Technical details and PoC exploit code for the critical Penpot file takeover flaw are now public. Upgrade to version 2.18.0 now.

Related Posts:

• Attackers Exploit SonicWall SonicOS SSLVPN Flaw CVE-2026-19868 in the Wild
• Veeam Releases Kernel Updates to Fix Critical CVE-2026-98432 Flaw Across Backup Appliances
• JetBrains Patches 61 Flaws Across Hub, Datalore, YouTrack, and IntelliJ IDEA

The post Penpot File Takeover Flaw Details and PoC Exploit Publicly Disclosed appeared first on Daily CyberSecurity.

Sekoia uncovered an APT29 watering hole campaign mobile exploits operation using Plerdy analytics and watering holes to compromise unpatched phones.

Related Posts:

• Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures
• mSecure Security Notification Prompts Password Resets
• Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks

The post APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits appeared first on Daily CyberSecurity.

SnappyMail RCE chain disclosed with a public proof-of-concept exploit. The auth bypass hit dev builds only; avoid master builds from Oct 22-Nov 4.

Related Posts:

• Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
• Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder
• PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4)

The post SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code appeared first on Daily CyberSecurity.

Puppet Server RCE CVE-2026-115731 (CVSS 9.4) now has a public proof-of-concept exploit. Update OpenVox and Puppet Enterprise to patched versions.

Related Posts:

• Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
• SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
• Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder

The post PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4) appeared first on Daily CyberSecurity.

Details and a macOS privilege escalation PoC exploit are public for CVE-2026-112445. Patch macOS now to stop local users from gaining root privileges.

Related Posts:

• Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
• SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
• Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder

The post PoC Exploit Disclosed for macOS Privilege Escalation appeared first on Daily CyberSecurity.

Technical details and a macOS revisiond vulnerability PoC exploit for CVE-2026-112487 are public, allowing root elevation. Update macOS immediately.

Related Posts:

• Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket
• cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel
• TeamViewer Client Vulnerability Enables Remote Code Execution

The post PoC Exploit Disclosed for macOS Local Privilege Escalation Vulnerability appeared first on Daily CyberSecurity.

Details and a Linux kernel vulnerability PoC exploit are public for CVE-2026-31419. Patch this high-severity flaw to prevent local privilege escalation.

Related Posts:

• Critical MediaTek Vulnerabilities Patched in Chipsets
• Critical FreePBX Vulnerabilities Patched in User Manager
• Apache Wicket Fixes 19 Vulnerabilities in 8.20.0, 9.25.0 and 10.12.0

The post Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability appeared first on Daily CyberSecurity.

Dream researchers uncovered a Chinese-nexus PHP2Shell exploit Fragnesia chain that rooted 25 firewalls and breached a US government Active Directory.

Related Posts:

• GMO Internet Ransom Demand Slashed After Cloud Breach
• UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127
• Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison

The post Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems appeared first on Daily CyberSecurity.

Details and PoC exploit code are out for critical libheif vulnerabilities GHSA-x8r2-mggj-j6wr and GHSA-2jg2-4ch7-h545. Upgrade to 1.23.3 now.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post Public PoC Exploit Disclosed for Critical libheif RCE Vulnerabilities appeared first on Daily CyberSecurity.

Public PoC exploit code for the AnyPwn AnyDesk RCE vulnerability is now disclosed. The pre-auth flaw gives root on AnyDesk Linux 8.0.2. Update to 8.0.3.

Related Posts:

• MariaDB Patches Nine Vulnerabilities Enabling Privilege Escalation and Code Execution
• GitLab Patches CVE-2026-97229 (CVSS 10.0) Flaw That Lets Unauthenticated Attackers Execute Arbitrary Code
• NVIDIA DCGM Exporter Flaw CVE-2026-47483 Lets Attackers Crash GPU Monitoring

The post AnyDesk RCE Vulnerability Details and PoC Exploit Code Publicly Disclosed appeared first on Daily CyberSecurity.

A public PoC exploit, cups2root, chains a CUPS privilege escalation to take lpadmin users to root. No CVE or patch yet. See the mechanism and mitigations.

Related Posts:

• Actively Exploited Veeam Agent Vulnerability PoC Disclosed
• Exploited VeloCloud Vulnerability CVE-2026-93952 Hits 10
• D-Link DIR-822A Vulnerabilities Details and PoC Disclosed

The post cups2root: Public PoC Exploit Escalates lpadmin to Root on CUPS appeared first on Daily CyberSecurity.