The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.

The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek.

Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.

The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek.

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.

The post Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH appeared first on SecurityWeek.

CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA.

The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek.

Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests.

The post Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day appeared first on SecurityWeek.

Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.

The post Critical Node-RED Flaw Exploited in Attacks appeared first on SecurityWeek.

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.

The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

The post Fresh WordPress Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.

Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.

The post Drupal Commerce Core Vulnerability Exploited Against Online Stores  appeared first on SecurityWeek.

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

The post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.

Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.

The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek.

An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload.

The post Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August appeared first on SecurityWeek.

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.

CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution.

The post Hackers Start Probing Fresh Oracle EBS Vulnerability appeared first on SecurityWeek.

CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.

The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.

Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.

The post PHP2Shell Exploitation Moves From Probes to Working Shells  appeared first on SecurityWeek.

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.

The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared first on SecurityWeek.

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

The post Attackers Exploit Third Arista VCO Zero-Day in Four Months appeared first on SecurityWeek.

Initial attempts were observed on October 17, and mass activity began shortly after patches were released.

The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek.