Vulnerabilities

One link in Elementor 4.3 can make an admin create another admin

One link in Elementor 4.3 can make an admin create another admin

Versions 4.3.0 and 4.3.1 skip WordPress REST CSRF checks. Update to 4.3.2 before someone clicks the wrong email....
Someone stole an Azure service principal and wiped storage in seven minutes

Someone stole an Azure service principal and wiped storage in seven minutes

Storm-3168 used compromised workload identities to delete Azure Storage, Key Vaults, and Function Apps. Check your service principals before standup....
The app your team built with AI may be leaking its users table. Check Supabase today

The app your team built with AI may be leaking its users table. Check Supabase today

UpGuard found 16,326 Supabase databases with tables anyone can read. If someone shipped a quick app on Supabase, check row…
iPhones still on iOS 26 need Apple’s new update after targeted attacks

iPhones still on iOS 26 need Apple’s new update after targeted attacks

Apple says a CoreGraphics bug may have been used against specific people on iOS before 27. Update to 26.7.1 or…
Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

A federal tip led Kiteworks to recommend a weekend shutdown. The flaw sits in Advanced Forms, and every customer should…
PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

ShinyHunters changed one letter in the URL and got past the WAF rules protecting PeopleSoft. Oracle’s June fix is the…
WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

An unsupported JWT algorithm can become an admin session on WSO2 API Manager and Universal Gateway. KEV due was September…
Zimbra OnlyOffice can turn a public Briefcase link into a shell

Zimbra OnlyOffice can turn a public Briefcase link into a shell

Unauthenticated RCE when OnlyOffice meets a public Briefcase document. Patch to 10.1.21 or turn the feature off....
SharePoint’s federal clock runs out today — confirm the August builds

SharePoint’s federal clock runs out today — confirm the August builds

CISA’s SharePoint KEV is due Monday September 28. Microsoft already confirmed observed attacks — verify the farm builds....
NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

Citrix confirmed two NetScaler RCEs were exploited before Saturday’s fix. One hits every appliance in the default config....
Your GitLab issue-email address can push code — rotate it today

Your GitLab issue-email address can push code — rotate it today

GitLab's issue-by-email address carries an account-wide token that can push code and run CI jobs past IP allowlists. How to rotate it and check for misuse.
One cPanel account can own the whole server: patch today

One cPanel account can own the whole server: patch today

A cPanel CalDAV/CardDAV flaw lets any hosting account run code as root. Update to 11.134.0.57, 11.136.0.41 or 11.138.0.8, plus WP Toolkit 6.11.3, today.
Old Roundcube webmail bug now exploited: update this week

Old Roundcube webmail bug now exploited: update this week

A pre-auth SQL injection in Roundcube's virtuser_query plugin is now exploited. Update to 1.6.16 or 1.7.1 or disable the plugin. Here's what to check today.