelerate its patch rollout for this record-breaking update, or will you stick to your usual deployment schedule?

SAP has shipped security updates addressing multiple vulnerabilities, the most severe being a maximum-severity flaw in SAP Extended Passport (EPP) Processing. Tracked as CVE-2026-44756, the issue carries a CVSS score of 10.0, placing it at the top of the severity scale. The vulnerability is classified as a case of memory corruption, and it carries a critical impact on the confidentiality, integrity, and availability of affected applications. According to the disclosure, the flaw was discovered and reported by SAP itself. Details on the specific affected versions and the exact patch levels were not provided in the source material, so administrators should consult SAP's official security notes for their deployment to confirm coverage. Apply the latest SAP security updates without delay, prioritizing systems exposed to untrusted networks. Verify whether SAP Extended Passport (EPP) Processing is enabled or reachable in your environment. Monitor for unusual memory-related crashes or unexpected process behavior in SAP services. Review SAP's official advisory for patch guidance specific to your product version. Given the 10.0 rating and the potential for severe impact across the CIA triad, this should be treated as an urgent patching priority for any organization running affected SAP components. Source: The Hacker News Does your organization run SAP EPP, and if so, how quickly can you get these patches deployed?

The researcher known as Chaotic Eclipse has published a proof-of-concept for a new zero-day in Microsoft Defender, codenamed ShieldCrash. The flaw is assessed as a patch bypass for CVE-2026-69414, a vulnerability that carries a CVSS score of 7.8 and was previously reported by the same researcher under the name ShieldBreak. According to the researcher, Microsoft failed to properly fix the original ShieldBreak issue tracked as CVE-2026-69414. The new ShieldCrash PoC demonstrates that the earlier patch can be circumvented. Key details: CVE-2026-69414 is rated 7.8 on the CVSS scale, indicating a high-severity issue. The original bug was publicly referred to as ShieldBreak. The newly disclosed penetration test is called ShieldCrash and is described as a patch bypass. Source: [email protected] (The Hacker News) Has your organization seen updates for Microsoft Defender in response to CVE-2026-69414, or are you holding off until a more complete patch is available?

Google has rolled out an update for Chrome that addresses 230 security vulnerabilities, one of which is a zero-day that has already been exploited in the wild. The flaw is tracked as CVE-2026-87491 and is rated medium severity with no CVSS score provided. It is an out-of-bounds write in V8, Chrome's JavaScript and WebAssembly engine. Successful exploitation allows code execution inside the browser sandbox, which is why the vulnerability is considered serious despite its medium rating. Affected versions and mitigation guidance: Google Chrome versions prior to the fixed release are impacted. Users should update Chrome to the latest version immediately via the browser's built-in updater. Given active exploitation, patching should be treated as urgent rather than routine. The update covers a wide range of other fixes beyond this single zero-day, so applying it resolves the immediate threat along with the rest of the patched issues. Source: The Hacker News Has your organization pushed this Chrome update yet, or are you holding it back for internal testing?

A China-aligned espionage group is actively exploiting a critical vulnerability in Tencent's Sogou Input Method for Windows to deliver a backdoor tracked as GrayRabbit. The flaw is being used as an initial access vector in targeted intrusions, with the goal of establishing persistence and enabling espionage activity on victim systems. Key points: The vulnerability is tracked as CVE-2026-51990 and is rated critical. Affected software: Sogou Input Method for Windows, developed by Tencent. Payload deployed: the GrayRabbit backdoor. Attribution: a threat actor assessed to be aligned with Chinese state-sponsored espionage operations. Exploitation occurs through the vulnerable input method application, allowing the attacker to run code and drop the backdoor. Mitigation and response guidance: Patch or update the Sogou Input Method to the latest version as soon as a fix is available. If the application is not required in your environment, consider removing or restricting it. Monitor endpoints for unusual child processes spawned by the input method software. Hunt for indicators of GrayRabbit persistence and command-and-control traffic. Apply network-level detections for known malicious infrastructure associated with this campaign. Organizations relying on Sogou Input Method in Windows environments should treat this as a priority given the espionage motivation behind the exploitation. Source: Unknown Is Sogou Input Method present anywhere in your environment, and if so, how are you handling the risk?

Alby Hub users should be aware of a critical vulnerability affecting self-hosted Lightning wallets. According to the vendor, the flaw could allow an attacker to take over a wallet and send its funds, but exploitation requires one key condition: the Hub must have been reachable from the internet. Alby Hub is a self-hosted Lightning wallet, meaning the owner runs it on their own machine or server and holds their own bitcoin. Because of this, the exposure depends heavily on how each operator has configured their setup rather than affecting all installations equally. Affected versions: v1.7.0 through the latest release listed in the advisory Exploitation requirement: the Hub must be internet-exposed Impact: potential wallet takeover and unauthorized fund transfers If your Hub is not reachable from the public internet, the attack path described by the vendor is not available to an attacker. Operators who have exposed their Hub directly should treat this as urgent and either update to a patched release or restrict network access immediately. As with any self-hosted wallet software, keeping the instance off the public internet and behind appropriate access controls remains the strongest defensive measure. Source: The Hacker News Has your organization deployed Alby Hub, and if so, is it currently exposed to the internet?