A WordPress Core vulnerability chain, publicly nicknamed wp2shell, combines CVE-2026-63030 (CVSS 9.8) and CVE-2026-60137 (CVSS 5.9) for pre-authentication remote code execution (RCE). The exploit chain affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. WordPress 6.8.x before 6.8.6 is affected by CVE-2026-60137 alone. Dozens of proof-of-concept (PoC) exploits have been published for the full exploit […]
Citrix security advisory CTX696604 covers six vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway. NetScaler Gateway is used to authenticate remote users and connect them to internal network resources, and NetScaler ADC load balancing is a core feature used to distribute requests and improve availability. The highest-risk issues in the bulletin can lead to memory […]
BeyondTrust advisory BT26-03, issued on July 6th, 2026, describes multiple new vulnerabilities in BeyondTrust Remote Support (RS) and BeyondTrust Privileged Remote Access (PRA). The vulnerabilities include two critical flaws exploitable without authentication and additional high-severity issues in network communication and web application components. All the flaws require specific configurations for exploitation, but BeyondTrust has not […]
CVE-2026-48282 (CVSS 10) is a critical path traversal vulnerability [CWE-22] in Adobe ColdFusion. According to Adobe’s Security Bulletin [APSB26-68], the issue affects ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier. Exploitation is network-based, which increases the risk to exposed ColdFusion instances, and exploitation does not require authentication. A successful attack […]
The true impact that cyber security aware AI will have on the global threat landscape remains to be seen. By some reports, the CVE output for software made by major vendors is on the rise. This June 2026 threat report only scratches the surface of the major cyber security threats from this month. The month […]
Cisco products have been battered in 2026 by critical-severity, actively exploited vulnerabilities in recent months [1][2][3][4][5][6][7][8][9]. Recently exploited Catalyst SD-WAN Manager and Controller flaws include CVE-2026-20133 (CVSS 7.5, EPSS >= 95th pctl), CVE-2026-20128 (CVSS 7.8, EPSS >= 90th pctl), CVE-2026-20122 (CVSS 5.4, EPSS >= 93rd pctl), CVE-2026-20127 (CVSS 10, EPSS 99th pctl), and CVE-2026-20182 (CVSS […]
Exploitation of vulnerabilities has now emerged as the most common way that attackers gain initial access into an organization’s environment, which underlines the ongoing importance of getting the basics right. Verizon 2026 Data Breach Investigation Report [1] More CVEs, Less Time The industrialization of vulnerability exploitation is not new; the process-driven approach to vulnerability weaponization […]
Three new high-severity local privilege escalation (LPE) vulnerabilities affecting Linux were recently disclosed, creating significant global risk. Although user-level access is a prerequisite for their exploitation, the new CVEs allow command execution as the root user and full system takeover. The CVEs are considered reliably exploitable on all major Linux distributions. The name “Copy Fail” […]
In April 2026, the cyber security landscape was flooded with news about Anthropic’s new Mythos bug-hunting AI and Project Glasswing. The rose-colored takeaway is that one year from now, software will be free from vulnerabilities because AI will find all of the flaws and vendors will patch. Major software companies will scan all their products […]
! Update May 18, 2026 Three additional CVEs have been discovered in cPanel & WHM that could allow attackers to read files, execute arbitrary code, or escalate privileges on unpatched systems. The issues have been patched in cPanel & WHM versions 11.136.0.9, 11.134.0.25, 11.132.0.31, and WP Squared. Greenbone’s OPENVAS ENTERPRISE FEED provides users with alerts […]
