All news with #vulnerability disclosure tag

🔒 A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app that requests no special permissions. Researcher Rasmus Moorats chained two vendor services to gain root: one that accepts arbitrary calls and injects text into system commands, and another that executes shell instructions when invoked as root. OnePlus confirmed the flaws in May, claimed exclusive control over disclosure, and had not released a patch when Moorats published on September 24.

🔒 On September 4, 2026, researcher Oren Yomtov of Accomplish reported a vulnerability affecting Cloudflare Containers and Sandboxes. Cloudflare validated the report, found no evidence of customer data compromise, and applied a fleetwide fix with no customer action required. The issue involved dm-thin thin-provisioning and the skip_block_zeroing option, which could allow residual data disclosure when partially overwriting reassigned 64 KiB blocks. Cloudflare removed the option, retired affected disks and caches, and found no signs of malicious exploitation.

🔍 Threat actors have progressed from scanning for CVE-2026-87902 to actively exploiting the vulnerability to write files that execute shell commands when accessed. Patchstack observed initial reconnaissance less than five hours after WordPress 7.1.2 was released, with malicious activity increasing tenfold as attackers began delivering payloads. The flaw, discovered by Robert Ressl, is an unauthenticated path traversal that can lead to RCE under specific theme and server conditions. Administrators are urged to update to WordPress 7.1.2 and review logs for indicators of compromise.

🔐 GitGuardian discovered hundreds of publicly exposed GitHub App private keys that remain valid unless manually revoked. Their testing found many keys granted read or write access to private repositories and some allowed organization administration, enabling potential takeovers. The exposed keys included apps used by multiple organizations and internal one-off bots, increasing supply-chain risk. Experts recommend routine key rotation and prompt revocation to limit long-lived exposure.

🛡️ Vercel disclosed a critical vulnerability in Next.js ImageResponse that could allow remote code execution when untrusted values are embedded in SVG content during image generation. The flaw affects Next.js 16.2.0 through 16.3.5 on the Node.js runtime and was patched in version 16.3.6 on September 22. The issue stems from Satori incorrectly allowing unescaped values into SVG output; users of Satori should update to 0.33.5. Workarounds include avoiding attacker-controlled values in SVG content.

🛡️ WordPress released updates on September 22 to fix a critical template-handling vulnerability (CVE-2026-87902) that lets unauthenticated attackers cause a site to load PHP files from outside theme folders. The flaw affects versions 4.7.0 through 7.1.1 and was rated CVSS 9.2. Site owners are urged to update to the listed patch for their branch immediately; automatic updates will apply for sites with that setting enabled.

🛡️ WordPress fixed a critical flaw, CVE-2026-93485 dubbed Comment2Shell, on September 17 in version 7.1.1 after a researcher showed how a crafted comment could plant a hidden script that executes when a page is viewed. The bug allowed that script to act with the viewer's privileges and, if an administrator viewed the page, to leverage the admin session to upload a plugin web shell. Site owners are urged to update immediately or temporarily disable comments and consider WAF or security plugin mitigations.

🛡️ A newly disclosed WordPress CSRF vulnerability named Click2Shell allows pre-authenticated remote code execution by forcing the installation of a theme from the WordPress.org catalog and running arbitrary PHP. The issue, fixed in WordPress 7.1.1, was reported by researcher Paulos Yibelo of pwn.ai and relies on a buggy interpretation of a theme-preview URL combined with JavaScript in the admin browser. An attacker needs no account but requires a logged-in administrator to visit a crafted link, enabling server-side code execution and potential data or file theft. Patchstack notes only administrators can trigger the chain and advises updating or enabling DISALLOW_FILE_MODS as a temporary mitigation.

🛡️ Fortinet and other telemetries report active exploitation of CVE-2026-58138, a critical unauthenticated remote code execution flaw in Orkes Conductor. The vulnerability affects versions 3.21.21 through 3.30.1 and allows attackers to execute arbitrary OS commands by submitting crafted workflow definitions containing JavaScript or Python expressions to the workflow API. Exploits leverage unsandboxed GraalVM evaluators with unrestricted host access, and multiple vendors have observed in-the-wild attempts. Users are urged to upgrade to Conductor 3.30.2 or later and apply network mitigations if immediate patching is not possible.

🛡️ The US Cybersecurity and Infrastructure Security Agency (CISA) has upgraded its vulnerability reporting and coordination platform to VINCE-NT, a modernized, CISA-managed version of Carnegie Mellon’s VINCE. The change, announced on September 17, shifts ownership to CISA’s Coordinated Vulnerability Disclosure (CVD) team and introduces automation, built-in collaboration tools, and a revamped interface to simplify reporting and improve triage. Active cases will be migrated over the coming weeks while inactive cases remain on the original VINCE; organizations are advised to update internal reporting procedures to submit vulnerabilities via VINCE-NT.

🛡️ NLnet Labs released Unbound 1.26.1 to address a critical heap overflow in the DNSSEC validator affecting every release prior to 1.26.1. The overflow (CVE-2026-81642) can be triggered by an attacker controlling a malicious zone and may allow denial of service or remote code execution; eight additional flaws were also patched. Source, binaries, and Windows installers are available, and the advisory provides standalone and combined patches for those unable to upgrade.

🛡️ The Internet Systems Consortium (ISC) released BIND 9.20.29 and 9.21.26 to remediate fourteen vulnerabilities disclosed on 16 September, including a DoH-related crash triggered by an invalid SIG(0) when the client closes a connection early. ISC reports no known active exploitation of these flaws and provides no workarounds; twelve of the issues also affect the unsupported 9.18 branch. The advisories detail affected versions, CVSS scores, conditions to exploit each flaw, and that public test reproductions exist to confirm fixes.

🔒 Helpfeel's image-sharing service Gyazo disclosed a breach that exposed about 23.62 million user records and roughly 490 million image metadata records, mostly from January 2019 or earlier. The attacker exploited a vulnerability in Gyazo's image upload server to run arbitrary commands and access the database; Helpfeel has disabled some image viewing and urged users to change passwords and watch for suspicious messages. The company says no payment data was exposed and external forensics are ongoing.

🛡️ Oracle’s September 2026 Critical Security Patch Update delivers 673 fixes across 17 product families, led by Oracle E-Business Suite (159 patches) and Fusion Middleware (153). Several vulnerabilities in these products are remotely exploitable without authentication, including five Fusion Middleware flaws rated CVSS 10.0 and an additional CVSS 10.0 issue in Hyperion Financial Management. Oracle urges immediate patching and notes that mitigations such as blocking protocols or removing privileges may break functionality and are not substitutes for updates.

🛡️ Wordfence reports attackers uploading PHP webshells via a critical flaw in the premium WooCommerce Wholesale Lead Capture plugin. The vulnerability (CVE-2026-27540) was patched in version 2.0.3.2 on February 20, but exploitation attempts—over 100,000 blocked—continued months later. Site owners should update immediately, scan uploads directories, and check access logs for the vulnerable AJAX action.

🔒 JFrog disclosed a local privilege escalation in Parallels Desktop for Mac that allows a non‑admin local account to execute code as root by abusing the prl_disp_service socket and an unsafe InstallAppliance extract template. The issue, tracked as CVE-2026-90894 and rated 7.8 by JFrog, was demonstrated on Parallels Desktop 26.4.0 on Apple silicon. JFrog says the fix appears in the 27.x line, which is only installable on Apple silicon Macs, leaving Intel users on the 26.x line without the described repair.

🔒 Security researchers disclosed two zero-day vulnerabilities in TP-Link Tapo C200 cameras used for home and SOHO monitoring. Vendor firmware V5_1.4.6, released 18 August, addresses CVE-2026-15315 (auth bypass via replay) and CVE-2026-15316 (onboarding DoS). OPSWAT warns the auth bypass can expose live video and recordings, while the DoS crashes the HTTPS service. A third, still-unpatched bug is considered critical and may allow full device compromise.

🔒 Wordfence has observed active exploitation of a critical vulnerability (CVE-2026-27540) in the premium WordPress plugin WooCommerce Wholesale Lead Capture, enabling unauthenticated attackers to upload arbitrary files and achieve remote code execution. The flaw affects versions up to 2.0.3.1 and has prompted over 100,000 blocked exploit attempts since June 2026. Site owners should inspect for unexpected .php files and suspicious admin-ajax requests referencing the "wwlc_file_upload_handler" action.

🔒 Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. The flaw, designated CVE-2026-87886 with a 7.8 severity score, allows a low-privileged attacker to elevate permissions on affected Linux servers. Acronis reports limited, targeted exploitation and urges administrators to apply patches that fix affected builds of the plugin and extension.

🔒 Hackers are exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin (CVE-2026-27540) to upload PHP webshells and execute code on affected WordPress sites. The unauthenticated arbitrary file-upload flaw affects versions 2.0.3.1 and older and was fixed in version 2.0.3.2 released February 20. Wordfence blocked over 100,000 related attacks and urges administrators to update, scan for unexpected PHP files, check logs for wwlc_file_upload_handler requests, and restore from clean backups if compromised.