The exploited flaw, CVE-2025-67038, is one of the vulnerabilities disclosed in April as part of the BRIDGE:BREAK research project.

The post Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning appeared first on SecurityWeek.

CVE-2026-20245, the 7th Cisco SD-WAN vulnerability exploited in 2026, was used for months prior to its disclosure and patching.

The post Cisco SD-WAN Zero-Day Exploited Months Before Patching appeared first on SecurityWeek.

The flaws allow remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands.

The post Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs appeared first on SecurityWeek.

Cisco noted that a PoC had been available for CVE-2026-20230 when it announced patches in early June.

The post Hackers Exploiting Cisco Unified CM Vulnerability appeared first on SecurityWeek.

Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data.

The post Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data appeared first on SecurityWeek.

CISA has given federal agencies only three days to patch CVE-2026-20253, which can be exploited for unauthenticated remote code execution.

The post Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure appeared first on SecurityWeek.

The flaws allow attackers to execute arbitrary PHP code and gain root privileges on shared hosting servers.

The post Joomla, LiteSpeed Vulnerabilities Exploited in Attacks appeared first on SecurityWeek.

SOCRadar has detected 30,000 compromised Fortinet firewalls that expose networks to hacking. 

The post 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs appeared first on SecurityWeek.

Cisco recently became aware of the exploitation of CVE-2026-20262, a Catalyst SD-WAN Manager zero-day that allows arbitrary file write.

The post Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks appeared first on SecurityWeek.

The critical-severity OS command injection vulnerability allows attackers to execute arbitrary code with root privileges.

The post Ivanti Sentry Exploitation Attempts Hitting Honeypots appeared first on SecurityWeek.

Oracle has mitigated CVE-2026-35273, but it has not publicly confirmed the vulnerability’s in-the-wild exploitation.

The post Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters appeared first on SecurityWeek.

Oracle has released mitigations for CVE-2026-35273, but it has not said whether it’s a zero-day exploited in ShinyHunters attacks.

The post Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks appeared first on SecurityWeek.

Disclosed in March, the security defect enables unauthenticated attackers to write files to arbitrary locations on the system.

The post Hackers Exploit Langflow Vulnerability for Remote Code Execution appeared first on SecurityWeek.

The company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14. 

The post Microsoft Patches Exploited Exchange Server Vulnerability appeared first on SecurityWeek.

The company updated hosted customer instances to patch a security issue it reportedly had known about since April 7.

The post ServiceNow Patches Vulnerability Exploited Against Some Customers appeared first on SecurityWeek.

Organizations are advised to apply vendor-supplied mitigations or discontinue the vulnerable devices.

The post No Patch Planned for Exploited Arista EOS Vulnerability appeared first on SecurityWeek.

The vulnerability is tracked as CVE-2026-11645 and it was reported in late April by an anonymous researcher.

The post Google Patches 5th Chrome Zero-Day Exploited in 2026 appeared first on SecurityWeek.

The flaw allows attackers to execute arbitrary code remotely and has been exploited in the wild for two months.

The post Everest Forms Vulnerability Exploited to Hack WordPress Sites appeared first on SecurityWeek.

The social media giant has informed authorities about the impact of the recent attack involving an account recovery support tool.

The post Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse appeared first on SecurityWeek.

The vulnerability is tracked as CVE-2026-20245 and it can allow arbitrary command execution as root, but no patch yet.

The post Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 appeared first on SecurityWeek.