Google DevSite Bug Chain Turned Exposed Flask Secrets Into Remote Code Execution
Google fixed a critical DevSite vulnerability chain in which an OAuth secret exposed inside a Flask session cookie could be reused to forge sessions and reach unsafe Python...
Attackers Exploit Critical Bricksforge Flaw to Run PHP on WordPress Sites
Attackers are actively exploiting a maximum-severity Bricksforge vulnerability to turn image uploads into executable PHP files. WordPress administrators should update immediately and inspect upload directories and request logs...
GitLab Patches CVSS 10 Flaw Allowing Unauthenticated Server Code Execution
GitLab has issued urgent fixes for CVE-2026-97229, a CVSS 10 vulnerability that may allow unauthenticated code execution through a crafted CI/CD regular expression. Self-managed Community and Enterprise Edition...
Public AnyDesk Exploit Puts Unpatched Linux Hosts at Risk of Root Takeover
Public exploit code for the AnyPwn flaw can target AnyDesk 8.0.2 on Linux before authentication and execute commands with root privileges. Administrators should install version 8.0.3 or later,...
Critical NetScaler Memory Flaw Exposes SAML Appliances to Remote Code Execution
Citrix has released urgent updates for a critical NetScaler ADC and Gateway memory-overflow vulnerability with a CVSS 9.5 rating. Exposure depends on the appliance build and whether it...
Apache Struts Updates Close RCE, Memory Exhaustion and Data-Leak Flaws
Apache Struts maintainers have addressed four flaws spanning remote code execution, denial of service and cross-user data exposure. Administrators should move to Struts 7.4.0 or 6.12.0 and verify...
Crafted HEIC Uploads Can Turn WordPress Image Processing Into Server Code Execution
A newly demonstrated exploit chain turns a malicious HEIC upload into code execution through WordPress's server-side image pipeline. Administrators should update libheif, restrict unnecessary modern image formats, and...
GitLab AI Gateway Sandbox Escape Opens Door to Remote Command Execution
GitLab has patched a CVSS 9.9 sandbox escape in self-hosted AI Gateway deployments. An authenticated Duo Agent Platform user could abuse crafted flow templates to execute commands on...