Critical flaws in WPMU DEV, Avada, TranslatePress, Pods, and GiveWP can enable admin takeover or remote code execution.

Microsoft says TerminalFix uses fake Cloudflare CAPTCHAs to trigger PowerShell and deploy a reverse-tunnel backdoor for internal network access.

Attackers chain two PaperCut NG and MF flaws for unauthenticated remote code execution, with limited exploitation seen in two ...

Berlin confirms an extortion attempt after data theft from its state network, while the scope of the exfiltrated data remains ...

CISA adds six exploited flaws to KEV, including a NetScaler bug tied to web shells and 36 exploitation attempts in 12 days.

INTERPOL's Operation Jackal IV arrests 58 people, identifies 263 suspects, and disrupts fraud and laundering networks across ...

GoCaracal gave operators remote shell access and browser data theft during a June 2026 intrusion at a Venezuelan ...

Android 17 adds OS-wide ECH, local network permissions, default certificate transparency, and carrier-controlled 2G blocking.

Two Unitree G1 EDU vulnerabilities enable separate root RCE chains, including a BLE path; fixed firmware versions remain ...

PaperCut says a zero-day affecting all NG and MF versions is actively exploited; emergency patches are available for v25 and ...

Panel patches CVE-2026-65643, a critical flaw that lets authenticated accounts with domain controls execute code as root.

CISA adds CVE-2026-60004 to KEV amid active Gitea RCE exploitation; a separate reported attack deployed a miner-like dropper.