Tag
#security
BTCPay Server Hot Wallet Thefts, Fixed in 2.4.2
Attackers stole Bitcoin and Litecoin from hot wallets on BTCPay Server 2.4.1 and earlier through the flaw fixed in 2.4.2; rebuild on a fresh server now.
Nov 03, 2026
Siemens IoT2050 Node-RED RCE, Exploited in the Wild (CVE-2026-58115)
An unauthenticated Node-RED interface on Siemens SIMATIC IoT2050 gateways lets attackers run comm...
Nov 03, 2026
libexpat Billion Laughs Bypass, Fixed in 2.10.0 (CVE-2026-115506)
libexpat through 2.9.0 detects some billion-laughs attacks too late. Learn the affected parser pa...
Nov 02, 2026
Control Web Panel Unauthenticated RCE Chain (CVE-2026-73696)
Control Web Panel before 1.12 exposes user-panel code without login; learn the three-CVE chain, a...
Nov 02, 2026
More tagged #security
Barracuda ESG Pre-Auth Bypass to Root, Patched (CVE-2026-116606)
A pre-authentication bypass in Email Security Gateway chains with a root command injection across six Barracuda products; patches shipped November 2, 2026.
Nov 02, 2026
SMS of Death: Android Zero-Click Telephony DoS (CVE-2026-58882)
One malformed WAP Push SMS crashes Android telephony and drops calls with no tap from the victim; the fix ships at the November patch level.
Nov 02, 2026
TeamViewer RCE via Screen Size, Fixed in 15.83 (CVE-2026-111585)
A malicious TeamViewer host runs code on the viewer that connects to help it, through one truncated screen-size multiply; update every client to 15.83.
Nov 02, 2026
TightVNC Viewer Pre-Auth RCE, Fixed in 2.8.90
A malicious VNC server runs code on the TightVNC Viewer before any password prompt; upgrade the Viewer to 2.8.90 and restrict listening mode on TCP 5500.
Nov 02, 2026
EDK II PXE Driver RCE Before Secure Boot (CVE-2026-97631)
An oversized ICMP error message corrupts memory while a server PXE-boots, running attacker code before the OS loads. Isolate PXE networks now.
Nov 01, 2026
LXD and Incus mTLS Authentication Bypass (CVE-2026-112816)
LXD and Incus mTLS authentication bypass lets network attackers impersonate trusted clients using public certificates. Check exposure and fixed versions.
Nov 01, 2026
CakePHP SQL Injection, Fixed in 5.4.4 (CVE-2026-119418)
CakePHP window offsets and collation names allow SQL injection when fed untrusted input. Check exposure and upgrade to 5.4.4, 5.3.8 or 5.2.16.
Nov 01, 2026
ChatGPT Shared-Link Account Takeover via MathLive Sandbox Escape
A shared ChatGPT link ran attacker JavaScript inside the victim session through MathLive unchecked messages; OpenAI fixed it on October 26.
Oct 31, 2026
GhostAction: Stolen GitHub Tokens Hit 23,000 Repos
Stolen GitHub tokens pushed 72,026 malicious commits to 22,964 repositories in nine days; revoke the tokens and hunt the #ghc2 cron job.
Oct 31, 2026
Ivanti Connect Secure Zero-Day Chain, Exploited (CVE-2026-104935)
A three-flaw chain gives unauthenticated root on Ivanti Connect Secure; upgrade to 22.8R2.6 or 25.1.1.3 and audit for October exploitation.
Oct 31, 2026