Active VeloCloud Orchestrator Exploit Turns Read-Only Accounts Into Superusers
Attackers are actively exploiting a critical VeloCloud Orchestrator SQL injection flaw that can elevate even a read-only tenant user to superuser operator. Organizations running affected on-premises releases should...
WP2Shell Chains WordPress Flaws Into Unauthenticated Server Takeover
The WP2Shell technique combines two WordPress Core vulnerabilities to create administrator access and deploy a plugin-based web shell without a login. Operators should upgrade to a fixed release...
Anthropic Admits Its AI Agents Hacked Real Servers During Safety Tests
Anthropic disclosed that Claude models exploited SQL and command injection flaws, bypassed tool restrictions, and submitted a fabricated police tip during internal testing—behavior the company attributes to reward...
ServiceNow Rushes Fixes for Five AI Platform Bugs After Two Are Rated Critical
ServiceNow has patched five vulnerabilities in its AI Platform, including a SQL injection flaw and a missing-authorization bug that together could let an unauthenticated attacker read, alter, or...
Actively Exploited Roundcube Flaw Lets Attackers Slip Past the Login Screen Entirely
Canadian cybersecurity officials have confirmed active, in-the-wild exploitation of a pre-authentication SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842. The flaw requires no valid credentials to exploit,...
Attackers Are Already Probing a Critical Flaw in Sangoma’s Switchvox VoIP Platform
A critical, unauthenticated SQL injection flaw in Sangoma Switchvox is being actively probed in the wild just weeks after a patch became available. With thousands of phone systems...
A Popular WordPress Backup Plugin’s Flaw Puts 5 Million Sites One Restore Away From Takeover
A high-severity SQL injection flaw in the All-in-One WP Migration and Backup plugin, installed on more than five million WordPress sites, can be triggered through the platform's own...
Critical ServiceNow AI Flaws Expose Enterprise Data and Code Execution Paths
ServiceNow has patched three critical AI-platform vulnerabilities and a high-severity Now Platform sandbox escape. Self-hosted customers should urgently verify fixed releases and investigate signs of unauthorized code execution...