Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.

The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek.

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.

The post Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH appeared first on SecurityWeek.

CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA.

The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek.

Hackers created an account on an internal system and accessed names, email addresses, phone numbers, and business addresses.

The post DigiCert Data Breach Impacts Business Customer Information appeared first on SecurityWeek.

On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters.

The post OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass appeared first on SecurityWeek.

An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.

The post AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research appeared first on SecurityWeek.

Cisco patched an RCE in UCS Central Software; WatchGuard fixed authentication and MitM flaws.

The post Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws appeared first on SecurityWeek.

An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.

The post Barracuda ESG Authentication Bypass Flaw Opens Path to Root appeared first on SecurityWeek.

The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.

The post Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical appeared first on SecurityWeek.

A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff.

The post Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million appeared first on SecurityWeek.

The most severe is a critical flaw in Framework leading to remote code execution without user interaction.

The post Android’s November 2026 Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.

Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.

The post Critical Node-RED Flaw Exploited in Attacks appeared first on SecurityWeek.

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

The post Fresh WordPress Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.

The post TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines appeared first on SecurityWeek.

The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.

The post Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.

An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload.

The post Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August appeared first on SecurityWeek.

The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.

The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.

The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek.

Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs.

The post Long-Hidden Flaws Patched in EPICS Research Facility Control Software appeared first on SecurityWeek.