← Feed

Posts

• View post

  CVE-2026-108693 is an uncontrolled search path flaw in ImageMagick on Windows. A malicious Ghostscript binary planted in the working directory can run with ImageMagick privileges when PDF, PostScript, or EPS files are converted. Affected: through 7.1.2-33 and 6.9.13-58. Update to a newer ImageMagick build to remediate. https://www.cve.org/CVERecord?id=CVE-2026-108693 #infosec #cybersecurity

• View post

  🔴 EXPLOITED AhsayCBS backup servers are under active attack. Two chained flaws give code execution as SYSTEM on an exposed console, no login needed. The latest version, 10.3.4, has no patch. Fix: restrict the console to trusted IPs or VPN. (CVE-2026-105134) https://suriq.io/blog/ahsaycbs-cve-2026-105134-unauth-rce-exploited #CVE #infosec #cybersecurity

• View post

  CVE-2026-40800 and CVE-2026-42717 are SQL injection vulnerabilities in two WordPress plugins. CVE-2026-40800 affects ELEX WooCommerce Advanced Bulk Edit through 1.5.3; CVE-2026-42717 affects Leyka through 3.32.3. No exploitation is confirmed. Update both plugins to the latest available version. https://www.cve.org/CVERecord?id=CVE-2026-40800 #CVE #infosec #cybersecurity

• View post

  SonicWall patched a max-severity flaw in its SMA1000 VPN gateways on Oct 6. Honeypots saw exploitation a day later. CVE-2026-102255 is a CVSS 10 pre-auth SSRF. No workaround. Run SMA1000? Patch now. https://suriq.io/blog/sonicwall-sma1000-cve-2026-102255-preauth-ssrf #CVE #CISAKEV #infosec #cybersecurity

• View post

  CVE-2026-109259: ImageMagick patched two memory-handling flaws. A crafted TGA image can trigger an uninitialized memory read (CVE-2026-109259) disclosing process memory; a crafted image triggers an SVG encoder leak (CVE-2026-109262) causing denial of service. Versions before 6.9.13-57 and 7.x before 7.1.2-32 are affected; fixed in 6.9.13-57 and 7.1.2-32. https://www.cve.org/CVERecord?id=CVE-2026-109259 #infosec #cybersecurity

• View post

  CVE-2025-27895, CVE-2025-27896 and CVE-2025-27897 are unauthenticated cross-site scripting flaws in IBM DB2 Recovery Expert for Linux, UNIX and Windows. Version 5.5 IF 2 is affected. No exploitation is confirmed. IBM fixes all three in version 12.1. https://www.cve.org/CVERecord?id=CVE-2025-27895 #Linux #Windows #infosec #cybersecurity

• View post

  ⚠️ PATCH NOW A crafted regex in a CI/CD config can run code on a self-managed GitLab server. No login required. GitLab CVE-2026-97229 is a CVSS 10 unauthenticated RCE. GitLab.com is already patched; self-hosted is the exposure. Patch to 19.4.2, 19.3.5, or 19.2.8 now. https://suriq.io/blog/gitlab-cve-2026-97229-cicd-regex-unauth-rce #CVE #infosec #cybersecurity

• View post

  CVE-2026-89112 is a broken access control flaw in SAP SE's CLA-Assistant. A low-privileged authenticated user can read CLA signature records, including contributor information, for organisations they do not administer. Versions through 2.13.1 are affected. Upgrade to the patched release. https://www.cve.org/CVERecord?id=CVE-2026-89112 #infosec #cybersecurity

• View post

  CVE-2026-103316: Logius DigiD for macOS shipped without Hardened Runtime, letting a local user with code execution inject a dylib and run code inside the app. Versions before 6.19.2 are affected. Update to 6.19.2. No in-the-wild exploitation is confirmed. https://www.cve.org/CVERecord?id=CVE-2026-103316 #infosec #cybersecurity

• View post

  GitLab (CVSS 10, unauthenticated RCE) and Argo CD (four criticals) both shipped maximum-severity fixes for their build and deploy control planes in one week. A flaw there is not one server, it is a trusted channel to everything it deploys. This week's Signal. https://suriq.io/blog/signal-pipeline-rce-blast-radius #CVE #SupplyChain #infosec #cybersecurity

• View post

  CVE-2026-109964 affects ImageMagick. A crafted PICT file can trigger a heap buffer underwrite in the PICT decoder on 32-bit builds, leading to crashes or possible code execution. Versions before 7.1.2-33 and 6.9.13-58 are affected. No exploitation is confirmed. Update to 7.1.2-33 or 6.9.13-58. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w #infosec #cybersecurity

• View post

  ONLYOFFICE Document Server has a high-severity flaw (CVE-2026-110385): a Document Builder request can overwrite its own config file and run commands on the server. Affects every self-hosted version before 10.0. Fix: upgrade to 10.0 and enable inbound token validation. https://suriq.io/blog/onlyoffice-cve-2026-110385-document-builder-rce #CVE #infosec #cybersecurity

• View post

  CVE-2026-87855 and CVE-2026-78193 affect the JTL-Connector for WooCommerce WordPress plugin from ntbyk, all versions up to and including 2.4.3. CVE-2026-87855 is an unauthenticated arbitrary file upload that can lead to remote code execution. CVE-2026-78193 is an unauthenticated SQL injection. No fixed version is listed. https://www.cve.org/CVERecord?id=CVE-2026-87855 #CVE #infosec #cybersecurity

• View post

  CVE-2026-70035 is a remote code execution flaw in Microsoft .NET Windows Desktop Runtime (WPF), from unsafe deserialization and URI handling in XAML and XPS. No exploitation is confirmed. Affected: .NET 8, 9, 10 and 11 preview runtimes. Fix: update to 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2. https://github.com/advisories/GHSA-4j9v-h7pp-725h #Windows #infosec #cybersecurity

• View post

  CVE-2026-9703: Grafana's data source proxy did not apply role-based access control to Loki write requests, so a Viewer-only account could create, modify or delete Loki alerting rules affecting every user of that data source. Releases through 13.0.3 are affected. Update to 13.0.4 or the patched maintenance release. https://www.cve.org/CVERecord?id=CVE-2026-9703 #infosec #cybersecurity

• View post

  CVE-2026-100409 affects OpenNextJS @opennextjs/cloudflare, the Next.js adapter for Cloudflare. Versions 0.3.0 through earlier than 1.20.2 can serve cached protected content to unauthenticated requests through percent-encoded paths that bypass authorization middleware. Upgrade to 1.20.2. https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6 #CloudSecurity #infosec #cybersecurity

• View post

  CVE-2026-111133 is an integer underflow in libyal's libfsapfs, an open-source APFS image parsing library. A crafted APFS image can trigger a heap out-of-bounds read, crashing forensic tools that parse it before password checks. Versions through 20260921 are affected. No in-the-wild exploitation is confirmed. No fixed release is named yet. https://www.cve.org/CVERecord?id=CVE-2026-111133 #infosec #cybersecurity

• View post

  FunnelKit, a WooCommerce plugin on 30,000+ stores, has a flaw that lets anyone with no login read the billing name, address, email and phone on any order. Exposed only if your thank-you page shows FunnelKit order data. Fix: update to 3.17.0. (CVE-2026-107746) https://suriq.io/blog/funnelkit-cve-2026-107746-woocommerce-pii-leak #CVE #DataBreach #infosec #cybersecurity

• View post

  CVE-2015-7297 is an SQL injection flaw in Joomla CMS that allows remote attackers to execute arbitrary SQL commands. It affects versions 3.2 through 3.4.3. Joomla addressed it in version 3.4.4. Sites on affected versions should update. https://www.cve.org/CVERecord?id=CVE-2015-7297 #infosec #cybersecurity

• View post

  CVE-2026-94134: Apache Airflow SSH and SFTP providers disable SSH host-key verification by default, accepting any server key unless configured otherwise. A machine-in-the-middle attacker can impersonate the server and capture the credentials or data a task sends. The Apache Software Foundation fixed both providers in version 7.0.0. No exploitation is confirmed. https://www.cve.org/CVERecord?id=CVE-2026-94134 #infosec #cybersecurity

• View post

  Our desk triaged 4,609 vulnerabilities this week and published 8. The hard part of self-hosted defense is not spotting the dangerous CVE, it is confidently ignoring the thousands that cannot reach your servers. https://suriq.io/blog/signal-triage-signal-from-noise #CVE #CISAKEV #infosec #cybersecurity

• View post

  🔴 EXPLOITED WordPress core CVE-2026-87902 is being exploited to run code on sites, and it affects every release back to 4.7.0. No login needed. CISA wants it patched by Sept 28. Fix: update to WordPress 7.1.2. https://suriq.io/blog/wordpress-core-cve-2026-87902 #CVE #CISAKEV #infosec #cybersecurity

• View post

  CVE-2026-82294, CVE-2026-82300 and CVE-2026-94396: Elastic patched three uncontrolled resource consumption flaws in Elasticsearch that can cause denial of service. Affected 8.x and 9.x releases run through 9.5.3. No exploitation is confirmed. Update to 8.19.22, 9.4.8 or 9.5.4. https://www.cve.org/CVERecord?id=CVE-2026-82294 #infosec #cybersecurity

• View post

  🚨 BREAKING A stranger with no login can upload a PHP file and run it on your WooCommerce store. Request a Quote for WooCommerce (through 2.9.2) has a critical file-upload flaw, and there is no patch yet. Disable the popup quote form now. (CVE-2026-18143) https://suriq.io/blog/request-a-quote-woocommerce-cve-2026-18143 #CVE #infosec #cybersecurity

• View post

  containerd patched CVE-2026-53493: a crafted image can pin a node's CPU and memory during the pull, before any container runs. Moderate, not yet exploited. Pull untrusted images? Update: 1.7.36, 2.0.13, 2.2.9, 2.3.6, 2.4.1. https://suriq.io/blog/containerd-cve-2026-53493-image-pull-dos #CVE #infosec #cybersecurity

• View post

  CVE-2026-63278 affects LibreOffice from The Document Foundation. Crafted document links could expand environment variable or INI file values and exfiltrate that data to a remote server when a document is opened. Versions before 26.2.5 are affected. Update to LibreOffice 26.2.5. No exploitation has been confirmed. https://www.libreoffice.org/about-us/security/advisories/CVE-2026-63278 #infosec #cybersecurity

• View post

  🔴 EXPLOITED CVE-2025-25249: A heap-based buffer overflow in Fortinet FortiOS and FortiSwitchManager allows unauthorized code execution via crafted packets. It is listed in CISA KEV. Affected: FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 and 7.2 branches. Fix: upgrade to the patched releases. CISA due date September 12, 2026. https://www.cve.org/CVERecord?id=CVE-2025-25249 #CISAKEV #infosec #cybersecurity

• View post

  Two of this week's five critical WordPress flaws (GiveWP, CVSS 10.0, and Avada) don't just take over the site, they run code on the hosting server. All five are unauthenticated. Patch now. https://suriq.io/blog/wordpress-five-critical-plugin-theme-flaws-server-rce #CVE #CloudSecurity #infosec #cybersecurity

• View post

  The Unitree G1 humanoid robot has two flaws that give root with no login (CVE-2026-76639, CVE-2026-76640). One works over Bluetooth from across a room, and a hacked robot can infect other G1 units nearby. Unitree fixed the cloud part; isolate the rest. https://suriq.io/blog/unitree-g1-robot-bluetooth-root-rce #CVE #CloudSecurity #infosec #cybersecurity

• View post

  VulnCheck found two more factory backdoors in ZBT router firmware: SPEAKINGSTONE and DARKLANTERN (CVE-2026-74232/74233). One calls out, one listens on an open port for anyone to reach as root. No fix. Replace the hardware. https://suriq.io/blog/zbt-speakingstone-darklantern-router-backdoors #CVE #SupplyChain #infosec #cybersecurity