WordPress Urges Immediate Patch for Click2Shell Vulnerability
WordPress released fixes for Click2Shell CSRF allowing PHP execution and potential remote code execution; patch immediately.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesWednesday, September 23
Monday, September 21
Critical Click2Shell Vulnerability in WordPress Demands Immediate Update
PremiumClick2Shell allows a crafted link to force a WordPress admin to install an attacker-chosen theme, chaining to server RCE.
Critical Flaw in Cisco Identity Services Engine Poses Severe Security Risks
PremiumCVE-2026-76460 authentication bypass in Cisco ISE scored 10/10 CVSS, exposing API endpoints to unauthenticated access.
Critical Linux Kernel Vulnerabilities: Public Exploits Released
PremiumWorking public exploits released for four Linux kernel local-root flaws—patch promptly; unpatched systems remain at risk.
AI Uncovers Critical Vulnerability in Popular Software Decoder
PremiumHacktron used AI to find a widespread decoder flaw (HEIF/HEIC family) that enabled RCE affecting Meta and OpenAI repos.
Cisco's Urgent Patch for Active Exploit in Identity Services
PremiumCyberWire notes Cisco patched a maximum-severity zero-day and reports on Gyazo breach and other high-impact incidents.
Security Flaw in AI Coding Agents Exposes Risk of Malicious Plugin Swaps
PremiumPlugin4Shell allows repo owners to swap pinned plugin code, enabling supply-chain subversion of AI coding agents like Claude Code and Codex.
Critical Vulnerability in Check Point Software Exposes Systems to Root-Level Attacks
PremiumCheck Point released fixes for a critical vulnerability allowing remote code execution as root on management systems.
Orkes Conductor Vulnerability Exploited: What You Need to Know
PremiumCVE-2026-58138 is an unauthenticated Orkes Conductor RCE vulnerability being actively exploited via inline workflow definitions.
Steam Vulnerability Opens Door to SYSTEM Privilege Escalation on Windows
PremiumBrokenPipe PoC abuses Steam Client Service to silently escalate a local standard user to NT AUTHORITY\SYSTEM privileges.
Colorado Water Systems Breach Highlights Infrastructure Vulnerabilities
PremiumTwo privately managed Colorado water systems suffered cyber intrusions, highlighting operational and public-safety risks to utilities.
CISA Urges Immediate Action on Exploited Linux Kernel Vulnerabilities
PremiumCISA added multiple Linux kernel CVEs (including CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV for immediate remediation.
Revolut Breach and Cisco Vulnerabilities Highlight Ongoing Cybersecurity Threats
PremiumReports claim a Cisco Email Gateway zero-day was exploited while Revolut data breach details surfaced, indicating active user data exposure.
Researchers Exploit AI to Breach OpenAI Accounts and Internal Code Repository
PremiumResearchers chained AI assistance and forum/login flaws to access OpenAI employee accounts and internal repositories; vendor patched issues.
Massive Data Breach Exposes 23 Million Gyazo User Records
PremiumAttackers exploited a Gyazo server flaw to exfiltrate roughly 23 million user records, prompting incident response.
Microsoft Fixes Critical Vulnerability in Azure AI Foundry
PremiumCVE-2026-85889 allowed unauthenticated privilege escalation in Azure AI Foundry; Microsoft released an urgent patch.
Friday, September 18
BIND 9 Update Addresses Critical Security Vulnerabilities
PremiumISC patched 14 BIND 9 vulnerabilities, including unauthenticated DoH crash and cache-poisoning risks affecting DNS servers.
Critical Vulnerabilities in TP-Link Cameras Expose Privacy Risks
PremiumOPSWAT researchers found two zero-days in TP-Link cameras that enable remote eavesdropping and data exposure.
Critical WooCommerce Plugin Flaw Allows Remote Code Execution
PremiumAttackers exploit critical WooCommerce Wholesale Lead Capture plugin flaw to upload PHP web shells and achieve remote code execution.
Get these articles delivered to your inbox.
Subscribe free