GitLab AI Gateway Sandbox Escape Opens Door to Remote Command Execution
GitLab has patched a CVSS 9.9 sandbox escape in self-hosted AI Gateway deployments. An authenticated Duo Agent Platform user could abuse crafted flow templates to execute commands on...
Root-Level cPanel/WHM Flaw Puts Every Hosted Account on a Server at Risk
cPanel has patched a critical flaw (CVE-2026-93698) in the Multilang adminbin component that allows arbitrary command execution as root, alongside two stored XSS bugs in WHM's SSL Hosts...
Researchers Warn of Two More Unpatched NetScaler Zero-Days Already Under Attack
Security firm watchTowr says it has uncovered two additional, undisclosed remote-code-execution vulnerabilities in Citrix NetScaler during forensic investigations, and that both appear to have been exploited in real-world...
OpenCode Web Interface Flaw Let Hostile Sites Run Commands on Developer PCs
A flaw in OpenCode’s local web interface allowed a malicious website to turn an upgrade request into code execution on a developer machine. Version 1.18.22 fixes both the...
Two Reported NetScaler Zero-Days Put Internet-Facing Gateways on Emergency Watch
Researchers say two undisclosed Citrix NetScaler remote-code-execution flaws are already being used in attacks, although vendor confirmation and technical indicators remain pending. Defenders should inventory exposed appliances, preserve...
Critical Next.js SVG Flaw Opens Server-Side Image Routes to Remote Code Execution
A critical flaw in the Node.js implementation of Next.js ImageResponse can turn attacker-controlled SVG data into server-side code execution. Applications using affected releases should move to Next.js 16.3.6...
IBM Payment Platform Flaws Expose Financial Workflows to Code Execution and Fraud
IBM has patched a broad set of flaws in Financial Transaction Manager for Red Hat OpenShift, including unauthenticated code-execution bugs and authorization failures affecting payment actions. Customers on...
Click2Shell Chain Turns One Malicious Link Into WordPress Server Takeover
WordPress has fixed a theme-preview weakness that can silently install an attacker-selected theme when an administrator opens a crafted link. Paired with unsafe pre-activation code in a theme,...