Maximum-Severity Flaw in SolarWinds Dameware Puts Remote Support Sessions at Risk
SolarWinds has patched a near-maximum-severity command injection flaw in its Dameware remote support software, tracked as CVE-2026-28336 with a CVSS score of 9.9. An authenticated attacker could use...
Critical Rails Flaw Lets a Single Malicious Image Upload Expose Server Secrets
A critical, CVSS 9.8 flaw in Ruby on Rails' Active Storage lets an unauthenticated user trigger file writes, and in some configurations file reads, simply by uploading a...
Maximum-Severity Certificate Bug in LXD and Incus Lets Attackers Forge Trust and Seize Linux Clusters
A critical, unauthenticated vulnerability in LXD and Incus — two widely used Linux container and virtual machine management platforms — lets remote attackers forge trusted identities and seize...
WatchGuard Patches Seven Critical Firebox Flaws With CVSS Scores Up to 9.5
WatchGuard's October 27 security advisory discloses 18 vulnerabilities in Fireware OS and its Windows Mobile VPN client, seven of them rated critical with CVSS scores between 9.1 and...
Three TLS Flaws in Widely Embedded GoAhead Web Server Undermine Certificate Trust on Millions of Devices
Researchers have disclosed three flaws in GoAhead, a lightweight web server embedded in routers, printers, industrial controllers, and networking gear from vendors including Palo Alto Networks, Siemens, and...
Critical Okta Access Gateway Bug Lets Rogue Admins Run System Commands
Okta has patched a critical flaw in Access Gateway, tracked as CVE-2026-115547 with a CVSS score of 9.1, that lets an already-authenticated administrator trigger system command execution through...
Palo Alto Confirms PAN-OS Firewalls Exposed to Critical PHP Remote Code Execution Bugs
Palo Alto Networks has confirmed that two critical PHP vulnerabilities reach into PAN-OS firewalls and Panorama management systems, with hotfixes still days away. Proof-of-concept exploits already exist for...
PHP Prepares Emergency Fixes for Two Critical 9.2 Flaws
PHP is preparing security updates for two critical vulnerabilities rated 9.2 under CVSS 4.0. Administrators should inventory exposed PHP systems now and apply the official fixes as soon...