Critical NetScaler Memory Flaw Exposes SAML Appliances to Remote Code Execution
Citrix has released urgent updates for a critical NetScaler ADC and Gateway memory-overflow vulnerability with a CVSS 9.5 rating. Exposure depends on the appliance build and whether it...
Apache Struts Updates Close RCE, Memory Exhaustion and Data-Leak Flaws
Apache Struts maintainers have addressed four flaws spanning remote code execution, denial of service and cross-user data exposure. Administrators should move to Struts 7.4.0 or 6.12.0 and verify...
Crafted HEIC Uploads Can Turn WordPress Image Processing Into Server Code Execution
A newly demonstrated exploit chain turns a malicious HEIC upload into code execution through WordPress's server-side image pipeline. Administrators should update libheif, restrict unnecessary modern image formats, and...
GitLab AI Gateway Sandbox Escape Opens Door to Remote Command Execution
GitLab has patched a CVSS 9.9 sandbox escape in self-hosted AI Gateway deployments. An authenticated Duo Agent Platform user could abuse crafted flow templates to execute commands on...
Root-Level cPanel/WHM Flaw Puts Every Hosted Account on a Server at Risk
cPanel has patched a critical flaw (CVE-2026-93698) in the Multilang adminbin component that allows arbitrary command execution as root, alongside two stored XSS bugs in WHM's SSL Hosts...
Researchers Warn of Two More Unpatched NetScaler Zero-Days Already Under Attack
Security firm watchTowr says it has uncovered two additional, undisclosed remote-code-execution vulnerabilities in Citrix NetScaler during forensic investigations, and that both appear to have been exploited in real-world...
OpenCode Web Interface Flaw Let Hostile Sites Run Commands on Developer PCs
A flaw in OpenCode’s local web interface allowed a malicious website to turn an upgrade request into code execution on a developer machine. Version 1.18.22 fixes both the...
Two Reported NetScaler Zero-Days Put Internet-Facing Gateways on Emergency Watch
Researchers say two undisclosed Citrix NetScaler remote-code-execution flaws are already being used in attacks, although vendor confirmation and technical indicators remain pending. Defenders should inventory exposed appliances, preserve...