Hewlett Packard Enterprise has released security patches for multiple vulnerabilities in Aruba Networking wireless software that could let attackers take complete control of affected devices.

The flaws affect AOS-8 and AOS-10 deployments across Mobility Conductors, Controllers, Gateways, and access points. Several allow attacks without a valid login, making prompt patching a priority for network administrators.

HPE Warns Aruba Networking Flaws

HPE’s October 22 security bulletin, HPESBNW05162, describes authentication bypass, command injection, SQL injection, and buffer overflow flaws.

Eight CVE entries carry the maximum CVSS severity score of 10.0. Successful attacks could expose sensitive data, change device settings, or run commands with high system privileges.

Among the most serious issues, CVE-2026-79850 lets an attacker bypass AOS-8 authentication without credentials and execute commands as root, giving them full control of the underlying operating system. CVE-2026-79855 separately affects the AOS-8 SSH service and can grant unauthenticated administrative access.

AOS-10 also contains critical weaknesses. CVE-2026-79845 affects PAPI, Aruba’s access point management protocol, and could let attackers bypass login checks, change configurations, and access sensitive information.

CVE-2026-79847 and CVE-2026-79851 involve buffer overflows that could allow malicious code to run with privileged permissions. Other flaws expose services reached through PAPI traffic. Attackers can trigger CVE-2026-79860 by sending specially crafted packets to UDP port 8211 on affected AOS-8 systems.

HPE also lists SQL injection flaws that could extend beyond database access and allow command execution on the operating system. The attack conditions vary. Some vulnerabilities can be reached remotely, while others require an attacker on an adjacent network or physical access.

Certain command execution flaws also depend on conditions outside the attacker’s control. Not every listed issue provides the same route to device takeover.

Cybersecurity News previously reported on Aruba access point command injection vulnerabilities and AOS controller and gateway security flaws. Those earlier reports concern separate disclosures, not the newly released fixes.

The affected releases include AOS-10.8.1.1, AOS-10.7.2.6, and AOS-10.4.1.13 and earlier versions within their respective branches. AOS-8.13.3.0 and AOS-8.10.0.23 and earlier releases in those branches are also affected. Compatible hardware and virtual deployments fall within scope, even when individual models are absent from the bulletin’s example list.

HPE recommends upgrading to AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, AOS-8.13.3.1, or AOS-8.10.0.24, depending on the installed branch. Later releases in those branches also contain the fixes. Updates are available through the HPE Networking Support Portal.

Until updates are deployed, HPE recommends restricting command line and web management interfaces to a dedicated network segment or VLAN, backed by firewall rules.

Administrators should also enable controls that track and log user activity. These measures reduce exposure but do not replace installing the patches.

HPE said it knew of no public discussion or exploit code targeting these vulnerabilities when the advisory was released. That statement does not establish whether attacks have occurred. Older software beyond maintenance or support should not be assumed safe, and HPE urges customers to move to supported releases.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post HPE Warns Critical Aruba Networking Flaws Could Let Hackers Take Complete Control of Devices appeared first on Cyber Security News.

Atlassian has released its October 2026 security bulletin, covering 176 flaw entries across products including Jira, Confluence, Bamboo, Bitbucket, and Crowd.

Published on October 20, the update lists 162 high-severity entries and 14 critical-severity third-party entries. Atlassian says it included fixes in product versions released last month and urges customers to install a suitable fixed release.

The total should not be read as 176 unique CVEs affecting Jira and Confluence alone. The official security bulletin lists findings by product, with some CVE identifiers appearing across several applications that use the same software libraries.

This means administrators must check each installed product rather than treat the announcement as a single patch. A key finding in Confluence is CVE-2026-65637, a man-in-the-middle issue in the Apache Tomcat Coyote dependency with a CVSS score of 9.8.

Other critical entries include CVE-2026-58062, a cryptographic failure in Bouncy Castle rated 9.3, and CVE-2026-75595, an authentication and session management weakness in Netty rated 9.1.

Atlassian Releases Security Update

Confluence also has two improper authorization entries, CVE-2026-65182 and CVE-2026-68525, affecting the Tomcat Catalina dependency.

These findings sit alongside high-severity issues involving denial of service, unsafe data handling, file inclusion, path traversal, and remote code execution in third-party components.

However, severity needs careful reading. Atlassian says the critical ratings describe flaws in outside libraries. In contrast, its use of those libraries presents a lower, non-critical assessed risk.

The company reserves separate critical security advisories for issues that pose an immediate critical risk in its products. Therefore, the library scores do not mean every affected Atlassian installation faces the same level of exposure.

For Confluence, the security bulletin lists 11.0.0, 10.2.19 LTS, and 9.2.26 LTS as fixed Data Center releases, with 10.2.19 LTS recommended.

Affected branches include 10.2.0 through 10.2.18 and 9.2.0 through 9.2.25, alongside several older releases. Administrators should compare their exact build against the full table rather than rely only on the major version number.

Bamboo customers are directed to 12.1.12 LTS or 10.2.24 LTS. Bitbucket fixes include 10.5.1, 10.2.8 LTS, and 9.4.26 LTS. The bulletin marks these fixed releases as Data Center only. Its product headings also mention Server, so customers should read the release labels carefully when planning upgrades.

Jira administrators should also review the recent Atlassian arbitrary file access security update. That separate advisory covered CVE-2026-21589 and identified Jira Software and Jira Service Management fixes including 10.3.26 and 11.3.12. It should not be confused with the third-party dependency findings in this monthly bulletin.

Previous attacks show why delayed Confluence updates deserve attention. Cybersecurity News documented attackers using an older, separate flaw, CVE-2023-22527, to deploy the Godzilla fileless backdoor. That case provides historical context, not evidence that attackers are exploiting the October 2026 findings.

Atlassian recommends upgrading to the latest release or a listed fixed version for each affected product. Because the fixed-version table reflects information available on October 20, customers should also check the linked release notes before scheduling deployment. The practical priority is to match every installed application to its patch path, including products that share vulnerable libraries.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence appeared first on Cyber Security News.

Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across its software portfolio. Published on October 20.

The update includes a maximum-severity Oracle E-Business Suite vulnerability that allows attackers without login credentials to take over an affected Workflow component through network access.

The headline figure reflects security patches rather than 1,295 separate flaws. Oracle notes that the same vulnerability can affect several products and appear in multiple risk matrices.

Tenable’s analysis counts 1,209 unique CVEs across 33 Oracle product families, highlighting the scale of this release. The most urgent E-Business Suite issue is CVE-2026-101809, which affects the Workflow Notification Mailer component in versions 12.2.3 through 12.2.15.

It carries a CVSS 3.1 score of 10.0, the highest possible rating. An attacker can exploit the weakness over HTTP without authentication, and Oracle describes it as easy to exploit.

A successful attack can lead to takeover of Workflow, putting its data and operation at risk. Oracle also warns that the impact could extend to other products.

The flaw therefore deserves attention beyond the affected mailer component, particularly where connected business systems depend on the same application environment.

Oracle Security Update

Another serious issue, CVE-2026-101767, affects the Core component of Oracle Application Object Library. Rated 9.8, it allows remote exploitation over HTTP without credentials or user interaction.

Supported versions 12.2.3 through 12.2.15 are affected, with high potential impact on data privacy, data integrity, and service availability.

The Oracle October 2026 advisory also lists CVE-2026-75803 in the Database Server’s OpenSSL component. This 9.8-rated vulnerability can allow an unauthenticated attacker using TLS network access to take over the affected component. Database versions 19.3 through 19.32 and 23.4.0 through 23.26.3 are affected.

Oracle APEX receives a critical fix for CVE-2026-101521, another 9.8-rated issue. It allows takeover through HTTPS without authentication and affects versions 24.1.0–24.1.21, 24.2.0–24.2.20, and 26.1.0–26.1.4. Oracle provides further impact details in its technical risk descriptions.

Earlier incidents highlight the risks of delaying Oracle patches. Cybersecurity News previously reported active exploitation of CVE-2026-4681, affecting Oracle Payments.

A separate mass exploitation campaign targeting E-Business Suite was linked to CVE-2025-61882. Neither incident confirms exploitation of the newly disclosed Workflow flaw.

Oracle says it continues to receive reports of successful attacks against customers who have not installed available patches. The company urges organizations to remain on supported versions and apply security updates without delay.

Administrators should check installed versions against Oracle’s affected-product tables and follow the patch availability documents for installation instructions.

E-Business Suite customers must also review the underlying Database and Fusion Middleware components, whose fixes are listed separately.

emporary network restrictions may reduce exposure, but Oracle warns that they can disrupt applications and do not fix the underlying flaws. Test these changes before production use, and treat them only as short-term protection until patches are deployed.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Massive Oracle Security Update – 1295 Flaws Patched, Including Critical E-Business Suite Vulnerability appeared first on Cyber Security News.

Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI.

The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026.

Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome’s About page to prompt an update check.

The most serious issue is CVE-2026-110922, a critical use-after-free flaw in Chrome’s Prerender feature. Google credits Xinyang Ge with reporting it on October 2.

A use-after-free bug occurs when software tries to use memory after it has been released. Depending on how an attacker can reach the flaw, this type of error may cause a crash or allow memory corruption. Google has not published further technical details and has not said the issue is being exploited.

CVE-2026-110913 is a high-severity memory corruption flaw in Chrome’s DOM, the browser system that represents and manages the structure of web pages.

Google Fixes 10 Chrome Vulnerabilities

Ge reported the bug on September 29, with Claude’s assistance. Google’s release note does not explain how the issue was found, whether Claude identified the flaw or helped with analysis, or what steps were involved. It does, however, publicly credit the AI’s assistance in the report.

The other high-severity fixes affect V8, Chrome’s JavaScript engine, as well as Core and SVG. They include two additional use-after-free flaws in V8, CVE-2026-110919 and CVE-2026-110921, and memory corruption issues CVE-2026-110918, CVE-2026-110917, and CVE-2026-110920. The reports came from Ge, Google, and researcher C0rk1.

The three medium-severity bugs involve improper input validation in Desktop, a use-after-free issue in Compositing, and memory corruption in Workers.

Google credited its own researchers with reporting these flaws. Together, the list shows that this release addresses problems in separate browser components rather than a single feature or subsystem.

Google says detailed bug information may remain restricted until most users have installed the fixes. This can limit what researchers and users can learn about the vulnerabilities while the update is spreading.

CVE	Severity	Affected component	Reported by
CVE-2026-110922	Critical	Prerender	Xinyang Ge
CVE-2026-110913	High	DOM	Xinyang Ge, Anthropic, assisted by Claude
CVE-2026-110919	High	V8	Xinyang Ge
CVE-2026-110918	High	Core	Google
CVE-2026-110917	High	SVG	C0rk1
CVE-2026-110921	High	V8	Xinyang Ge
CVE-2026-110920	High	V8	Xinyang Ge
CVE-2026-110916	Medium	Desktop	Google
CVE-2026-110915	Medium	Compositing	Google
CVE-2026-110914	Medium	Workers	Google

The company also said it uses tools such as AddressSanitizer, MemorySanitizer, libFuzzer, and AFL to find security bugs during development.

Chrome updates are delivered gradually, so users may not receive the new version at the same time. Check the browser’s About Google Chrome page and restart it if prompted to complete installation. Organizations should follow their normal browser update process and confirm that managed devices receive the fixed release.

This update follows other recent Chrome security coverage, including Google’s earlier report on a large Chrome vulnerability update and coverage of multiple Chrome flaws. Google’s Stable Channel announcement and Chrome Security page provide the primary release information.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI appeared first on Cyber Security News.

Next.js has released security updates for two critical vulnerabilities that could let remote attackers run malicious code without logging in. A third, high-severity flaw could stop affected applications from serving requests.

The issues involve cached functions, SVG image processing, and Server Actions, with fixes available in Next.js 16.4.1 and 15.5.28. Published on October 14, 2026, the advisories describe separate attack paths with different requirements

Both remote code execution flaws score 9.5, while the denial-of-service issue scores 8.2. Application settings and enabled features determine exposure, so version checks are only one part of risk assessment.

The first vulnerability, tracked as GHSA-673q-mjm6-r5xr, affects App Router applications using Cache Components. An application becomes vulnerable when a use cache function returns multiple typed arrays. Under these conditions, attackers could achieve remote code execution without authentication or user interaction.

Next.js releases 16.0.0–16.4.0 are affected by the flaw, which is fixed in version 16.4.1. Developers should upgrade immediately, as no workaround or CVE identifier is available.

Critical Next.js Vulnerabilities

Earlier React and Next.js RCE reports highlight server-side risks, but the newly disclosed cache flaw has a separate trigger and is unrelated to React2Shell.

The second flaw, CVE-2026-96889, involves a memory-related weakness in an upstream library the Image Optimization API uses to handle SVG files. It can lead to remote code execution on Next.js deployments running on glibc-based Linux. The advisory lists no required privileges or user interaction.

The official image optimization advisory lists affected versions as 10.0.0 through 15.5.27 and versions above 16.0.0 through 16.4.0.

Developers can address this issue by ensuring Next.js uses sharp 0.35.5 or later. Installing the patched Next.js releases ensures package managers provide a fixed dependency.

The third vulnerability, GHSA-p3m5-59mp-jv5r, affects App Router applications with at least one Server Action. Crafted requests can drive excessive CPU usage, preventing the same process from handling further requests. Applications using Pages Router, or those without Server Actions, are not vulnerable.

Affected versions include 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. There is no workaround besides upgrading. Previous coverage of Next.js security patches highlights related feature-specific risks, but those earlier fixes do not replace this update.

Developers should install Next.js 15.5.28 or 16.4.1 as appropriate. Updating only sharp addresses the image flaw, not the separate cached-function or Server Actions vulnerabilities.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Next.js Vulnerabilities Allow Hackers to Execute Malicious Code Remotely appeared first on Cyber Security News.

Google released a Chrome security update that addresses 37 vulnerabilities, including seven critical flaws that raise concerns about memory corruption and possible code execution.

Published on October 13, 2026, the update covers Windows, Mac, and Linux, with fixes spanning graphics, PDF handling, media processing, networking, and other browser components.

According to Google’s Stable Channel Update for Desktop, the patched versions are 155.0.8059.79/.80 for Windows and Mac, and 155.0.8059.79 for Linux. The release includes seven critical, 29 high, and one medium-severity security fixes.

Google says it will continue distributing updates over the coming days and weeks. The critical vulnerabilities include CVE-2026-110152, a buffer overflow in ANGLE, Chrome’s graphics translation layer. Zhenpeng “Leo” Lin at depthfirst reported the issue on September 30.

Buffer overflows can corrupt memory when software writes beyond the space reserved for data, potentially creating opportunities for attackers to change program behavior.

The remaining six critical entries are use-after-free flaws. CVE-2026-110149 affects Browser, CVE-2026-110136 affects PDF, CVE-2026-110161 affects Network, and CVE-2026-110165 affects Core.

Multiple Google Chrome Vulnerabilities

Google also patched CVE-2026-110148 in SVG and CVE-2026-110151 in Media. These findings involve Google researchers and Xinyang Ge.

A use-after-free vulnerability occurs when software continues accessing memory after releasing it. Depending on the bug, attackers may influence that memory’s contents, causing crashes, corrupting data, or potentially running malicious code. However, the flaw category alone does not enable an attack against every affected component.

Cybersecurity News previously covered Chrome’s update fixing 247 vulnerabilities, including four critical use-after-free issues. The latest release continues that focus on memory safety across multiple browser features rather than a single isolated component.

Among the high-severity vulnerabilities, CVE-2026-110169 affects V8, Chrome’s JavaScript and WebAssembly engine. Rapid7’s vulnerability record states that a crafted HTML page could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox in versions before 155.0.8059.79.

That limitation matters. Code execution inside the sandbox does not, by itself, prove an attacker can take control of the entire operating system.

CVE ID	Severity	Vulnerability Type	Affected Component
CVE-2026-110152	Critical	Buffer overflow	ANGLE
CVE-2026-110149	Critical	Use after free	Browser
CVE-2026-110136	Critical	Use after free	PDF
CVE-2026-110161	Critical	Use after free	Network
CVE-2026-110165	Critical	Use after free	Core
CVE-2026-110148	Critical	Use after free	SVG
CVE-2026-110151	Critical	Use after free	Media
CVE-2026-110162	High	Use after free	Desktop
CVE-2026-110170	High	Use after free	Bindings
CVE-2026-110160	High	Missing authorization	ReadingMode
CVE-2026-110143	High	Use of uninitialized variable	ThirdParty lmza_sdk
CVE-2026-110146	High	Information leak	Passwords
CVE-2026-110150	High	Privilege elevation	Installer
CVE-2026-110156	High	Incorrect reference resolution	Extensions
CVE-2026-110137	High	Use after free	WebRTC
CVE-2026-110140	High	Type confusion	V8
CVE-2026-110158	High	Use after free	Passwords
CVE-2026-110145	High	Use after free	Passwords
CVE-2026-110159	High	Incorrect authorization	Updater
CVE-2026-110144	High	Incorrect authorization	Mojo
CVE-2026-110153	High	Use after free	Media
CVE-2026-110166	High	Buffer overflow	Animation
CVE-2026-110169	High	Use after free	V8
CVE-2026-110168	High	Use after free	V8
CVE-2026-110139	High	Use after free	Media
CVE-2026-110172	High	Use after free	Media
CVE-2026-110164	High	Use after free	DOM
CVE-2026-110163	High	Use after free	DOM
CVE-2026-110141	High	Observable discrepancy	Media
CVE-2026-110138	High	Use after free	ShapeDetection
CVE-2026-110157	High	Use after free	SVG
CVE-2026-110147	High	Use after free	PDF
CVE-2026-110154	High	Use after free	Canvas
CVE-2026-110155	High	Buffer overflow	PDFium
CVE-2026-110167	High	Use after free	Media
CVE-2026-110171	High	Use after free	Media
CVE-2026-110142	Medium	Use after free	FileSystem

Google’s release announcement does not describe a complete attack chain or confirm that these newly patched vulnerabilities are being exploited in the wild.

Google credits Xinyang Ge at Anthropic, assisted by Claude, with reporting CVE-2026-110169. Other high-severity fixes address V8 type confusion, buffer overflows in Animation and PDFium, a Passwords information leak, Installer privilege elevation, and authorization problems in ReadingMode, Updater, and Mojo.

For background, Cybersecurity News’ coverage of earlier ANGLE and V8 security fixes explains how memory-handling issues repeatedly affect graphics and script processing.

Users should open Chrome’s menu, select Help, then About Google Chrome to check for updates. After installation, select Relaunch to apply the fixes. Linux users should update through their package manager. Google’s Chrome update guide explains these steps.

Google may restrict detailed bug reports until most users receive patches. Restrictions may also remain if affected third-party libraries haven’t been fixed elsewhere, limiting the technical information currently available to readers and defenders.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks appeared first on Cyber Security News.

Threat actors are exploiting two critical Citrix NetScaler zero-day vulnerabilities to deploy a modified Platypus remote access tool on exposed ADC and Gateway appliances.

The activity shows how quickly attackers are moving from initial access to persistent control of edge devices that often sit between corporate networks and the public internet.

The campaign targets CVE-2026-88771 and CVE-2026-88772, two actively exploited flaws in Citrix NetScaler ADC and Gateway. Both bugs carry a CVSS score of 9.5 and can allow remote code execution without requiring a valid user account.

Citrix released emergency fixes for affected products, while CISA also added the two issues to its Known Exploited Vulnerabilities catalog.

Researchers at Binary Defense investigated incidents involving two NetScaler devices that showed signs of exploitation during a customer’s upgrade process.

One device showed attempted exploitation, while the other contained evidence that attackers had delivered and likely executed a custom-built remote management implant called Platypus.

Platypus is an open-source remote administration framework written in Go. The attackers reportedly modified and compiled the tool for FreeBSD, the operating system used by NetScaler appliances. They then disguised the malware as a Perl-related file to blend in with normal appliance files.

The observed installer used a curl command piped into the shell to retrieve and launch the tool. The payload was stored under paths that could look familiar to NetScaler administrators, including /var/tmp/, /netscaler.local/, and /var/core/. One sample used the filename .ns_09343.pl, although it was an ELF binary rather than a legitimate Perl script.

Hackers Exploit Citrix NetScaler 0-Days

The deployment method matters because it provides attackers with a foothold that may remain even after an organization patches the original vulnerable appliance.

A patch stops further use of the flaw. However, it does not automatically remove web shells, backdoors, stolen credentials, altered configuration files, or remote access implants already placed on the device.

Recent reporting has also documented attackers using the command-injection flaw to install web shells and collect NetScaler configuration data.

CVE-2026-88771 is an improper input validation flaw that can allow an unauthenticated attacker to run commands on vulnerable NetScaler appliances.

Binary Defense researchers found that attackers could place shell commands inside crafted authentication-related input, including usernames. The malicious input is written into NetScaler logs, where a vulnerable error-handling process can later execute the injected command.

The second bug, CVE-2026-88772, is a DTLS memory overflow issue. It affects NetScaler VPN virtual servers where DTLS is enabled, which is the default configuration in many deployments.

A successful exploit can allow code execution or cause a denial-of-service condition by crashing the affected service. Palo Alto Networks Unit 42 said attackers were actively exploiting the two flaws in NetScaler ADC and Gateway systems.

The command-injection weakness is particularly concerning because execution may not happen immediately. A delayed maintenance process can run the injected command later, making it harder for defenders to match a suspicious login request with follow-on activity.

The recovered Platypus samples were not standard builds of the public project. The custom version reportedly included added modules for privilege escalation, persistence, cleanup, and timestamp manipulation.

It could execute commands through a remote terminal, read and write files, update itself, use plugins, and communicate with a command-and-control server through mutual TLS.

The malware also contained a local peer-discovery feature using the _platypus-mesh_tcp mDNS service. That feature could help an operator identify or link compromised systems on the same network.

Researchers linked the campaign to the domain entretiensol[.]com, which acted as a staging and control server. Other domains reportedly shared infrastructure or certificate traits with the operation, including white-guard[.]pro, gurerasfalt[.]com, garyvard[.]com, and hickoryusedauto[.]com.

Organizations should urgently upgrade vulnerable NetScaler ADC and Gateway systems to fixed releases. Citrix identified version 14.1-73.37 and 13.1-64.23 as patched builds for the two original zero-days, including corresponding FIPS and NDcPP releases.

Security teams should also treat patching as only the first step. They should review ns.log, sh.log, bash.log, httpaccess.log, and httperror.log for suspicious authentication strings, unexpected shell commands, curl | sh activity, files with .pl extensions that are actually binaries, and outbound traffic from NetScaler appliances to unknown internet hosts.

Any appliance exposed before patching should be considered potentially compromised until administrators complete forensic checks, rotate reachable credentials, revoke active sessions, and inspect both nodes in high-availability deployments.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Hackers Exploit Citrix NetScaler 0-Days to Deploy Platypus Remote Access Tool appeared first on Cyber Security News.

IBM patched 22 vulnerabilities in Verify Identity Access and Security Verify Access, including two critical flaws allowing unauthenticated remote code execution across appliance and container deployments.

The most severe bugs, CVE-2026-78401 and CVE-2026-78406, each carry a CVSS score of 9.8. Both involve deserializing untrusted data, a process where software rebuilds stored or transmitted data into objects without properly checking whether it is safe.

The publicly listed advisory for CVE-2026-78401 confirms the risk of unauthenticated remote code execution. IBM rates both deserialization bugs as network-accessible attacks with low complexity, no required privileges, and no user interaction.IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs.

Successful exploitation could seriously affect data confidentiality, integrity, and service availability. However, the supplied bulletin does not identify vulnerable endpoints, describe an exploit chain, or report confirmed attacks.

These critical flaws deserve close attention because attackers do not need a valid account to reach the vulnerable code. Their severity reflects potential impact and ease of attack, not evidence that exploitation has already occurred.

IBM Patches 22 Verify Access Flaws

Three additional vulnerabilities carry scores of 9.1. CVE-2026-16916 allows an authenticated, high-privilege remote attacker to execute arbitrary code because a protection mechanism fails.

CVE-2026-16823 enables attackers to bypass security restrictions, while CVE-2026-19491 allows authentication bypass. Unlike the deserialization bugs, these issues require different access and have different outcomes.

The update follows earlier IBM Identity and Verify Access vulnerabilities reported by Cyber Security News, which covered request smuggling, privilege escalation, and other security weaknesses in the same product family. Do not confuse those earlier fixes with this October patch release.

The bulletin also addresses CVE-2026-18740 and CVE-2026-19482, both rated 8.8. These argument injection flaws let authenticated remote attackers perform unauthorized actions or execute arbitrary commands. CVE-2026-19493, rated 7.5, allows a remote attacker to write files through path traversal.

Other vulnerabilities include cross-site scripting that could expose credentials within trusted sessions, SQL injection that could modify data or disrupt services, and cross-site request forgery that could trigger unauthorized actions.

Additional fixes address audit log forgery, incorrect authorization checks, authentication workflow bypass, and information disclosure in the Snapshot Manager Container. Several denial-of-service flaws affect resource allocation, recursive processing, and memory reads.

IBM also patched a stack buffer write issue that requires administrative privileges and access to the local management interface. Earlier IBM Security Verify command execution coverage provides related background on previously patched appliance flaws.

Affected releases include IBM Security Verify Access and its Container edition from 10.0 through 10.0.9.2. IBM Verify Identity Access and its Container edition are affected from 11.0 through 11.0.3.

IBM directs appliance customers to install Verify Identity Access 11.0.3.1 or Security Verify Access 10.0.9.3 through its Fix Central download links.

Container customers should follow IBM’s container download guidance, which identifies product images and registry locations. IBM renamed Security Verify Access to Verify Identity Access starting with version 11.0.0.

The bulletin lists no workarounds or mitigations. IBM encourages customers to update promptly, and the bulletin lists the supplied fixes as the stated remediation for these vulnerabilities across affected supported deployments.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs appeared first on Cyber Security News.

Hackers are exploiting two flaws in AhsayCBS backup servers to run commands, plant webshells, and install XMRig cryptocurrency miners disguised as Microsoft Edge.

Huntress first observed exploitation on October 7, 2026, at 23:20:15 UTC. By October 8, its researchers had seen five organizations targeted, with attackers checking systems and setting up tools to maintain access.

The campaign targets Ahsay Cloud Backup Server, a management platform used by managed service providers and system integrators. Administrators use it to manage backup users, policies, and operations. According to Huntress’s investigation, versions up to 10.3.4 are affected, including a release previously described as safe.

The attack chains CVE-2026-105133, a medium-severity authentication flaw in the checkSysPwd function, with CVE-2026-105134, a critical flaw in the Replication Receiver endpoint at /rps/api/json/UpdateReceivers.do.

Together, they let attackers bypass login checks and execute commands as NT AUTHORITY\SYSTEM, giving them broad control over the Windows host.

Hackers Exploit Critical AhsayCBS Flaws

The NVD entry for CVE-2026-105134, published October 4, lists a CVSS 4.0 score of 9.3 and describes remote command injection. It still identifies version 10.3.4 as a fix.

However, Huntress’s October 8 update says that the version remains vulnerable, making the conflicting guidance important for administrators assessing exposure.

After gaining access, attackers configured a malicious replication receiver and placed Java Server Page webshells inside the application’s web directory. Huntress also detected suspicious commands launched by cbssvcX64.exe, the AhsayCBS service executable.

This pattern resembles earlier z0Miner attacks against WebLogic servers, where attackers used JSP webshells to maintain access before deploying mining tools. That similarity describes a shared method, not evidence that the campaigns involve the same operators.

Attackers downloaded Taskgmr.ps1, edge.exe, msedge.exe, and config.json into temporary folders from an Alibaba Cloud Object Storage endpoint. The file edge.exe was XMRig, while msedge.exe was a modified copy of NSSM, a legitimate utility that keeps other programs running.

A newly created Windows service, MicrosoftEdgeUpdateSvc, ran the disguised NSSM binary with SYSTEM privileges. It kept the miner active and restarted it after crashes or reboots. The miner connected to xmr. kryptex[.]network and 51.195.127[.]124 on port 8029.

The use of webshells followed by Monero mining also appears in earlier Apache web server coinminer attacks, highlighting how exposed servers can become income sources for attackers.

The PowerShell script monitored Task Manager and stopped the mining service whenever users opened it. Mining resumed after Task Manager was closed.

Type	Indicator / File	Description
Payload hosting domain	imagefiles-backup.oss-ap-southeast-7.aliyunc[.]com	Hosts miner, scripts, configuration, and driver
Mining pool	xmr.kryptex[.]network:8029	XMRig mining destination
Mining pool IP	51.195.127[.]124:8029	Observed mining connection
Windows service	MicrosoftEdgeUpdateSvc	Maintains mining activity
PowerShell script	Taskgmr.ps1	Hides mining when Task Manager is open
Miner artifact	%TEMP%\edge.exe	XMRig disguised as Microsoft Edge
SHA-256	edge.exe	4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d
Persistence artifact	%TEMP%\msedge.exe	Modified NSSM utility disguised as Microsoft Edge
SHA-256	msedge.exe	05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034
Driver artifact	%TEMP%\WinRing0x64.sys	Vulnerable driver supporting mining
SHA-256	Taskgmr.ps1	481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

The script also closed Task Manager at 18:00 local time or after it stayed open overnight for over an hour. Huntress described its comments as suggesting AI assistance, not proving AI authorship.

In one incident, attackers downloaded WinRing0x64.sys, a legitimate but vulnerable driver, using certutil.exe. Huntress linked its use to improved mining performance through low-level hardware access, not to turning off security tools.

Organizations should restrict management access to trusted IP addresses or a VPN while awaiting a confirmed fix. Investigate suspected compromised hosts and rebuild them from trusted backups.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners appeared first on Cyber Security News.

wolfSSL has released wolfSSH 1.6.0 to fix five security flaws, including a critical host key verification bypass that could let an attacker impersonate an SSH server.

Published on October 6, 2026, the update addresses Windows privilege escalation, unauthenticated key exchange abuse, unauthorized forwarding channels, and an SFTP memory corruption bug.

The release rates one flaw critical, one high, and three medium. The most serious issue, CVE-2026-16516, affects wolfSSH through version 1.5.0.

During SSH key exchange, the client failed to check whether the ECDSA curve inside the server’s host key matched the algorithm agreed upon for the connection. An attacker positioned between the client and server could replace that key with one using a different curve.

Because the attacker owns the replacement key’s private key, signature verification could still succeed. However, exploitation also requires a weak public-key-checking callback in the application.

This condition matters: the flaw does not mean every affected client automatically accepts an attacker’s key. wolfSSL credits researcher zhangph, known on GitHub as afldl, with reporting the issue.

The high-severity issue, CVE-2026-83540, affects wolfSSHd on Windows from versions 1.4.15 through 1.5.0. Concurrent connections shared an authentication context containing a Windows logon token.

Both password and public key authentication wrote to this shared token, creating a risk that a user with a valid account could receive another user’s login identity, including one with higher privileges. Non-Windows builds are unaffected.

CVE-2026-84897 concerns incorrect handling of Diffie-Hellman group exchange messages. A vulnerable server accepted messages intended only for a server, allowing an unauthenticated client to trigger client-side processing.

After selecting diffie-hellman-group-exchange-sha256, an attacker could submit a chosen group and force costly checks of whether its numbers are prime.

wolfSSH 1.6.0 Fixes 5 Security Flaws

The release notes describe roughly half a second of CPU work per 1 KB packet containing a 4096-bit prime. The message-handling flaw affects versions 1.2.0 through 1.5.0, while the expensive prime checks apply from 1.5.0. Builds using WOLFSSH_NO_DH_GEX_SHA256 are unaffected.

CVE-2026-81535 affects versions 1.4.8 through 1.5.0 built with –enable-fwd. The software accepted forwarded-tcpip channel requests without checking the application’s forwarding policy.

Clients also accepted channels for remote forwards they had never requested. A peer could therefore cause an endpoint to allocate buffers for forwarding channels that the application had not approved.

The fifth flaw, CVE-2026-83742, affects non-Windows builds from versions 1.4.11 through 1.5.0. Incorrect length calculations in wolfSSH_RealPath() could let a crafted SFTP path write a terminating NUL byte just beyond a stack buffer.

An authenticated attacker could corrupt nearby data and crash the process. Applications supplying an output buffer smaller than the input face additional exposure to an unbounded copy.

Administrators and developers should upgrade affected deployments to wolfSSH 1.6.0 and review the official release notes before rollout.

The update enables strict key exchange by default, adding protection against the Terrapin attack previously covered by Cyber Security News. It also requires RSA user authentication keys of at least 2048 bits and, by default, limits failed authentication attempts to six.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass appeared first on Cyber Security News.

Cisco has released security updates for three critical vulnerabilities in Nexus 3000 and 9000 Series switches that could let remote attackers run code with root privileges without logging in.

The flaws affect the Next Generation Operation, Administration, and Maintenance feature, known as NGOAM, in Cisco NX-OS Software. Successful attacks could also crash processes, force switches to reload, and disrupt network services.

Published on October 7, 2026, Cisco’s security advisory covers CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. The advisory carries a CVSS base score of 9.8.

Cisco found the vulnerabilities during internal security testing and said its Product Security Incident Response Team was not aware of public announcements or malicious use when the advisory was released.

The flaws stem from improper validation of incoming IP traffic when NGOAM is enabled. An attacker can send crafted packets to an IP interface on an affected switch.

If exploitation succeeds, those packets could trigger code execution with root privileges, giving the attacker control at the operating system’s highest privilege level. The same attack path could cause a denial-of-service condition through process crashes and device reloads.

NGOAM supports network checks and troubleshooting. Its VXLAN functions help detect and address loops. In contrast, its Segment Routing over IPv6, or SRv6, functions help operators check connectivity and locate forwarding problems.

However, the exposure differs across the three vulnerabilities, so administrators must check both software versions and enabled features rather than treating every Nexus switch as affected.

Cisco Nexus Flaws

Cisco’s security advisory applies to Nexus 3000 and Nexus 9000 Series switches operating in standalone NX-OS mode. CVE-2026-76485 requires only NGOAM to be enabled.

CVE-2026-76486 requires NGOAM alongside either SRv6 or a qualifying Network Virtualization Overlay configuration. For the overlay path, a VXLAN EVPN network identifier must be mapped to an NVE interface with at least one learned peer tunnel endpoint.

CVE-2026-76501 requires both NGOAM and SRv6. Nexus 3000 switches do not support SRv6, and only some Nexus 9000 models support it. Cisco confirmed that Nexus 9000 switches running in ACI mode, Nexus 7000 switches, and MDS 9000 multilayer switches are not affected.

Administrators can check NGOAM with the show feature | include ngoam, overlay status with the show feature | include nve, and SRv6 with the show feature | include srv6. Overlay checks also require reviewing show running-config | begin "interface nve", show nve vni, and show nve peers to establish whether the required configuration exists.

Cisco says no workarounds address the vulnerabilities, but turning off an unneeded NGOAM feature removes the attack vector. Administrators can use the no feature ngoam command in global configuration mode after assessing the effect on network operations. Cisco has also released Live Protect shields as temporary protection, not a replacement for patched software.

Organizations should use the Cisco Software Checker to identify the fixed release for their platform. CybersecurityNews previously covered a separate Nexus 9000 root-code-execution flaw, CVE-2026-20212, affecting Silicon One models.

That issue had different exposure conditions; administrators should assess this NGOAM advisory independently and schedule the appropriate NX-OS upgrade.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Critical Cisco Nexus Flaws Let Unauthenticated Attackers Execute Code With Root Privileges appeared first on Cyber Security News.

WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses.

The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported.

The release documentation lists seven security issues, although its introductory sentence describes “one security fix.” It provides no CVE identifiers, severity scores, or confirmed exploitation details. Consequently, the headline’s critical wording should not be interpreted as an official severity classification for every vulnerability.

One vulnerability involves stored cross-site scripting on the Comments administration page. Pending comments provide the attack surface, potentially exposing administrators when they review submitted content.

Thomas Chauchefoin of Trail of Bits reported this issue. The disclosure does not describe the malicious payload or precise conditions required for successful exploitation.

A separate cross-site scripting weakness affects Imgur embeds. WordPress credits Zhengyu Liu, Jingcheng Yang, and Gavin Zhong with reporting it.

These two findings concern different content pathways: comment moderation and embedded media. Both make the update relevant to sites that process user content or display externally sourced material.

WordPress Vulnerabilities

Anthropic reported a second-order SQL injection vulnerability in WordPress WXR export. The release identifies the export component but does not explain the injection sequence, required permissions, or database impact.

Administrators should therefore avoid assuming that the issue enables unrestricted database access or that every export operation is exploitable. Another vulnerability allows unauthenticated disclosure of comments associated with private and unpublished posts.

Reported by Ananda Dhakal of Patchstack, this issue affects information expected to remain outside public access. The announcement identifies comments as the exposed data it does not claim that attackers can retrieve complete private posts.

Anthropic also reported a weakness that lets users with the Author role make posts sticky. This represents an authorization problem involving a publishing capability.

Separately, Alex Concha of the WordPress security team reported forgeable parameters passed to the {status}_{type} hook that can produce action name collisions. The announcement leaves the broader exploitation consequences unspecified.

A denial-of-service issue affects the WP_Http::make_absolute_url() method. Anthropic reported this finding as well, but WordPress provides no request pattern, resource-consumption measurements, or detailed attack prerequisites in the release notes.

Administrators can install WordPress 7.1.3 through Dashboard > Updates or obtain it from the official releases page. WordPress explicitly recommends updating sites immediately because this is a security release. Older affected branches also receive these fixes, but that doesn’t change the project’s stated support policy.

The revised files span administration JavaScript, export handling, REST posts, customization, HTTP processing, embeds, queries, and post operations. No packages were revised.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks appeared first on Cyber Security News.

Dell has released security update DSA-2026-448 to address multiple critical vulnerabilities in its Container Storage Modules, including flaws that could allow unauthenticated remote attackers to take full administrative control of affected storage environments.

Organizations using vulnerable Dell CSM deployments should upgrade immediately, as Dell stated that no workarounds or mitigations are available.

The advisory affects Dell Container Storage Modules versions before 1.17.0, with fixes available in 1.18.0 and later, covering CSM Authorization, CSM Operator, CSI components, and third-party Go libraries.

The most severe vulnerabilities are CVE-2026-63688 and CVE-2026-63692, both assigned a CVSS score of 10.0. CVE-2026-63688 is a missing authentication flaw in the csm-authorization-storage gRPC server in CSM Authorization version 2.4.0.

An unauthenticated attacker could exploit the flaw to access administrator credentials for all registered storage arrays, potentially gaining control across Dell’s five supported storage product families.

Access to backend administrator credentials could enable an attacker to change storage configurations, access sensitive data, disrupt workloads, or create persistent access paths within the environment.

Critical Dell Container Storage Flaws

CVE-2026-63692 also affects CSM Authorization version 2.4.0. The vulnerability exists in the authorization proxy and tenant service, where critical functions can be reached without proper authentication.

Successful exploitation could allow a network-based attacker to bypass authentication controls and elevate privileges to the administrative level. This could expose and enable manipulation of storage resources across all tenants.

Another critical issue, CVE-2026-54472, is a hard-coded credentials vulnerability in CSM Authorization. The flaw could allow an unauthenticated remote attacker to forge cryptographically valid administrative JSON Web Tokens and gain administrator access to the CSM Authorization proxy.

Dell rated the flaw CVSS 9.8 and advised rotating JWT signing secrets after updating, the advisory also addresses CVE-2026-61421 in the archived karavi-authorization component.

Dell said older documentation used the JWT signing secret “supersecret” alongside a real token example. Organizations that deployed karavi-authorization using this documented value and never changed the signing secret may remain exposed to forged-token attacks and administrative takeover.

CVE-2026-67269 in Dell CSM Operator 1.12.0 could let low-privileged remote users gain root access to Kubernetes nodes via a malicious ContainerStorageModule resource, Dell rated it 9.9 due to potential cluster-wide compromise.

CVE-2026-67273, rated 9.6, could permit a low-privileged attacker to access Kubernetes Secrets and create cluster-scoped RBAC resources through template-engine injection. Such access could effectively bypass intended Kubernetes permissions and allow broad control of cluster resources.

Other flaws include improper certificate validation, missing authorization in the Dell CSI Driver for PowerMax, sensitive-information disclosure through logs, and flaws affecting CSI drivers for PowerFlex, PowerMax, and PowerStore.

The update also addresses vulnerabilities in third-party Go components, including golang.org/x/crypto, golang.org/x/net, golang-jwt/jwt, and protobuf.

Dell recommends upgrading all affected Container Storage Modules deployments to version 1.18.0 or later at the earliest opportunity. Security teams should also rotate JWT secrets, review CSM Authorization access logs, audit administrative token usage, and check Kubernetes RBAC policies and custom resources for unauthorized changes.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control appeared first on Cyber Security News.

Kiteworks has released a major security update that addresses 126 vulnerabilities across its secure data transfer platform and associated applications.

The update includes fixes for critical account takeover flaws, high-severity code execution bugs, security bypass issues, unauthorized data modification, privilege escalation, and denial-of-service conditions.

The company published the vulnerabilities through its public security advisories repository, which provides affected-version details and remediation guidance for Kiteworks products.

Organizations using Kiteworks Core, Kiteworks Secure Data Forms, and Kiteworks Email Protection Gateway should review their deployed versions and apply the latest updates as soon as possible.

The most severe findings affect Kiteworks Core and Kiteworks Email Protection Gateway versions before 9.5.1. Both products were affected by critical account takeover vulnerabilities tracked as GHSA-xgh2-fgj6-w93r and GHSA-c9w5-4frw-7wqq.

Successful exploitation could allow an attacker to take control of a user account, potentially gaining access to sensitive files, email workflows, data-sharing functions, or administrative capabilities depending on the compromised account’s privileges.

Kiteworks Patches 126 Vulnerabilities

Kiteworks Core versions before 9.5.1 were also vulnerable to arbitrary code execution, tracked as GHSA-gmgg-7xhc-75f9. Code execution flaws are especially dangerous because they can let an attacker run malicious commands on a targeted server. In enterprise environments, this could enable data theft, persistent access, lateral movement, or ransomware deployment.

Another high-severity Core issue, GHSA-m39v-w8fv-gf3m, could allow privilege escalation. An attacker with limited access may be able to obtain permissions beyond those intended by administrators.

Kiteworks Core also received a fix for a moderate-severity flaw, GHSA-h97r-j99c-q8xc, which could expose internal network resources to an unauthorized party.

The update also resolves several issues in Kiteworks Email Protection Gateway before version 9.5.1. The affected vulnerabilities include unauthorized file modification flaws tracked as GHSA-5pgq-v8g2-rg2f and GHSA-3p9g-jh62-8f89, along with a moderate denial-of-service issue identified as GHSA-wwhf-5862-rjxq.

Unauthorized file modification weaknesses could allow malicious changes to files the gateway processes or protects. At the same time, denial-of-service attacks could interrupt email security operations.

Kiteworks Secure Data Forms versions before 9.5.0 were affected by a high-severity unauthorized data modification vulnerability (GHSA-9×72-vqwh-v4hv). The company also fixed a separate high-severity security bypass issue in Secure Data Forms versions before 9.5.1, tracked as GHSA-vwvw-rp3m-rm37.

Kiteworks said it discloses vulnerability details for up to 12 months after releasing a fix. Existing customers can obtain product-specific remediation information through release notes distributed with each update.

Security teams should upgrade affected deployments to version 9.5.1 or later, where applicable, verify exposed Kiteworks services, review account activity for suspicious access and ensure administrative accounts use strong authentication controls.

Organizations should also assess whether internet-facing Core, Email Protection Gateway, or Secure Data Forms instances were reachable before patching.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Kiteworks Patches 126 Vulnerabilities in Massive Security Update appeared first on Cyber Security News.

Axios has disclosed two high-severity vulnerabilities in its HTTP/2 implementation that could allow attackers to bypass outbound network controls or crash vulnerable Node.js applications. The flaws affect Axios versions 1.13.0 through 1.19.x and have been fixed in version 1.20.0

The first issue, tracked as GHSA-3pq3-5fj3-cg6v and CVE-2026-101898, affects Axios applications that use HTTP/2 requests alongside custom DNS lookup functions or proxy settings.

Axios may fail to apply caller-supplied config. It may fail to apply caller-supplied DNS lookup policies, explicit proxy settings, or proxy configuration inherited from environment variables before creating an HTTP/2 connection.

This creates a server-side request forgery risk in applications that accept user-controlled URLs. Security teams commonly use a custom DNS resolver to block internal addresses, cloud metadata services, localhost targets, or private network ranges.

Other deployments force outbound traffic through an inspection proxy. Under the vulnerable HTTP/2 code path, Axios can connect directly to a destination instead of honoring those protections.

Axios HTTP/2 Flaws

An attacker could abuse the flaw when an application passes a user-influenced destination into Axios with httpVersion: 2. For example, a web service designed to fetch external URLs may use a DNS allowlist to prevent requests to 127.0.0.1, RFC1918 networks, or cloud metadata endpoints.

If the service switches to the affected HTTP/2 adapter, Axios could bypass the custom lookup or proxy route and send a direct request to a restricted resource.

The second issue, GHSA-542g-h47m-68v8 and CVE-2026-101901, can cause denial-of-service in Node.js applications. Axios did not install adequate error handling for a ClientHttp2Session during HTTP/2 session initialization or reuse.

If that session emits an error event, the event may escape Axios’s normal Promise rejection handling and become an uncaught exception.

In Node.js, an unhandled error event can terminate the running process. Therefore, an attacker who can influence a request flow that creates or reuses an Axios HTTP/2 session may be able to force an affected service offline.

The practical risk is highest in applications that use Axios to retrieve attacker-controlled URLs, call external integrations, process webhooks, or proxy requests to user-specified hosts.

The Axios advisory covers two high-severity flaws following the introduction of HTTP/2 support in its Node.js HTTP adapter in version 1.13.0.

Organizations should upgrade Axios to version 1.20.0 or later immediately. Until patching is complete, teams should turn off HTTP/2 requests by removing httpVersion: 2 or using HTTP/1.1.

Defenders should also review applications that fetch user-supplied URLs, validate destination hosts before initiating requests, maintain egress filtering outside the application layer, and monitor outbound connections for unexpected internal or metadata-service access.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Axios HTTP/2 Flaws Enable SSRF Control Bypass and Node.js Denial of Service appeared first on Cyber Security News.

Multiple newly disclosed vulnerabilities in OWASP ModSecurity could let attackers bypass web application firewall protections by exploiting parsing differences, malformed input, transformation errors, and resource limits.

The flaws affect functions commonly used to inspect HTTP requests and responses, raising concerns for organizations that rely on ModSecurity rules to detect malicious payloads.

One of the most serious issues, tracked as GHSA-5pww-8rfg-9crf, involves the RFC 2231 filename* parameter in multipart HTTP uploads.

ModSecurity applies strict validation rules to filenames, but RFC-compliant application backends written in Go, Python, Node.js, or Java may interpret encoded filename* values differently. An attacker could craft an uploaded file request that the backend accepts while avoiding ModSecurity filename inspection rules.

This mismatch can create a dangerous gap between the firewall and the protected application. Security rules may block suspicious extensions, path traversal strings, or malicious filenames in standard fields.

Meanwhile, the backend processes the RFC 2231-encoded value. The issue is rated High severity because it may allow a malicious file upload or evade security controls designed around multipart filename validation.

ModSecurity Vulnerabilities

Another Moderate-severity vulnerability, GHSA-4j47-8qcr-jf59, affects the t:base64DecodeExt transformation. When the transformation encounters a malformed Base64 padding group, it silently discards the complete decoded output.

As a result, ModSecurity rules relying on the transformed value may see an empty or incomplete string and fail to match an otherwise malicious payload.

Attackers often encode SQL injection, cross-site scripting, command injection, or web shell content to evade signature-based filtering.

If a firewall decodes the data incorrectly and stops inspecting it, it can bypass a rule designed to identify dangerous strings. This flaw illustrates why malformed data handling is as important as normal input processing in web application firewalls.

A third flaw, GHSA-qrch-pjfr-9g47, affects the removeComments transformation. The feature is intended to remove comments from an input before it is checked against security rules.

However, adjacent comments may not be removed correctly, allowing an attacker to split suspicious keywords with comment syntax and potentially evade pattern matching.

For example, a payload can insert comments between fragments of a dangerous command or SQL statement. If ModSecurity fails to normalize the full input, the request may not match a blocking rule even though the backend reconstructs or accepts the malicious expression.

Additional advisories include a High-severity response body inspection bypass, an XML request-body processor pointer dereference flaw, multipart form-data parsing weaknesses, and an issue where PCRE2 @rxGlobal match-limit errors are treated as no match.

Together, the vulnerabilities show that inspection engines can fail when their parsing behavior differs from the applications they protect.

Administrators should review the affected ModSecurity release notes and security advisories, update to patched versions as they become available, and test rules against encoded, malformed, multipart, and comment-obfuscated payloads. Organizations should also use layered defenses rather than depending solely on WAF signatures for application security.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post ModSecurity Vulnerabilities Let Attackers Bypass Web Application Firewall Protections appeared first on Cyber Security News.

TeamViewer has released security updates to fix five high-severity vulnerabilities affecting its Full Client, Host, and related components across Windows, Linux, and macOS.

The most serious issue could allow attackers to bypass configured remote-session permissions and potentially execute code on vulnerable systems.

The company urged customers to update TeamViewer clients to version 15.82 or the latest version available. TeamViewer said it is not aware of public disclosure or active exploitation of the vulnerabilities in the wild.

The primary privilege-escalation issue, tracked as CVE-2026-19743, affects TeamViewer Full Client and Host installations before version 15.82 on Windows, Linux, and macOS.

The TeamViewer local IPC flaw allows low-privileged authenticated users to manipulate file paths and write arbitrary files with elevated SYSTEM or root privileges.

The flaw has a CVSS score of 7.8. It is classified as CWE-22, an improper limitation of a pathname to a restricted directory, commonly known as path traversal.

The issue also affects several supported legacy and maintenance releases, including TeamViewer 15.64, 14.7, and 13.2 on selected operating systems.

TeamViewer Vulnerabilities

TeamViewer also addressed CVE-2026-92369, a time-of-check time-of-use race condition in the Windows installer rollback mechanism.

A local attacker with low privileges could replace backup files located in a user-writable temporary directory before an elevated installer restores them. If successfully timed during an installation, update, or rollback event, the attack could result in SYSTEM-level privileges.

Another vulnerability, CVE-2026-92371, impacts the Cloud Session Recording function on Linux. The flaw involves improper link resolution during file access.

A local authenticated attacker could exploit a race condition to redirect privileged file operations to unintended locations. This issue affects Linux TeamViewer Full Client and Host versions from 15.0 through releases before 15.82.

CVE-2026-92368 is a heap-based buffer overflow when handling TeamViewer .tvs session recording files on Linux and macOS. The issue stems from a size mismatch during decompression of recorded session data.

An attacker could create a malicious session recording file and trick a victim into opening it through the “Play or convert recorded session” feature.

Successful exploitation could allow arbitrary code execution with the logged-in user’s permissions. The vulnerability affects TeamViewer versions from 15.70 up to, but not including, 15.82 on Linux and macOS.

CVE ID	Vulnerability	Severity	CVSS
CVE-2026-19743	Path traversal in local IPC	High	7.8
CVE-2026-92368	Heap buffer overflow in .tvs playback	High	7.8
CVE-2026-92369	TOCTOU race in Windows installer	High	7.3
CVE-2026-92370	Improper access control	High	8.8
CVE-2026-92371	Improper link resolution	High	7.0

CVE-2026-92370, the highest-rated flaw with a CVSS score of 8.8, could allow authenticated remote attackers to bypass user-configured restrictions and perform denied actions by altering access-control parameters.

TeamViewer warned that the flaw could lead to unauthorized activity and potentially remote code execution on the affected endpoint.

Organizations should identify systems running TeamViewer Full Client or Host and upgrade to version 15.82 or the latest supported maintenance release.

Security teams should also review TeamViewer access-control settings, limit remote-access privileges, restrict local access to managed endpoints, and monitor for unusual installer activity, suspicious session-recording files, or unexpected changes to protected system files.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Critical TeamViewer Vulnerabilities Enable Code Execution Attacks Via Remote Session appeared first on Cyber Security News.

GitHub Security Lab has disclosed that its open-source AI security agent identified 24 vulnerabilities in Android applications, including flaws that could enable covert location tracking in OsmAnd and account takeover attacks against Wikipedia for Android.

The findings highlight how targeted AI workflows can help researchers uncover complex mobile logic flaws, while still requiring human validation.

The research used the GitHub Security Lab Taskflow Agent, an open-source framework designed to automate and share AI-assisted security research workflows.

Rather than asking a large language model to scan an entire repository with a general prompt, researchers created Android-specific taskflows that broke audits into smaller stages.

One taskflow identifies mobile entry points, such as exported activities, services, broadcast receivers, and deep links. Another taskflow assesses each entry point against Android-focused vulnerability classes, including insecure intents, confused deputy problems, unsafe broadcasts, cross-app scripting, and WebView risks.

This structure helps the AI understand the relevant attack surface in repositories that may contain mobile, web, and desktop code.

GitHub AI Finds 24 Android Vulnerabilities

One of the most serious findings affected OsmAnd, an Android navigation application with more than 10 million downloads. Researchers found that the app’s exported MapActivity accepted security-sensitive intent extras while importing settings.

Because exported Android activities can receive intents from other applications, a malicious app could supply attacker-controlled values such as silent_import, replace, and export_type_list_key.

The vulnerable logic allowed an unprivileged malicious application to silently import and replace OsmAnd settings without alerting the user. An attacker could modify the application’s map-tile source so that map requests were sent to an attacker-controlled server.

By logging tile coordinates, the attacker could infer a victim’s location and movements. The same weakness could also expose routing requests, including route origins and destinations. At the same time, the user continued using the application normally.

GitHub also detailed an account takeover chain in the Wikipedia Android application. The app registers a wikipedia:// deep link handler to open content inside its WebView. However, the hostname validation used an endsWith() check instead of validating the exact trusted domain.

This allowed a malicious domain such as evil-wikipedia.org to satisfy the suffix check because its name ends with wikipedia.org. An attacker could create a malicious webpage containing a crafted deep link and persuade a victim to open it.

The Wikipedia app could then load attacker-controlled content inside its WebView, potentially making the victim believe they were viewing a legitimate Wikipedia page.

A second domain-suffix validation issue in the application’s cookie-handling code made the attack more severe. The flawed check could cause the WebView to provide Wikimedia cookies to the attacker-controlled page.

Researchers said the stolen data could include a username, long-lived authentication token, and session token valid across Wikimedia projects, including Wikipedia, Wikimedia Commons, Wikidata, and Meta. Chaining the two bugs could therefore result in account takeover after a victim taps a single malicious link.

GitHub cautioned that AI-generated findings must not be accepted without expert review. Large language models can identify code patterns and relevant APIs effectively. However, they can also misjudge severity, overlook mitigating behavior, or generate false positives.

Researchers found that requiring the model to build a proof of concept can improve triage, although human testing remains essential.
The Taskflow Agent and Android audit workflows are publicly available.

GitHub said users need a GitHub Copilot license, and audits can consume substantial premium-model requests because medium-sized repositories may take one to two hours and require many tool calls. The results are stored in an SQLite audit_results table for researcher review.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post GitHub AI Security Agent Finds 24 Android Vulnerabilities Including Account Takeover Flaws appeared first on Cyber Security News.

wolfSSL has released version 5.9.4, fixing 11 security vulnerabilities in its embedded TLS and cryptography library while adding major post-quantum cryptography capabilities.

The update is important for developers using wolfSSL in IoT devices, embedded products, servers, gateways, and applications that depend on TLS or DTLS for secure communications.

The release addresses three high-severity, four medium-severity, and four low-severity CVEs. wolfSSL said most flaws affect particular build options, APIs, or non-default configurations rather than every deployment.

Still, organizations should review their compilation flags and update affected installations, especially deployments using OpenSSL-compatible settings, Raw Public Keys, OCSP stapling, certificate revocation checks, or TLS 1.2 session resumption.

The three high-severity flaws could weaken TLS peer authentication in certain builds. CVE-2026-93302 affects deployments using trusted peer certificates through WOLFSSL_TRUST_PEER_CERT.

The issue could allow a forged certificate authority clone to pass validation when an attacker knows the CA certificates trusted by the target. It may affect compatibility-focused configurations used with software such as nginx, HAProxy, stunnel, Apache HTTP Server, BIND, and rsyslog.

wolfSSL 5.9.4 Fixes TLS Security Flaws

CVE-2026-89102 affects clients that enable RFC 6961 multiple OCSP response stapling. A vulnerable client could accept a certificate in a server-provided chain as a certificate authority without checking whether that certificate is authorized to issue certificates. An attacker with a certificate chaining to a trusted CA could potentially forge certificates for arbitrary identities.

The third high-severity issue, CVE-2026-89136, affects clients built with Raw Public Key support. A malicious server could send an unsolicited Raw Public Key and bypass normal X.509 certificate-chain validation.

Raw Public Key support is turned off by default. However, it is enabled through options such as –enable-rpk, –enable-all, and –enable-distro.

wolfSSL 5.9.4 also fixes certificate name-constraint validation errors. One medium-severity flaw could allow a certificate to escape DNS name constraints if an unconstrained CA appeared between a name-constrained intermediate CA and the leaf certificate.

Another issue involved certificates that carried a Subject Alternative Name of a type other than DNS, allowing an invalid Common Name to bypass a DNS name-constraint check.

Other fixes address an out-of-order ChangeCipherSpec message in TLS 1.2 and DTLS 1.2, an OCSP and CRL fallback issue that could accept a revoked certificate, and a session-cache reference issue affecting legacy TLS 1.2 and DTLS 1.2 resumption flows. The release also resolves a potential use-after-free condition during TLS shutdown.

CVE	Severity	Affected Versions	Vulnerability	Fixed In
CVE-2026-93302	High	5.3.0–5.9.2	Trusted-peer certificate bypass	5.9.4
CVE-2026-89102	High	5.7.2–5.9.2	OCSP stapling certificate forgery	5.9.4
CVE-2026-89136	High	5.6.0–5.9.2	Raw Public Key auth bypass	5.9.4
CVE-2026-93304	Medium	4.7.0–5.9.2	ChangeCipherSpec bypass	5.9.4
CVE-2026-89133	Medium	≤5.9.2	X.509 NameConstraints bypass	5.9.4
CVE-2026-89134	Medium	5.9.2	Common Name constraint bypass	5.9.4
CVE-2026-89135	Medium	5.8.4–5.9.2	Unverified CA persistence	5.9.4
CVE-2026-15442	Low	4.4.0–5.9.2	TLS shutdown use-after-free	5.9.4
CVE-2026-94417	Low	≤5.9.2	OCSP/CRL check bypass	5.9.4
CVE-2026-94418	Low	3.15.5–5.9.2	Certificate signature bypass	5.9.4
CVE-2026-94419	Low	5.3.0–5.9.2	TLS session-cache confusion	5.9.4

Administrators should not assume that only updating the shared library is enough. For some affected long-running applications, wolfSSL states that the WOLFSSL_CTX or entire process should be restarted because certificate or session state may persist in memory.

Beyond security fixes, wolfSSL 5.9.4 significantly expands its post-quantum cryptography support. The release adds native Falcon signature support, replacing the prior dependency on the liboqs library.

It also introduces FrodoKEM, a post-quantum key encapsulation mechanism, with optimized implementations for x86_64, AArch64, AArch32, and Thumb2 platforms.

The update adds SLH-DSA authentication for TLS 1.3 and DTLS 1.3 handshakes across all 12 parameter sets. Developers can also build post-quantum-only TLS 1.3 configurations using ML-KEM key exchange with ML-DSA or SLH-DSA authentication, without traditional RSA, elliptic-curve cryptography, or Diffie-Hellman algorithms.

wolfSSL also added AVX512 acceleration for ML-KEM and ML-DSA, ML-DSA support for PKCS#7 and CMS SignedData, and an –enable-all-quantum-crypto configuration bundle.

These improvements position the library for organizations preparing systems against future cryptographically relevant quantum computers.

Organizations running wolfSSL 5.9.2 or earlier should identify enabled build features and upgrade to version 5.9.4 or a downstream package containing the fixes.

Priority should be given to systems using trusted-peer certificate APIs, multi-OCSP stapling, Raw Public Keys, OpenSSL compatibility APIs, OCSP plus CRL checking, and legacy session resumption.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post wolfSSL 5.9.4 Fixes 11 TLS Security Flaws and Expands Post-Quantum Cryptography Support appeared first on Cyber Security News.

WatchGuard has disclosed three security vulnerabilities affecting WatchGuard AP devices, including two critical flaws that could allow attackers to gain unauthenticated access and execute commands on vulnerable access points.

Organizations using WatchGuard AP firmware earlier than version 3.4.8 should apply the available update immediately. The vulnerabilities were published on September 28, 2026, and affect WatchGuard AP versions from 1.0 through 3.4.7.

WatchGuard addressed all three issues in version 3.4.8. The most serious issue, tracked as CVE-2026-86102, carries a CVSS v4 score of 9.3. The vulnerability is an OS command injection flaw in the internal management API service.

An attacker with network access to a vulnerable WatchGuard AP could send crafted input to trigger arbitrary shell command execution on the underlying operating system.

No authentication or user interaction is required, making the bug especially dangerous where the affected API service is reachable from untrusted networks.

WatchGuard API Vulnerabilities

A second critical vulnerability, CVE-2026-101891, is also rated 9.3. It stems from improper access control in an internal API service on WatchGuard access points. The flaw allows an unauthenticated attacker with network access to access functionality that should be protected.

This issue could provide a path for attackers to interact with internal management capabilities and potentially support follow-on compromise attempts against the device or connected environment.

The third vulnerability, CVE-2026-87969, is a high-severity command injection issue with a CVSS v4 score of 8.6. Unlike the two critical flaws, exploitation requires authenticated administrator privileges.

A malicious or compromised administrator account could supply crafted input through the diagnostic command-line interface and execute arbitrary operating system commands on the WatchGuard AP.

Command injection vulnerabilities are particularly serious in network appliances because compromised access points can become a foothold inside enterprise networks.

Attackers may use command execution to collect configuration data, modify device settings, deploy persistence mechanisms, intercept network traffic, or attempt lateral movement toward other systems.

Devices exposed through management networks, remote-access paths, or poorly segmented wireless infrastructure may face greater risk.

Security teams should first identify all deployed WatchGuard AP devices and verify their firmware versions. Prioritize upgrading devices running a release earlier than 3.4.8.

Administrators should also restrict access to AP management interfaces and internal API services. They should be reachable only from trusted administrative networks.

Organizations should review access logs, administrative activity, diagnostic CLI usage, and configuration changes for signs of unexpected activity. They should also rotate administrative credentials if there is any indication that an AP management account may have been exposed.

Network segmentation can reduce the impact of a compromised wireless device by limiting its ability to communicate with critical internal systems.

There is currently no public evidence of active exploitation or a publicly available proof-of-concept for the disclosed vulnerabilities. However, the unauthenticated nature and critical severity of the internal API flaws make rapid patching essential for WatchGuard AP deployments.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Critical WatchGuard API Vulnerabilities Enables Command Execution Attacks appeared first on Cyber Security News.