All news with #vulnerability disclosure tag

🔍 On day one of Zero Day Initiative’s Pwn2Own Ireland 2026, ethical hacking teams discovered 32 zero-day vulnerabilities across smartphones, smart home devices, printers and AI tools, earning over $368,000 in prizes. Notable successes included exploits against Sonos Era 300, LiteLLM, Philips Hue Bridge Pro, Lexmark CX532adwe, Oracle Autonomous AI Database, OpenAI Codex and Garmin Index BPM. Findings will be responsibly disclosed to vendors with a 90-day patch window as the contest continues.

⚠️ Atlassian has disclosed CVE-2026-21589, a critical arbitrary file-access vulnerability affecting multiple self-hosted Data Center products including Confluence, Jira, and Bitbucket. An unauthenticated attacker can access specific files within an application's web root if they know the exact filename and path, though directory listing is not possible. Atlassian released fixed versions and urges immediate patching; cloud instances were auto-patched. Temporary mitigations and detailed configuration steps are provided for administrators unable to patch immediately.

🛡️ A malicious spreadsheet can trigger remote Java code execution in LibreOffice and Apache OpenOffice via database ranges that auto-refresh from an external ODB source. The issue requires Java support to be enabled and bypasses the usual macro trust prompt, enabling execution without user consent. LibreOffice patched the flaw as CVE-2026-63277 in updates released October 5 (move to 26.2.5 or 26.8.0), while Apache OpenOffice's matching CVE-2026-59265 remains unpatched in releases up to 4.1.16. Users can mitigate the risk by disabling Java or avoiding untrusted spreadsheets until OpenOffice issues its fix.

🔒 Atlassian disclosed CVE-2026-21589, a critical path traversal vulnerability in eight Data Center products that allows unauthenticated attackers who know a file's exact path to read files from the web application root. The flaw, rated 9.3 CVSS v4.0, affects on-premises deployments and has fixed versions listed for each product; cloud offerings have been patched. Atlassian advises offlineing or restricting internet access for instances that cannot be upgraded and provides temporary WAF or server-level blocking rules as mitigations.

🔒 Dell disclosed 18 CVEs affecting its Container Storage Modules (CSM) and Dell System Update (DSU), including two CVEs rated 10 and five rated 9+. The flaws could let unauthenticated or low-privilege attackers bypass auth, gain root, forge admin tokens, and execute remote code. Affected CSM versions prior to 1.17.0 and DSU versions prior to 2.3.0.0 must be updated; Dell reports no active exploitation so far. Vendors and customers are urged to apply fixes and rotate credentials.

🔒 Dell patched multiple maximum-severity flaws in its Container Storage Modules (CSM) that link enterprise storage arrays to Kubernetes. The issues, rooted in the CSM Authorization module, allow unauthenticated attackers to obtain administrator credentials and bypass authorization. Dell recommends updating CSM to version 1.18.0 or later to remediate the critical vulnerabilities.

🔍 Kaspersky’s analysis shows a sharp rise in detected vulnerabilities and a shrinking window between disclosure and exploitation, fueled in part by AI. Relying solely on periodic scanners creates gaps: findings pile up, prioritization is often manual and inconsistent, patches are delayed or incompletely applied, and assets can remain untracked. The article advocates four core processes—asset inventory, contextualized vulnerability analysis, risk-based prioritization, configuration hygiene, and post-patch verification—and highlights the Kaspersky Vulnerability Management module as a solution to centralize and operationalize these steps.

🛡️ Researchers published a public proof‑of‑concept for CVE‑2026‑86950, an Apple CoreGraphics vulnerability Apple says may have been used in targeted attacks. The trigger is a malicious PDF with a crafted embedded font that causes a crash on unpatched iPhones and Macs, though the published code demonstrates a crash, not full code execution. Apple patched the flaw on September 28 after crediting Meta Product Security, and CISA added it to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 2.

🔒 OpenSSL released fixes on September 29 for a High-severity DTLS vulnerability (CVE-2026-84782) that can leak heap memory or crash applications when a DTLS handshake resend occurs while a larger message is partially sent. The bug affects multiple branches and is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8, while fixes for older branches are available only to premium support customers. Vendors including Ubuntu and Debian have issued package updates; Ubuntu users must reboot after updating.

🔒 Researchers disclosed details of a critical memory overflow in Citrix NetScaler ADC and Gateway, tracked as CVE-2026-88772 (CVSS 9.5). The flaw stems from improper DTLS fragment parsing in the NetScaler Packet Processing Engine, allowing crafted records to overflow a scratch buffer and enable remote code execution or denial-of-service. Vendor and researchers show how reassembly of many small fragments can produce a large NSB chain, enabling shellcode execution by bypassing NX protections with mprotect().

🔒 A team from VUSec and Scuola Superiore Sant'Anna has disclosed a new Spectre‑v2 variant called Branch Target Reuse (BTR) that impacts JIT engines in browsers, language runtimes, and the Linux kernel across multiple CPU vendors. Researchers demonstrated exploitation against SpiderMonkey, GraalVM, and cBPF JIT, producing kernel exploits that can recover root password hashes on patched Intel systems. Mitigations have been merged into the Linux kernel under CVE‑2026‑64507 and CVE‑2026‑64508, while vendors pursue code‑cache randomization and site isolation approaches.

🛡️ Kiteworks worked with federal intelligence authorities during a scheduled precautionary shutdown to identify and fix a critical vulnerability affecting fewer than 1% of customers. The company developed and deployed a patch and added an extra protective layer across all environments, and said there is no evidence the flaw was exploited. Customers were advised to bring systems back online after the threat window passed and no anomalies were observed.

🔔 Kiteworks has lifted a temporary shutdown notice it issued after receiving threat intelligence from federal authorities, allowing customers to bring systems back online. Self-hosted Advanced Forms users should contact Customer Support for assistance, while Kiteworks-hosted systems are reported to be operating normally. The vendor recommended customers run the latest release, 9.5.1, and said there were no confirmed breaches. Industry observers noted this precautionary action amid speculation of a potential zero-day exploit targeting MFT platforms.

🔔 Kiteworks, formerly Accellion, notified customers to temporarily shut down systems after receiving an intelligence warning of an imminent cyberattack, then restored hosted systems after patching a critical vulnerability and finding no evidence of compromise. The company said the flaw affected less than 1% of customers and urged self-hosted Advanced Forms users to contact support. Continuous monitoring reportedly showed no abnormal activity, and no CVE has been assigned yet.

🛡️ Apple released updates to address a zero-day vulnerability in CoreGraphics tracked as CVE-2026-20700, discovered by Meta Product Security. The flaw is an out-of-bounds write that could allow crashes, data corruption, or arbitrary code execution when processing malicious files. Affected platforms include multiple iPhone, iPad, and Mac models, and fixes are available in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.

🔒 ArsTechnica reports on an implementation of a 2007 RSA forgery attack that bypasses factoring. The attack forges digital signatures but does not recover private keys and only applies to unpadded, pure RSA signatures. It is subexponential (faster than factoring in their tests) and required about 1380 CPU core-years to forge a 1024-bit key. The researchers provide a webpage and paper with full context.

🔒 A CSRF vulnerability in the Elementor WordPress plugin could let an unauthenticated attacker create administrator accounts by tricking a logged-in admin into opening a crafted link. The flaw affects versions 4.3.0 and 4.3.1, which are active on up to 2 million sites. Patchstack reported the issue to Elementor on September 22 and a fix was issued in version 4.3.2 two days later. Users are advised to update immediately to prevent one-click admin account creation attacks.

⚠️ CISA warns that multiple critical and high-severity vulnerabilities in WSO2, Adobe Commerce, Microsoft SharePoint, and Mikrotik RouterOS are being actively exploited. Two critical flaws—CVE-2026-5430 in WSO2 and CVE-2026-71362 in Adobe Commerce—were added to the Known Exploited Vulnerabilities catalog with federal mitigation deadlines. Agencies must patch or mitigate by the specified dates, and organizations are urged to prioritize these fixes.

🛡️ A GitLab feature that supplies a project-scoped email address to create issues embeds a long-lived token in the address, which can be used to act as the linked user across projects. Aikido Security found the token (prefixed with glimt-) is identical across project addresses for an account and bypasses IP restrictions, enabling actions like creating issues and merge requests with the account's permissions. GitLab updated wording to acknowledge merge request capabilities; Aikido recommends treating the addresses as credentials and rotating tokens if exposed.

🔒 WordPress released a security update fixing a critical remote code execution vulnerability (CVE-2026-87902) that allows unauthenticated attackers to include and execute readable local PHP files outside active theme directories. The flaw, reported by researcher Robert Ressl, has been backported to versions as far back as 4.7 and has already seen exploitation in the wild. Security firms observed reconnaissance within hours and active payload delivery within a day, prompting urgent calls for fast, verified patch rollouts and increased visibility of forgotten WordPress instances.