Actively Exploited Collabora RCE Leaves Nextcloud Servers Backdoored
Attackers are exploiting CVE-2026-110447, a critical unauthenticated command-injection flaw in the Collabora Online Built-in CODE Server app for Nextcloud. Administrators must upgrade to richdocumentscode 26.4.303 or later and...
Proxyjacking Campaign Hijacks D-Link, Ubiquiti and SAP Flaws to Build a Residential Proxy Network
Researchers at GreyNoise have uncovered a campaign that exploited old vulnerabilities in D-Link NAS devices, Ubiquiti UniFi Video recorders, and SAP NetWeaver to secretly enroll at least 143...
Plex2Shell Attacks Turn Exposed Media Servers Into Cryptomining Nodes
Attackers are using the public Plex2Shell exploit chain against internet-facing Plex Media Server instances to install an XMRig miner and proxy software. Administrators should update immediately and inspect...
October Windows Server Updates Disrupt Exchange Mail Flow and Web Access
Microsoft says October 2026 Windows Server security updates can interrupt Exchange webmail, message delivery, and database availability. A registry-based mitigation is available, and administrators are advised to keep...
Researcher Details Critical Prompt-Injection Risk in ChatGPT GitHub Workflows
A researcher says hostile instructions hidden in a public repository could redirect an AI-assisted GitHub workflow toward a private repository and expose secrets. The reported 9.3-severity scenario highlights...
PwnEscape: Linux Kernel Bug Lets Rogue VMs Reach Into the Host
A Linux kernel flaw dubbed PwnEscape (CVE-2026-99999) lets an attacker-controlled virtual machine leak host memory through a checksum-handling bug in the networking stack, with researchers demonstrating a path...
GitLab Patches Maximum-Severity RCE Flaw as Exploit Code Goes Public
A public proof-of-concept now exists for CVE-2026-97229, a maximum-severity (CVSS 10.0) GitLab vulnerability that chains a CI/CD regex integer overflow into remote command execution. Self-managed GitLab instances on...
One Click, Full Corruption: Critical Adobe Acrobat Flaw Found by AI-Assisted Fuzzing
Adobe has patched CVE-2026-81983, a critical integer-overflow bug in Acrobat's image-parsing pipeline that lets a malicious PDF corrupt memory the moment it's opened. The flaw was uncovered using...