GitLab Fixes 12-Year-Old CVSS 10 Flaw Enabling Unauthenticated RCE
GitLab has patched a maximum-severity vulnerability that could let an unauthenticated attacker execute code on self-managed servers. The affected code dates to GitLab 7.0, making immediate upgrades and...
Node.js Patches Brotli RCE and High-Severity TLS and DNS Flaws
New Node.js releases address ten vulnerabilities across supported branches, including a potential Brotli remote code execution flaw and certificate-validation bypasses. Teams should update runtimes, rebuild application images and...
GoDaddy Forces Mass TLS Certificate Reset After Compliance Lapse Hits 400,000+ Sites
GoDaddy has revoked more than 404,000 SSL/TLS certificates issued under its GoDaddy and Starfield chains after discovering the certificates did not match its published certificate policies, then missed...
PHP Prepares Emergency Fixes for Two Critical 9.2 Flaws
PHP is preparing security updates for two critical vulnerabilities rated 9.2 under CVSS 4.0. Administrators should inventory exposed PHP systems now and apply the official fixes as soon...
WP2Shell Chains WordPress Flaws Into Unauthenticated Server Takeover
The WP2Shell technique combines two WordPress Core vulnerabilities to create administrator access and deploy a plugin-based web shell without a login. Operators should upgrade to a fixed release...
Exploited SiteGuard Flaw Can Elevate Attackers to Root or SYSTEM
Attackers are exploiting CVE-2026-106931, a command-injection flaw in SiteGuard Server Edition's default-enabled statistics feature. Administrators should preserve diagnostic evidence before applying the vendor's update or replacement-file patch.
Sixteen-Year-Old Broadcom WPS Bug Exposes Routers Over the Air
Research has exposed a memory-corruption flaw in Broadcom's proprietary WPS implementation that can be attacked from wireless range without the network password. Demonstrations recovered a saved key from...
Critical Drupal Field UI Flaw Opens Unauthenticated Takeover Paths
Drupal has patched CVE-2026-108097, a critical Field UI vulnerability that can enable remote code execution when certain contributed modules or custom code are present. At least one confirmed...