Exploited bugs, new critical vulnerabilities, and what defenders should check.
Brief2 min read
A researcher says the update that patches an actively exploited WordPress flaw still unpacks its files using the site's old, unpatched code, leaving a window for an attacker who times it right.
ExploitedCVE-2026-96654CVSS 6.92 min read
QNAP says it has reports from some users that Plex Media Server on their NAS was compromised through the Plex2Shell flaws, and that patching won't remove what attackers already left behind.
ExploitedCVE-2026-123158CVSS 8.12 min read
On Alpine and other musl libc builds with PAM disabled, some accounts accept any password between 257 and 1,024 characters. Fixes are in OpenSSH 10.6p2.
Brief2 min read
The bug only hits OpenSSH built against musl, which covers Alpine Linux, OpenWRT, BuildRoot and Yocto. Patches went out a day after the report.
Brief1 min read
A password of 257 to 1,024 bytes gets past SSH authentication on some Alpine servers running the standard openssh-server package, including accounts with no password set.
ExploitedCVE-2026-116606CVSS 9.32 min read
The researchers diffed Barracuda's own patches for two ESG flaws and found a failed password change that doesn't stop execution, plus a timezone field that reaches a shell.
CVE-2016-6210CVSS 5.92 min read
A researcher says the bug has been in OpenSSH since 2016 and only bites on musl-based systems with password auth on and PAM off. It's fixed in OpenSSH 10.6p2.
Brief2 min read
Bitdefender says a malformed APK can crash system_server repeatedly, and Google closed the report as not reproducible. Recovery means a factory reset or ADB, and ADB needs debugging already switched on.
ExploitedCVE-2026-7273CVSS 8.82 min read
Binarly says the attacks GreyNoise pinned on a June-patched Zyxel bug instead exploited a separate out-of-bounds write, which Zyxel fixed in October.
Brief1 min read
Binarly found switches patched with Zyxel's earlier fix are still open to the same attack. New firmware covers 10 GS1900 models.
CVE-2026-109593CVSS 9.12 min read
The vendor advisory covers GMS 9.5.2 and earlier. One flaw is an unauthenticated file read rated 9.1; the other can alter database records. Neither gets a fix.
Brief2 min read
Debian, Ubuntu and APT's developers published advisories on November 4 describing a package-swap bug that ends in code running as root. It needs a man-in-the-middle position and APT's default retry behaviour.
