cve11 articles
CISA's Vulnerability Report Is a Masterclass in Déjà Vu
CISA's latest review finds that the most exploited software vulnerabilities in 2024–2025 belong to decades-old weakness classes — such as injection flaws, improper input validation, and path traversal — that should have been eliminated long ago, with seven of the top ten most frequent vulnerabilities falling into MITRE's "stubborn" or "unforgivable" categories. The agency argues the problem is not technical complexity but failures in organizational culture, developer workflows, and slow adoption of Secure by Design (SBD) practices. CISA is urging software vendors to take ownership of security outcomes by eliminating these longstanding flaws at the development stage, rather than continuing to burden defenders with an endless cycle of patches.
Half a Million WordPress Sites Running Vulnerable Form Plugin — 300,000 Still Unpatched
A critical remote code execution vulnerability (CVE-2026-15748, CVSS 9.8) has been discovered in the Forminator Forms WordPress plugin, affecting all versions up to 1.56.1. The flaw allows unauthenticated attackers to bypass file type validation and upload executable files, potentially leading to full site compromise — but only poses a significant risk when a Custom File Upload Storage root has been configured. The bug was patched in version 1.56.2 on July 31, though roughly 300,000 of the plugin's 600,000+ installations are still running a vulnerable version.
N-able's N-central Authentication Bypass Gets Patched Twice After First Fix Left Door Open
Attackers exploited an authentication bypass vulnerability (CVE-2026-18556/CVE-2026-18577) in N-able's N-central remote monitoring platform to gain administrative access to servers and then pivot to managed customer endpoints using the platform's Take Control feature. They also installed persistent Cloudflare tunnels on compromised devices, meaning that simply upgrading N-central is insufficient — customers must also actively hunt for and remove malicious tunnel services. N-able's initial patch proved incomplete, and the fully fixed version (build 2026.3.1.7) was released on August 2, with self-hosted customers required to upgrade manually.
One Webpage Visit Was Enough to Own Your Browser — and Then Your Kernel
Researchers at Nebula Security have disclosed a patched Firefox vulnerability (CVE-2026-10702) that allowed arbitrary code execution simply by visiting a malicious webpage, with no additional user interaction required. The flaw, stemming from a JIT compiler error that incorrectly treated a memory-mutating operation as a safe read, affected Firefox versions 147 through 151.0.2 and also impacted Tor Browser builds using vulnerable Firefox versions. Nebula chained the browser exploit with a separate Linux kernel flaw (CVE-2026-43499) to achieve full device compromise on ARM64 Android devices, though updating to Firefox 151.0.3 blocks the browser entry point.
n8n's JWT Login Bug Let the Wrong Issuer Vouch for the Wrong User
A flaw in n8n's Enterprise token exchange feature (CVE-2026-59208) allowed attackers to log in as another user by presenting a valid JWT from one trusted issuer that shared a matching `sub` claim with an account registered under a different issuer, because n8n matched users on `sub` alone rather than the correct `iss` + `sub` pairing. The vulnerability only affects Enterprise instances with token exchange enabled and at least two external issuers configured. n8n patched the issue on June 24 in versions 2.27.4 and 2.28.1, though the fix was not mentioned in either release's changelog.
ServiceNow RCE Flaw Exploited Within Days of Patch — But Who's Actually Behind It?
A critical remote code execution vulnerability in ServiceNow (CVE-2026-6875) is reportedly being exploited in the wild just days after patches were released on July 14 and technical details were publicly disclosed. Threat intelligence firm Defused observed exploitation activity on July 18, though closer analysis revealed the payload was identical to a published proof-of-concept rather than an independently developed exploit. ServiceNow states it has found no evidence of compromise on its hosted instances, and there is speculation the activity may originate from security researchers rather than malicious threat actors.
Unknown Threat Actor Chained SonicWall Zero-Days to Root Before Anyone Knew They Existed
A previously unknown threat actor (UTA0533) exploited two zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — in SonicWall SMA 1000 series VPN appliances before patches were publicly released, chaining them together to achieve root-level access on compromised devices. The attacker deployed custom malware, including a web shell and HTTP proxy tool, modified startup scripts for persistence, and used packet capture utilities to steal LDAP credentials. While UTA0533 demonstrated advanced capability in compromising the appliances, evidence suggests they had limited success in moving laterally to other systems on the network.
Botnets in Your Living Room, Ransomware in Your Browser, and AI That Follows the Wrong Orders: This Week in Security
This week's cybersecurity recap highlights how attackers exploited ordinary, trusted systems rather than sophisticated vulnerabilities. Key incidents included Google and the FBI disrupting the NetNut residential proxy botnet (comprising at least 2 million devices), a fake GitHub PoC repository delivering the ChocoPoC RAT via a malicious dependency, and AI-generated browser ransomware leveraging Chromium's File System Access API. Additional notable stories covered WhatsApp username impersonation concerns, a Scattered Spider suspect extradited to the US, and multiple phishing-as-a-service toolkits emerging in the wild. The overarching theme was misplaced trust — in home devices, clean-looking code, identity reset flows, and browser permissions — underscoring that attackers need little more than a familiar, overlooked entry point.
Bad Epoll: The Linux Root Bug That Anthropic's AI Walked Right Past
A newly discovered Linux kernel vulnerability called Bad Epoll (CVE-2026-46242) allows unprivileged users to gain root access by exploiting a use-after-free race condition in the kernel's epoll code, affecting Linux desktops, servers, and Android devices. Researcher Jaeyoung Chung developed a highly reliable exploit that succeeds roughly 99% of the time, and notably can be triggered from within Chrome's renderer sandbox. A fix is available via upstream commit a6dc643c6931, though there is no workaround since epoll cannot be disabled, and an Android-specific exploit remains in development.
Oracle E-Business Suite Exploited Before Anyone Even Published the Attack Code
A critical vulnerability in Oracle E-Business Suite's Payments module (CVE-2026-46817, CVSS 9.8) was actively exploited just six weeks after Oracle patched it in May, with attacks beginning before any public proof-of-concept code was released, suggesting the attacker reverse-engineered Oracle's patch or used a private exploit. The targeted, low-volume nature of the attacks — only six attempts from a single source — indicates deliberate reconnaissance rather than broad scanning. The incident reflects a growing trend of attackers rapidly weaponizing enterprise software patches, with around 950 EBS instances currently exposed to the public internet.
Nine-Year-Old Linux Kernel Bug Quietly Handed Root Access to Anyone Who Asked
A security flaw sitting undetected in the Linux kernel for nine years has been found to allow unprivileged users to execute commands as root on a wide range of major distributions.