N-able Pulls N-central Offline Worldwide After Researcher Drops 33 Alleged Zero-Day Exploits
N-able shut down its hosted N-central environments globally and told on-premises customers to do the same, after a researcher published 33 claimed zero-day vulnerabilities and working exploit code...
SonicWall Flags Possible Active Exploitation of SSLVPN Flaw That Slips Past MFA
SonicWall has warned customers to patch seven SonicOS vulnerabilities after a researcher reported signs of possible in-the-wild exploitation. The most serious flaw lets an attacker with valid alternate...
A Single Claude Code Approval Setting Has Leaked Thousands of Secrets to Public GitHub Repos
Researchers at Apiiro found 2,539 exposed secrets across nearly 2,000 public GitHub repositories, traced back to Claude Code's 'Yes, and don't ask again' approval option, which can save...
Critical React Server Components Bug Opens the Door to Unauthenticated Remote Code Execution
A newly disclosed React security advisory, carrying a 9.5 CVSS score, warns that specially crafted requests to React Server Components can trigger remote code execution with no login...
A WordPress Upgrade Bug Drew 240,000 Attack Attempts in Days — Here’s Why the Window Was So Narrow
Attackers fired off more than 240,000 exploitation attempts against a newly disclosed WordPress Core flaw within days of its patch release. The bug, rated 8.1 on the CVSS...
A 300-Character Password Can Unlock Alpine Linux Servers Thanks to an OpenSSH Quirk
A newly patched OpenSSH flaw lets attackers bypass password checks on Alpine Linux systems running musl without PAM, turning an oversized password into an accidental skeleton key for...
Maximum-Severity Flaw in SolarWinds Dameware Puts Remote Support Sessions at Risk
SolarWinds has patched a near-maximum-severity command injection flaw in its Dameware remote support software, tracked as CVE-2026-28336 with a CVSS score of 9.9. An authenticated attacker could use...
Critical Rails Flaw Lets a Single Malicious Image Upload Expose Server Secrets
A critical, CVSS 9.8 flaw in Ruby on Rails' Active Storage lets an unauthenticated user trigger file writes, and in some configurations file reads, simply by uploading a...