❌

Visualização normal

Antes de ontemFirewall Daily – The Cyber Express
  • ✇Firewall Daily – The Cyber Express
  • Critical wp2shell Vulnerability Hits WordPress Core, Patch Released Ashish Khaitan
    WordPress has released security updates to address the wp2shell vulnerability, a critical flaw that allowed attackers to achieve remote code execution (RCE) on vulnerable sites using a single anonymous web request.   Unlike many previous attacks, this issue did not require plugins, authentication, or third-party code, making affected core installations particularly vulnerable. Security patches were released in WordPress 6.9.5 and 7.0.2.  wp2shell Vulnerability Exposed Core WordPress Sites 
     
  • ↗️

Critical wp2shell Vulnerability Hits WordPress Core, Patch Released

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan
30 de Julho de 2026, 04:50

wp2shell vulnerability

WordPress has released security updates to address the wp2shell vulnerability, a critical flaw that allowed attackers to achieve remote code execution (RCE) on vulnerable sites using a single anonymous web request.   Unlike many previous attacks, this issue did not require plugins, authentication, or third-party code, making affected core installations particularly vulnerable. Security patches were released in WordPress 6.9.5 and 7.0.2. 

wp2shell Vulnerability Exposed Core WordPress Sites 

Tracked as CVE-2026-63030, the wp2shell vulnerability is described in the official WordPress release notes as a "REST API batch-route confusion and SQL injection" issue that can result in remote code execution. The flaw originates from the REST API batch endpoint located at /wp-json/batch/v1, or its legacy query-string alias ?rest_route=/batch/v1, allowing exploitation through a single anonymous web request.  The vulnerability was discovered by Adam Kues of Assetnote, an attack surface management division of Searchlight Cyber, through the WordPress HackerOne programme.   To provide defenders time to update their systems, Searchlight Cyber intentionally withheld technical exploitation details, stating, "Given the egregious nature of the flaw and to ensure defenders have adequate time, we are refraining from disclosing technical specifics at this juncture." 

Second SQL Injection Flaw Patched 

The same security release also fixed CVE-2026-60137, another critical SQL injection vulnerability. WordPress credited researchers TF1T, dtro, and haongo for reporting the issue. Unlike the wp2shell vulnerability, this flaw predates the latest release and was backported to WordPress 6.8.6. The wp2shell vulnerability only affects versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.  Severity ratings differ across security advisories. While WordPress classifies CVE-2026-63030 as "high severity," the corresponding GitHub Security Advisory (GHSA-ff9f-jf42-662q) labels it as Critical with a CVSS score of 7.5. Regardless of classification, both vulnerabilities require immediate patching because the wp2shell vulnerability can be exploited without authentication. 

Immediate Updates Recommended 

Powering around 40% of websites, WordPress responded by enabling forced automatic updates for affected versions, including WordPress 7.1 beta2, to secure pre-release installations. As of 17 July, there were no confirmed reports of active exploitation. However, security researchers warned that because WordPress is open source and patch-related code changes became publicly available immediately, proof-of-concept exploits could emerge within hours.  Administrators should verify that every internet-facing WordPress installation has successfully received the update, as some hosting environments disable automatic updates or lock websites to specific versions. Site owners can also check exposure using the public tool available at wp2shell.com. If immediate patching is not possible, temporarily blocking both REST API batch endpoints at the Web Application Firewall (WAF) level can reduce risk, although this should not replace installing the official update.  Security teams managing multiple WordPress websites should also monitor for spikes in anonymous web request traffic targeting batch endpoints, as the wp2shell vulnerability demonstrates how overlooked core features can introduce severe security risks. 
  • ✇Firewall Daily – The Cyber Express
  • CISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities Ashish Khaitan
    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities (KEV) catalog after reports confirmed active zero-day attacks targeting the iCagenda and Balbooa extensions for Joomla. Both flaws carry the maximum CVSS severity score of 10.0 and can allow attackers to upload malicious files that ultimately lead to remote code execution.  CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Actively Exploited 
     
  • ↗️

CISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan
13 de Julho de 2026, 05:47

CVE-2026-48939

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities (KEV) catalog after reports confirmed active zero-day attacks targeting the iCagenda and Balbooa extensions for Joomla. Both flaws carry the maximum CVSS severity score of 10.0 and can allow attackers to upload malicious files that ultimately lead to remote code execution. 

CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Actively Exploited 

According to the cloud-based website management platform, mySites.guru, CVE-2026-48939 has been exploited in automated attacks since June 15, 2026. The vulnerability affects the iCagenda Joomla extension through its "Submit an Event" feature, enabling attackers to upload arbitrary PHP files and execute malicious code.  "We first saw it in a client's access log: an automated scanner identifying itself as 'icagenda-batch/1.0' grabbed a token, posted a malicious upload to the submit endpoint, then fetched the planted shell at the exact path the component writes attachments to," mySites.guru said.  The flaw impacts iCagenda versions 4.0.7 and earlier in the 4.x branch, along with legacy 3.x releases from 3.2.1 through 3.9.14. Developer JoomliC addressed CVE-2026-48939 in versions 4.0.8 and 3.9.15. Administrators are advised to inspect the "images/icagenda/frontend/attachments/" directory for suspicious PHP files and remove any unauthorized uploads.  mySites.guru also reported active exploitation of CVE-2026-56291, which affects Balbooa Forms versions up to and including 2.4.0. The issue was patched in version 2.4.1.  "Up to and including version 2.4.0, its frontend attachment upload had a serious flaw: it accepted a file from any anonymous visitor, with no login, no CSRF token, and no check on the file type," the company said. "An attacker could upload a PHP file into a public folder and then run it, which is unauthenticated remote code execution, the worst outcome a web flaw can have."  Discovered on July 8, 2026, during an attack against one of its customers, CVE-2026-56291 prompted mySites.guru to recommend checking the default "images/baforms/uploads" directory for non-image or non-document files, reviewing Joomla administrator accounts for suspicious additions, and auditing recently modified PHP files across affected websites. 

Broader CMS Exploitation Campaign Raises Concerns 

Following the addition of CVE-2026-48939 and CVE-2026-56291 to the KEV catalog, Federal Civilian Executive Branch agencies have until July 13, 2026, to apply available patches.  Separately, the Australian Cyber Security Centre (ACSC) warned of a global campaign targeting vulnerable CMS platforms and plugins, including iCagenda, Balbooa, Sneeit Framework (CVE-2025-6389), WPBookit (CVE-2025-7852), Gravity Forms (CVE-2025-12352), Craft CMS (CVE-2025-32432), Ninja Forms (CVE-2026-0740), MaxSite CMS (CVE-2026-3395), Breeze Cache (CVE-2026-3844), WavePlayer (CVE-2025-12057), MetInfo CMS (CVE-2026-29014), and Joomla JCE (CVE-2026-48907).  As part of this campaign, malicious cyber actors are actively scanning websites for opportunities to deploy web shells," ACSC said, adding that attackers are exploiting vulnerabilities enabling unauthenticated file uploads, remote code execution, server-side request forgery, and deserialization. The agency further warned that "advances in AI are accelerating the speed and scale of cyber operations, reducing the time between vulnerability disclosure and exploitation." 
  • ✇Firewall Daily – The Cyber Express
  • Ubiquiti Fixes Critical CVE-2026-50746 and Multiple UniFi OS Vulnerability Flaws Ashish Khaitan
    Ubiquiti has released security updates to address several critical security flaws, led by CVE-2026-50746, a maximum-severity UniFi OS vulnerability with a CVSS score of 10.0. Published in Security Advisory Bulletin 066 on July 2, 2026, the update resolves 25 vulnerabilities affecting UniFi OS and multiple applications, including UniFi Connect, Talk, Access, Protect, and Network.  CVE-2026-50746 Tops List of Critical UniFi OS Vulnerability Patches  The most severe issue, CVE-2026-50746, affects
     
  • ↗️

Ubiquiti Fixes Critical CVE-2026-50746 and Multiple UniFi OS Vulnerability Flaws

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan
10 de Julho de 2026, 04:12

CVE-2026-50746

Ubiquiti has released security updates to address several critical security flaws, led by CVE-2026-50746, a maximum-severity UniFi OS vulnerability with a CVSS score of 10.0. Published in Security Advisory Bulletin 066 on July 2, 2026, the update resolves 25 vulnerabilities affecting UniFi OS and multiple applications, including UniFi Connect, Talk, Access, Protect, and Network. 

CVE-2026-50746 Tops List of Critical UniFi OS Vulnerability Patches 

The most severe issue, CVE-2026-50746, affects UniFi Connect Application versions 3.4.16 and earlier. The software is used to manage commercial building operations, including smart LED lighting systems and electric vehicle chargers, from a centralized interface.  According to Ubiquiti, "A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device."  The advisory recommends upgrading the UniFi Connect Application to version 3.4.20 or later. The flaw carries a CVSS v3.1 score of 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and was reported by Duc Anh Nguyen (@heckintosh_). 

Additional UniFi OS vulnerability fixes 

Alongside CVE-2026-50746, Ubiquiti patched six additional critical vulnerabilities on Thursday. These include CVE-2026-50747 and CVE-2026-50748, affecting UniFi Talk and UniFi Access, respectively, both carrying CVSS scores of 9.9. The company also fixed CVE-2026-54402, a command injection flaw in UniFi OS; CVE-2026-55115, an SSRF vulnerability in UniFi Protect; and CVE-2026-55116, an improper access control issue that allowed unauthorized changes to affected devices. Each requires software updates to the latest supported releases.  The advisory also addresses several high-severity vulnerabilities, including CVE-2026-54401 (SSRF), CVE-2026-54403 (path traversal), CVE-2026-54404 (SQL injection), and multiple authentication bypass, privilege escalation, denial-of-service, path traversal, SQL injection, CORS, and improper access control flaws affecting UniFi OS, UniFi Network, UniFi Protect, UniFi Talk, UniFi Access, and UniFi Protect Floodlight.  Notably, Ubiquiti warned that CVE-2026-54403 can be chained with other vulnerabilities to remove the requirement for low-privileged access, increasing its exploitation potential.  Affected products include UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, Cloud Key devices, UNVR systems, ENVR platforms, UCG appliances, EF-Core, and multiple UNAS storage products running vulnerable software versions.  Ubiquiti advises customers to update UniFi OS devices to version 5.1.19 or later, where applicable, and to upgrade UniFi Talk to version 5.2.2, UniFi Access to version 4.2.29, UniFi Protect to version 7.1.83, and UniFi Network to version 10.4.57. Prompt installation of these updates is recommended to mitigate the risks associated with CVE-2026-50746 and the broader UniFi OS vulnerability disclosures. 

Microsoft Patches Actively Exploited Defender Vulnerabilities Affecting Enterprise Systems

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan
22 de Maio de 2026, 06:01

CVE-2026-41091

Microsoft has confirmed active exploitation of two security vulnerabilities in its security ecosystem, identified as CVE-2026-41091 and CVE-2026-45498, both evaluated under the CVSS scoring system. The issues affect Microsoft Defender and have raised concerns due to confirmed in-the-wild exploitation and potential impact on enterprise systems.  The first issue, CVE-2026-41091 (CVSS 7.8), is a privilege escalation vulnerability affecting Microsoft Defender. If successfully exploited, it could allow a local attacker to obtain SYSTEM-level privileges. The flaw is rooted in improper link resolution before file access, commonly described as a “link following” issue.  Microsoft stated in its advisory:  "Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally,"  The second vulnerability, CVE-2026-45498 (CVSS 4.0), is a denial-of-service flaw impacting Microsoft Defender. While rated lower in severity under the CVSS framework, it has still been confirmed as actively exploited in real-world environments alongside CVE-2026-41091.  Both vulnerabilities have been addressed in updated releases of the Microsoft Defender Antimalware Platform, specifically versions 1.1.26040.8 and 4.18.26040.7, respectively.

CVE-2026-41091, CVE-2026-45498, and CVSS Context 

Although Microsoft has not explicitly confirmed the link, the behavior associated with CVE-2026-41091 and CVE-2026-45498 overlaps with earlier publicly discussed issues named RedSun and UnDefend, which were disclosed by the threat research group Chaotic Eclipse (also known as Nightmare-Eclipse).  Security researchers from Huntress have reported active exploitation of both CVE-2026-41091 and CVE-2026-45498 in the wild. These observations also include exploitation activity related to BlueHammer (CVE-2026-33825), suggesting a broader campaign targeting Microsoft Defender components and adjacent security mechanisms. 

Additional Security Findings

Alongside the two actively exploited vulnerabilities CVE-2026-41091 and CVE-2026-45498, Microsoft also patched another flaw in the same Defender update cycle: CVE-2026-45584 (CVSS 8.1). This vulnerability is a heap-based buffer overflow that could allow remote code execution if exploited. Unlike CVE-2026-41091 and CVE-2026-45498, there is currently no evidence that CVE-2026-45584 has been used in active attacks.  Microsoft Defender systems that have been disabled are not affected by these vulnerabilities, according to the company. Microsoft also noted that no manual intervention is required for most users, as updates are delivered automatically through malware definition updates and the Microsoft Malware Protection Engine. 

CVSS Updates and Security Guidance 

To verify protection status against CVE-2026-41091 and CVE-2026-45498, Microsoft recommends users check their Microsoft Defender configuration using the Windows Security interface (Microsoft Windows Security). The recommended steps include navigating to Virus & threat protection, checking protection updates, and verifying the Antimalware Client Version. Microsoft credited five researchers for identifying CVE-2026-41091, including Sibusiso, Diffract, Andrew C. Dorman (also known as ACD421), Damir Moldovanov, and an anonymous contributor. 

CISA KEV Catalog 

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) (Cybersecurity and Infrastructure Security Agency) has added both CVE-2026-41091 and CVE-2026-45498 to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch (FCEB) agencies are required to apply mitigations by June 3, 2026, reflecting the urgency of addressing CVSS-rated threats that are already being exploited.  With this addition, three Microsoft vulnerabilities have been flagged as actively exploited within a single week, highlighting a concentrated wave of CVE-based attacks targeting Microsoft products. 

Legacy Vulnerabilities  

CISA’s KEV catalog update also included several older but still relevant vulnerabilities: 
  • CVE-2010-0806: Internet Explorer use-after-free flaw enabling remote code execution  
  • CVE-2010-0249: Another Internet Explorer use-after-free vulnerability allowing arbitrary code execution  
  • CVE-2009-1537: DirectX issue in QuickTime Movie Parser Filter via crafted media files  
  • CVE-2008-4250: Windows Server Service buffer overflow via crafted RPC request  
  • CVE-2009-3459: Adobe Acrobat and Reader heap-based buffer overflow via malicious PDF files  
These legacy issues demonstrate that exploitation of older software remains relevant in modern threat landscapes, especially when combined with newer vulnerabilities like CVE-2026-41091 and CVE-2026-45498, both evaluated using CVSS metrics.
  • ✇Firewall Daily – The Cyber Express
  • Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 Ashish Khaitan
    Adobe has issued emergency security updates addressing a severe Acrobat Reader flaw tracked as CVE-2026-34621, a high-impact Adobe vulnerability that has already been observed being exploited in real-world attacks.   The issue, rated with a CVSS score of 8.6 out of 10.0, affects multiple Acrobat and Reader products across Windows and macOS platforms. According to Adobe, the vulnerability could enable attackers to execute arbitrary code on targeted systems if successfully exploited.  Acrobat
     
  • ↗️

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan
13 de Abril de 2026, 05:16

Acrobat Reader flaw

Adobe has issued emergency security updates addressing a severe Acrobat Reader flaw tracked as CVE-2026-34621, a high-impact Adobe vulnerability that has already been observed being exploited in real-world attacks.   The issue, rated with a CVSS score of 8.6 out of 10.0, affects multiple Acrobat and Reader products across Windows and macOS platforms. According to Adobe, the vulnerability could enable attackers to execute arbitrary code on targeted systems if successfully exploited. 

Acrobat Reader Flaw and CVSS Severity Assessment 

The Acrobat Reader flaw CVE-2026-34621 has been classified as a critical security defect with a CVSS base score of 8.6. The scoring notes impact potential, including confidentiality, integrity, and availability compromise. The CVSS vector associated with the flaw is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating that local access and user interaction are required for exploitation, while the scope change increases the severity.  Initially, the Adobe vulnerability was assessed with a higher score, but later revisions adjusted the attack vector from network-based (AV:N) to local (AV:L). This change reduced the overall CVSS rating from 9.6 to 8.6, as noted in Adobe’s revision history dated April 12, 2026. 

Adobe Vulnerability Impact and Affected Acrobat Products 

The Adobe vulnerability affects several widely deployed versions of Acrobat and Acrobat Reader. The impacted software includes: 
  • Acrobat DC versions 26.001.21367 and earlier (fixed in 26.001.21411)  
  • Acrobat Reader DC versions 26.001.21367 and earlier (fixed in 26.001.21411)  
  • Acrobat 2024 versions 24.001.30356 and earlier (fixed in 24.001.30362 for Windows and 24.001.30360 for macOS)  
These versions are used across both Windows and macOS environments, increasing the exposure range of the Acrobat Reader flaw CVE-2026-34621 in enterprise and consumer settings.  Adobe classified the update under bulletin APSB26-43, published on April 11, 2026, with a priority rating of 1, indicating the highest urgency level for patch deployment. The bulletin confirms that the Adobe vulnerability can result in arbitrary code execution if exploited successfully. 

Exploitation of Acrobat Reader flaw CVE-2026-34621 in the Wild 

Adobe has confirmed that it is “aware of CVE-2026-34621 being exploited in the wild.” This statement indicates active exploitation attempts against unpatched systems, elevating the urgency of the Acrobat Reader flaw CVE-2026-34621 beyond theoretical risk.  The exploitation activity suggests that threat actors may already be leveraging the Adobe vulnerability in targeted attacks. While specific campaigns have not been fully detailed publicly, the confirmed exploitation status places the flaw in a high-risk category, particularly for organizations that have not yet applied for the latest updates. 

Prototype Pollution Behind the Adobe Vulnerability 

The root cause of the Acrobat Reader flaw CVE-2026-34621 is identified as a prototype pollution issue. Prototype pollution is a JavaScript-based vulnerability class that allows attackers to manipulate object prototypes within an application.  In this case, the Adobe vulnerability is categorized under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). Successful exploitation could allow an attacker to manipulate internal object structures, potentially leading to arbitrary code execution within Acrobat environments.  Because prototype pollution affects how objects inherit properties, attackers may be able to inject malicious attributes into running applications, escalating the severity of the Acrobat Reader flaw CVE-2026-34621 when combined with user interaction. 

CVSS-rated fix and APSB26-43 remediation guidance 

Adobe addressed the Adobe vulnerability through security updates released under bulletin APSB26-43. Fixed versions include: 
  • Acrobat DC and Acrobat Reader DC: 26.001.21411  
  • Acrobat 2024: 24.001.30362 (Windows), 24.001.30360 (macOS)  
Adobe recommends immediate updating via built-in update mechanisms (Help > Check for Updates) or through managed deployment systems in enterprise environments such as AIP-GPO, SCUP/SCCM, Apple Remote Desktop, or SSH-based workflows on macOS. Full installers are also available through Adobe’s official download channels.  The CVSS scoring for the Adobe vulnerability CVE-2026-34621 was revised on April 12, 2026. The adjustment reduced the attack vector classification from network (AV:N) to local (AV:L), resulting in a revised CVSS score of 8.6.  Adobe credited researcher Haifei Li of EXPMON for reporting the issue and coordinating disclosure efforts. 
❌
❌