Latest cyber news, threats, security, and guidelines. Stack up.
Thu 16 Jul
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability. Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Wed 15 Jul
CVE-2026-59762
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NF5 CNA advisory K000162231 (NVD published 15 July 2026) says that when an HTTP/2 profile is configured on a virtual server, undisclosed requests can raise TMM memory until the process restarts. That is a data-plane denial of service; F5 says there is no control-plane exposure. F5 scores it 8.7 (CVSS 4.0) and 7.5 (CVSS 3.1). Affected classic BIG-IP: 21.1.0 before 21.1.0.1, 21.0.0 before 21.0.0.3, 17.5.0 before 17.5.1.8, 17.1.0 before 17.1.3.4. Also BIG-IP Next for Kubernetes 2.3 before 2.3.2 and 2.0 before 2.2.3, Next CNF 2.3 before 2.3.2 / 2.0 before 2.2.3 / 1.1 before 1.4.3, and Next SPK 1.7 before 1.7.18 (NVD also lists Next SPK 1.9.0 as affected with no upper bound). Not in CISA KEV at last check. The NVD record does not state in-the-wild exploitation.
Tue 14 Jul
Horizon3 published on 1 September 2026 that Defused Cyber honeypots saw valid in-the-wild exploitation of CVE-2026-9586 on 30 August 2026 (attacker IP 176.65.148.184 in the published honeypot traffic). The flaw is an unauthenticated SQL injection in Sangoma Switchvox SMB Edition: the /pa PhoneAppsHandler.pm endpoint concatenates the PhoneIP field from an XML body into a PostgreSQL query, which Horizon3 says can be turned into remote code execution as the database superuser. Sangoma released Switchvox 8.4.0.2 on 14 July 2026. Horizon3 reported the issues in April; Security Risk Advisors independently reported them in May and published on 17 July. GitHub CVE advisory (17 July) rates it Critical 9.3. The CNA record cites Switchvox SMB Edition 8.3 (build 104997); Horizon3 notes Sangoma 8.4.0.2 release notes also mention 8.2.2.1 — upgrade to 8.4.0.2 rather than assuming an older build is safe. Horizon3 cites about 4,000 internet-exposed Switchvox devices on Shodan, mostly in the United States. CISA added CVE-2026-9586 to the KEV catalog on 2 September 2026. Restrict /pa to trusted phone networks until patched. IoC path if SSH is available: /var/log/switchvox/db-quirks.log.
Wed 8 Jul
CVE-2026-57023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HJuniper's 8 July 2026 security bulletin (JSA110083): an improper validation issue in the TCP proxy plugin of Junos OS on SRX Series and MX Series with SPC3 lets an unauthenticated, network-based attacker cause a complete denial of service. When TCP proxy is in use (ALGs, Advanced Anti-Malware, ICAP or UTM), a TCP packet with a specifically malformed header crashes flowd, causing a full service outage until the process restarts. CVSS 3.1 is 7.5; CVSS 4.0 is 8.7. Affected: 23.4 before 23.4R2-S7, 24.2 before 24.2R2-S4, 24.4 before 24.4R2-S3, 25.2 before 25.2R2. Not before 23.4R1. Juniper SIRT says it is not aware of malicious exploitation; the issue was seen during production usage. No workaround. This was part of Juniper's 8 July 2026 bulletin round (Canadian Centre for Cyber Security AV26-675).
Thu 25 Jun
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVE-2026-62253)CVE records were published on 7 October 2026 for three flaws in Homer, the open-source SIP and VoIP capture and troubleshooting platform from the SIPCAPTURE project, used by carriers and VoIP operators. The project fixed them in Homer 11.0.283 and published GitHub security advisories on 25 June 2026. CVE-2026-62253 (GHSA-rqcc-94gv-wjm9, CVSS 3.1 9.8): both JWT middleware functions let a request through when the JWT secret is empty, and the secret defaults to empty, so on a default install all protected API endpoints under /api/v1, /api/v3 and /api/v4 need no login. CVE-2026-62252 (GHSA-6xp5-7rcx-xfgx, 9.8): fresh deployments using internal authentication create an admin account with the password 'sipcapture' and never force a change, so anyone who reaches the login page gets full admin access. CVE-2026-62251 (GHSA-f46q-3v67-fmm4, 8.1): any authenticated user can send raw SQL to DuckDB through the v4 statistics query endpoint and read or change everything reachable through the FlightSQL service. Homer stores captured call signalling, which includes phone numbers and call metadata. No exploitation has been reported. Primary: SIPCAPTURE GitHub security advisories and CVE records.
Sun 24 May
CVE-2026-48842
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HRoundcube security updates 1.6.16 / 1.7.1 (published 24 May 2026) fix CVE-2026-48842: pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass (reporter: skull). Affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 when the plugin is enabled/reachable. CVE.report CVSS 3.1 8.1 HIGH (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Same releases also fix XSS/CSS injection, SSRF/local URL fetch bypasses, remote-image CSS var() bypass, pre-auth arbitrary file delete via redis/memcache session poisoning, and LDAP autovalues code-evaluation removal. Canadian Centre for Cyber Security advisory AV26-503 (updated 21 September 2026; amplified SecurityWeek / The Hacker News 25 Sep) confirms open-source reporting of active exploitation — CCCS did not publish attack details. UPDATE 25–26 Sep desk: SentinelOne describes the SQLi path (backslash sequences defeating preg_replace escaping so quotes land in the SQL string); Shadowserver Foundation telemetry cited by THN shows >523,000 internet-exposed Roundcube instances with 10 hosts flagged vulnerable as of 23 September 2026. Primary: Roundcube 24 May security news + GitHub 1.6.16; wire: SecurityWeek 25 Sep / THN 25 Sep.
Mon 11 May
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2026-23870 (GitHub advisory GHSA-rv78-f8rc-xrxh, published 11 May 2026) is a high-severity denial-of-service flaw in React Server Components (react-server-dom-webpack, -turbopack and -parcel) used by React 19.x apps, including Next.js deployments that use Server Actions. When React rebuilds submitted form data before a Server Action runs, each $K (nested form) reference triggers a full scan of every field in the request, and neither the reference count nor the field count is limited. A request with 10,000 references and 10,000 fields means about 100 million string checks, run synchronously on Node.js's single event-loop thread, so other visitors see timeouts or 503s; no authentication is needed. Researcher Simon Koeck published a technical write-up on 8 October 2026 showing a request of roughly 900 KB is enough, which makes the bug easy to reproduce for anyone still unpatched. Fixed React package versions: 19.0.6, 19.1.7 and 19.2.6; Next.js fixed it in 15.5.16 and 16.2.5 (GHSA-8h8q-6873-q5fj), and the Vite React plugin has its own advisory. No in-the-wild exploitation has been reported. Primary: GitHub advisory (React); wire: Cyber Security News.
Fri 1 May
Updated Mon 26 Oct
ASD's ACSC said in a 1 May 2026 critical alert that it is 'aware of active exploitation in Australia of a critical vulnerability (CVE-2026-41940) affecting cPanel/WHM products', according to Cyber Daily (4 May). The CVE record (NVD) describes it as an authentication bypass in cPanel and WHM versions after 11.40 that allows unauthenticated remote attackers to gain unauthorized access to the control panel. cPanel says it released security updates for cPanel & WHM on 28 April 2026. Correction (23 Oct 2026): this card earlier also cited a mistyped CVE number (the final 0 dropped), which belongs to an unrelated D-Link NAS flaw; the cPanel/WHM issue is CVE-2026-41940. Correction (23 Oct 2026): removed a line saying the ACSC noted patches as of 30 April 2026, which rested only on an ASD page we cannot recheck; the ACSC alert is now credited to Cyber Daily. Correction (26 Oct 2026): the mistyped number is no longer written out, so the page no longer links it. Correction (26 Oct 2026): removed the 9.3 (CVSS 4.0) score and vector, which this card credited to the CVE record but which no source this desk can read gives independently. cPanel's post of 10 May 2026 says the flaw affects every version of cPanel & WHM after 11.40 and WP Squared up to 11.136.1.6, and that CISA added it to its Known Exploited Vulnerabilities catalog on 1 May 2026. (source: cPanel blog — CVE-2026-41940: Response, Actions and Next Steps)
Fri 27 Mar
Updated Sat 24 Oct
CVE-2026-5027
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HTenable's advisory says Langflow's POST /api/v2/files endpoint does not sanitise multipart filenames, allowing a logged-in attacker to use path traversal to write files outside the upload directory. The CNA rates it 8.8 (CVSS 3.1). Exploit-DB published a working exploit on 31 August for Langflow 1.8.4 and earlier that uses the default auto-login path, writes a cron file and reaches remote code execution; BleepingComputer reported on 10 June 2026 that attackers were exploiting the flaw to write files on exposed servers; it is not on CISA's KEV catalog as of 24 October 2026. Upgrade to Langflow 1.9.0 or later. Disabling auto-login and restricting network access reduce exposure but do not fix the underlying arbitrary file write.
Fri 9 Jan
Updated Mon 26 Oct
CVE-2026-0768
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HTrend Micro ZDI advisory ZDI-26-034 (public 9 January 2026; CVE-2026-0768) rates an unauthenticated code-injection flaw in Langflow at CVSS 9.8: the validate endpoint executes a user-supplied code string as Python, which ZDI says can run as root. NVD published the CVE on 23 January 2026 and records affected Langflow 1.4.2. Updated 2 Sep 2026 (BleepingComputer, 1 September US time; 1:54 am 2 September Perth): BleepingComputer says CVE-2026-0768 affects Langflow 1.4.2 and earlier and recommends upgrading to the latest available version, 1.11.6, which it says addresses all known Langflow flaws. No vendor, CISA or other source this desk can cite has confirmed exploitation of CVE-2026-0768 in the wild; it was not in CISA's Known Exploited Vulnerabilities catalogue when checked on 26 October 2026. Distinct from desk card cve-2026-9198 (separate Langflow code-injection CVE on CISA KEV). ZDI's published mitigation is to restrict interaction with the product. ZDI and NVD don't name a fixed build; BleepingComputer's 1.11.6 is its advice to run the latest release, not a vendor-confirmed fix for CVE-2026-0768. Do not internet-expose unauthenticated Langflow. Correction (26 Oct 2026): reports of exploitation against UK honeypots (50 rising to 360 attempts, traffic mainly from Russia, and attackers querying Langflow, OpenAI and AWS environment variables and the Langflow secret key) have been removed: The Hacker News and BleepingComputer attribute them to one threat-intelligence company's honeypot data, and no vendor, CISA or other independent source confirms them. An unlinked SecurityWeek credit has also been removed. (source: Trend Micro ZDI-26-034; BleepingComputer)