Cybersecurity

F5 patched a critical nginx heap buffer overflow (CVE-2026-42533) rated 9.2 on CVSS v4, affecting versions since 2011.The flaw allows remote code execution if...

Russian state-sponsored hackers from the Sandworm group are using fake CAPTCHA checks to trick Ukrainian targets into executing malware.The campaign, attributed to sub-cluster UAC-0145,...

WordPress patched a pre-authentication remote code execution flaw in versions 6.9.5 and 7.0.2 on July 17, 2026.The bug, found by Adam Kues of Searchlight...

Researchers at Checkmarx uncovered the ViteVenom campaign, a software supply chain attack using seven malicious npm packages targeting the Vite frontend tooling ecosystem.The attack,...

CISA added a critical Microsoft SharePoint Server vulnerability, CVE-2026-58644, to its Known Exploited Vulnerabilities catalog.The flaw allows unauthenticated remote code execution and has been...

A critical identity-binding flaw in n8n's token exchange allowed account takeover when multiple external issuers were trusted.The vulnerability (CVE-2026-59208) matched JWTs on the sub...

The Daxin kernel-mode rootkit, dormant for over four years, has resurfaced on a compromised host at a Taiwan-based manufacturing subsidiary alongside a new backdoor...

Zoom released a critical security update for a flaw (CVE-2026-53412, CVSS 9.8) that could allow unauthenticated account takeover via network access.Three additional high-severity vulnerabilities...