Palo Alto Confirms PAN-OS Firewalls Exposed to Critical PHP Remote Code Execution Bugs
Palo Alto Networks has confirmed that two critical PHP vulnerabilities reach into PAN-OS firewalls and Panorama management systems, with hotfixes still days away. Proof-of-concept exploits already exist for...
Attackers Are Actively Hijacking Unpatched Citrix NetScaler Appliances to Plant Web Shells
Security researchers have documented a live exploitation campaign against a critical, already-disclosed Citrix NetScaler flaw, using a clever log-poisoning technique to achieve remote code execution, install web shells,...
Critical Cisco Expressway Cluster Flaw Opens Path to Root RCE
Cisco has patched a CVSS 9.8 vulnerability that could let a remote attacker execute operating-system commands as root on clustered Expressway systems. There is no workaround, making an...
Splunk Patches 24 Flaws, Including Four Critical Enterprise and SOAR Bugs
Splunk has issued a broad security release correcting 24 vulnerabilities across Enterprise, SOAR, and Secure Gateway. Four flaws are rated critical, while several others create command-execution, authorization-bypass, or...
eMudhra Abandons Global SSL/TLS Certificate Business After Weak-Key Disaster
Indian digital trust provider eMudhra is walking away from the global SSL/TLS certificate market entirely, weeks after researchers showed that eight of its intermediate CA certificates were signed...
Unpatched Linux KSMBD Flaws Exposed Before Fixes Were Ready
Technical details for several unresolved Linux-related vulnerabilities were posted publicly before fixes were broadly available. Two CVSS 9.0 KSMBD flaws could enable remote code execution, although exposure depends...
GitLab Fixes 12-Year-Old CVSS 10 Flaw Enabling Unauthenticated RCE
GitLab has patched a maximum-severity vulnerability that could let an unauthenticated attacker execute code on self-managed servers. The affected code dates to GitLab 7.0, making immediate upgrades and...
Node.js Patches Brotli RCE and High-Severity TLS and DNS Flaws
New Node.js releases address ten vulnerabilities across supported branches, including a potential Brotli remote code execution flaw and certificate-validation bypasses. Teams should update runtimes, rebuild application images and...