Security Articles

Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.

Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.

Updated July 26, 2026 — 168 published advisories, with new analysis most weekdays. Recent coverage includes the PTC Windchill FlexPLM remote code execution flaw under Clop exploitation, a Zimbra webmail cross-site scripting campaign stealing two-factor codes, Check Point SmartConsole CVE-2026-16232, the SharePoint machine-key remote code execution chain (CVE-2026-50522), and a ServiceNow AI Platform remote code execution bug. If one of these touches a system you run and you are not sure what to do next, our 24/7 staffed security operations center handles the triage for you.

All Articles Advisory Cyber Attack Data Breach Exploit Malware Threat Actor Vulnerability

Severity: All Critical High Medium Low

63 articles found

Featured Story

critical

Jun 16, 2026

criticalCVE AdvisoryVulnerability

CRITICAL: Three FortiSandbox Flaws Under Active Exploitation as Defenders Race to Patch

Defused Cyber reported active exploitation of three CVSS 9.1 FortiSandbox vulnerabilities inside a 24-hour window. CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 allow unauthenticated remote code execution and authentication bypass on the appliance that other Fortinet products trust to verdict malware. Patches are available, but the 4.2 branch requires migration to a supported release.

By Danny MercerRead Full Article

critical

CVE AdvisoryVulnerability•Jun 14, 2026

CRITICAL: ShinyHunters Burn Oracle PeopleSoft Zero-Day to Loot Universities (CVE-2026-35273)

ShinyHunters spent two weeks ransacking universities through an unauthenticated RCE in Oracle PeopleSoft's Environment Management Hub. CVE-2026-35273 carries a CVSS of 9.8, hit 100-plus orgs including the University of Nottingham, and Oracle only published a patch on June 10 after the campaign was already done.

critical

CVE AdvisoryVulnerability•Jun 12, 2026

CRITICAL: Oracle PeopleSoft Zero-Day CVE-2026-35273 Powers ShinyHunters Spree Across 100+ Universities

ShinyHunters weaponized an unauthenticated 9.8 CVSS RCE in Oracle PeopleSoft PeopleTools (CVE-2026-35273) as a zero-day from May 27 through June 9, breaching the University of Nottingham and over a hundred mostly higher-education organizations before Oracle issued an out-of-band advisory on June 10.

critical

CVE AdvisoryVulnerability•Jun 9, 2026

CRITICAL: LiteLLM RCE Chain Hits CISA KEV as Attackers Hammer Exposed AI Gateways

LiteLLM CVE-2026-42271 chained with Starlette CVE-2026-48710 (BadHost) creates an unauthenticated RCE path scoring CVSS 10.0 against AI gateways. CISA added the flaw to the KEV catalog after confirming active exploitation. Patch LiteLLM 1.83.7 and Starlette 1.0.1 immediately or block the vulnerable MCP test endpoints at your reverse proxy.

critical

CVE AdvisoryVulnerability•Jun 5, 2026

CRITICAL: Cisco Unified CM SSRF Flaw CVE-2026-20230 Hands Attackers Root, PoC Already Public

Cisco patched CVE-2026-20230, an unauthenticated SSRF in the Unified Communications Manager WebDialer Web Service that lets remote attackers write arbitrary files and escalate to root. Public proof-of-concept code is already circulating. CVSS 8.6 with a Critical Security Impact Rating from Cisco PSIRT. Version 14SU6 is fixed, but the 15 train waits until September 2026 for 15SU5 with only an interim COP patch available now.

critical

CVE AdvisoryVulnerability•Jun 4, 2026

CRITICAL: Active Exploitation Hits Magento Stores via Mirasvit Cache Warmer Bug (CVE-2026-45247)

CISA added CVE-2026-45247, a CVSS 9.8 PHP object deserialization flaw in the Mirasvit Full Page Cache Warmer extension for Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog after Imperva confirmed active unauthenticated RCE attacks against gaming and business storefronts in the US, UK, France, and Australia. Patch to version 1.11.12 or disable the extension immediately.

critical

CVE AdvisoryVulnerability•Jun 2, 2026

CRITICAL: Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Under Active Exploitation

An authentication bypass flaw in PAN-OS GlobalProtect portal and gateway (CVE-2026-0257, CVSS 9.1) is under active exploitation. Rapid7 confirmed in-the-wild attacks beginning May 17, and the CISA federal remediation deadline expired June 1. Patches and workarounds are available across PAN-OS 10.2, 11.1, 11.2, and 12.1 branches.

critical

CVE AdvisoryVulnerability•Jun 1, 2026

CRITICAL: WP Maps Pro Bug (CVE-2026-8732) Spawns Admin Accounts on 15,000 WordPress Sites

A CVSS 9.8 unauthenticated admin account creation flaw in the WP Maps Pro WordPress plugin (CVE-2026-8732) is under active mass exploitation. Wordfence blocked 2,858 attempts and Defiant blocked more than 3,600 within a single 24 hour window. The bug abuses a vendor-support shortcut to mint administrator accounts via an unauthenticated AJAX endpoint. All versions through 6.1.0 are vulnerable. Patch to 6.1.1 and hunt for rogue admins emailed support@flippercode.com.

critical

CVE AdvisoryVulnerability•May 29, 2026

CRITICAL: FortiClient EMS Bug CVE-2026-35616 Weaponized to Push EKZ Infostealer Across Managed Fleets

Threat actors are abusing CVE-2026-35616, a CVSS 9.1 pre-authentication API bypass in FortiClient EMS, to hijack endpoint management consoles and push the newly identified EKZ infostealer to every managed endpoint disguised as FortiEndpoint_Patch.exe. Patch to 7.4.7 immediately and hunt for indicators in EMS logs and on managed hosts.

critical

CVE AdvisoryVulnerability•May 26, 2026

CRITICAL: Ghost CMS SQL Injection Bug Turns Harvard, Oxford and 700 Other Sites Into ClickFix Launchpads

Threat actors are mass-exploiting CVE-2026-26980, a critical SQL injection bug in Ghost CMS, to harvest Admin API keys and inject ClickFix malware loaders into more than 700 hijacked sites including Harvard, Oxford, Auburn, and DuckDuckGo. A patch has been available in version 6.19.1 since February.

critical

CVE AdvisoryVulnerability•May 24, 2026

CRITICAL: LiteSpeed cPanel Plugin Zero-Day Gives Any Hosting User Root (CVE-2026-48172)

A CVSS 10.0 zero-day in the LiteSpeed User-End cPanel Plugin lets any authenticated cPanel user execute arbitrary scripts as root via the lsws.redisAble JSON-API endpoint. LiteSpeed confirms active in-the-wild exploitation. Plugin versions 2.3 through 2.4.4 are vulnerable, with the fix shipped in 2.4.7.

critical

CVE AdvisoryVulnerability•May 22, 2026

CRITICAL: Cisco Secure Workload Hit With CVSS 10.0 REST API Flaw That Hands Over Site Admin

Cisco disclosed CVE-2026-20223, a maximum severity CVSS 10.0 flaw in Secure Workload that allows unauthenticated remote attackers to gain Site Admin privileges by sending crafted requests to internal REST API endpoints. The vulnerability crosses tenant boundaries on both SaaS and on-premises deployments, has no workarounds, and is fixed in releases 3.10.8.3 and 4.0.3.17.

critical

CVE AdvisoryVulnerability•May 19, 2026

CRITICAL: 'MiniPlasma' Windows 0-Day Resurrects 2020 SYSTEM Escalation Bug Microsoft Thought It Killed

A working zero-day exploit dubbed MiniPlasma escalates standard users to SYSTEM on fully patched Windows 11. It abuses cldflt.sys, the same Cloud Filter driver behind CVE-2020-17103 that Microsoft 'fixed' in 2020. PoC is public on GitHub. No patch yet. Assume compromise paths exist on every Windows endpoint until the next Patch Tuesday.

critical

CVE AdvisoryVulnerability•May 18, 2026

CRITICAL: 18-Year-Old NGINX Rewrite Module Flaw Hits Active Exploitation in Days

A heap buffer overflow lurking in NGINX's ngx_http_rewrite_module since 2008 went from coordinated disclosure to active in-the-wild exploitation in roughly seventy-two hours. CVE-2026-42945 affects every release from 0.6.27 through 1.30.0 across both Open Source and Plus, can crash worker processes trivially, and can reach remote code execution on hosts where ASLR is disabled. Patches are available in NGINX 1.30.1 and 1.31.0.

critical

CVE AdvisoryVulnerability•May 17, 2026

CRITICAL: Cisco Catalyst SD-WAN CVE-2026-20182 Hits CVSS 10.0 with Active Exploitation by UAT-8616

Cisco patched CVE-2026-20182, a CVSS 10.0 authentication bypass in Catalyst SD-WAN Controller and Manager that lets an unauthenticated remote attacker gain administrative access via the vdaemon peering service on UDP/12346. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of May 17, 2026. Threat cluster UAT-8616 is actively exploiting it. No workarounds, only patches.

critical

CVE AdvisoryVulnerability•May 14, 2026

NGINX Rift CVE-2026-42945 Is an 18-Year-Old Bug That Hands Attackers Your Web Server

A heap buffer overflow in NGINX ngx_http_rewrite_module has been hiding in the codebase since 2008. CVE-2026-42945 (CVSS 9.2) lets unauthenticated attackers hijack any unpatched NGINX instance. With NGINX powering over 30% of the internet, patch immediately.

critical

CVE AdvisoryVulnerability•May 13, 2026

May 2026 Patch Tuesday Delivers Unauthenticated Netlogon and DNS RCE at CVSS 9.8

Microsoft shipped 138 patches including two unauthenticated remote code execution flaws rated CVSS 9.8. CVE-2026-41089 gives SYSTEM on domain controllers via Netlogon overflow. CVE-2026-41091 does the same via Windows DNS. Both are wormable. Patch now.

critical

CVE AdvisoryVulnerability•May 12, 2026

CRITICAL: cPanel WHM Authentication Bypass CVE-2026-41940 Exploited for Two Months Before Patch

cPanel and WHM are bleeding root through CVE-2026-41940, a CVSS 9.8 CRLF-injection authentication bypass that has been exploited in the wild since late February 2026. The April 28 patch is available now, but attackers running automated campaigns from over 2,000 source IPs have been deploying a cross-platform Go backdoor on compromised hosts for two months. Patch immediately and assume breach on any internet-exposed unpatched server.

critical

CVE AdvisoryVulnerability•May 6, 2026

CRITICAL: Palo Alto PAN-OS Zero-Day Hands Attackers Root on Internet-Facing Firewalls (CVE-2026-0300)

CVE-2026-0300 is an unauthenticated buffer overflow in the PAN-OS User-ID Authentication Portal that grants root code execution on PA-Series and VM-Series firewalls. Palo Alto has confirmed limited in-the-wild exploitation against internet-exposed portals. CVSS scores 9.3 for internet-exposed deployments, 8.7 for trusted-network only. Patches roll out from May 13 through May 28, 2026.

critical

CVE AdvisoryVulnerability•May 5, 2026

CRITICAL: Progress MOVEit Automation Hit by 9.8 Auth Bypass With No Workaround

Progress Software disclosed CVE-2026-4670, an unauthenticated authentication bypass in MOVEit Automation rated CVSS 9.8, alongside CVE-2026-5174, a CVSS 7.7 privilege escalation. Patch to 2025.1.5, 2025.0.9, or 2024.1.8. No workarounds exist.

Is Your Mobile App Secure?

Our CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.

Learn About Mobile Pen Testing MSP Partner Program

PreviousPage 2 of 4Next

Stay Informed

Subscribe to our newsletter and get the latest security insights delivered to your inbox.