Security news
Exploited vulnerabilities and what to do about them, checked against primary sources.
Actively exploited
Arara Message breach: 81 million email addresses stolen and phishing sent in card issuers' names
An attacker broke into Arara Message, a Japanese bulk email delivery service, took more than 81 million email addresses belonging to the customers of roughly 380 companies, and used the service itself to send up to 7.13 million phishing emails posing as credit card companies. The fallout is now reaching downstream customers: on 13 November 2026 the City of Osaka disclosed that 1.08 million addresses of users of its online services system were exposed. Here is what is confirmed and what it means for defenders and users.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.
Actively exploited
FBI disrupts North Korea's FaceStealer fake video call campaign as the US moves to seize $1.2 billion from the Binance theft
On 12 November 2026 the US Department of Justice announced two actions against North Korean cryptocurrency theft. The FBI disrupted cloud infrastructure behind FaceStealer, a campaign that lures crypto workers and open-source developers into fake video calls and installs malware disguised as a fix for an audio problem. Separately, a court authorised the seizure or restraint of more than $1.2 billion from the theft of over $6 billion from Binance on 29 October. Here is how the trick works and what to do if you joined one of these calls.
Actively exploited
Check Point: PHP2Shell and CVE-2026-123039 exploited against Mobile Access gateways
On 12 November 2026 Check Point disclosed that attackers hit unpatched Quantum Security Gateways running the Mobile Access portal between 30 October and 4 November. They got in through the PHP2Shell flaws in the bundled PHP runtime, escalated to root through a new Gaia OS bug, CVE-2026-123039, and planted backdoors. At some Israeli victims they then moved to VMware ESXi hosts and ran a wiper. If you run Check Point gateways, install the November Jumbo Hotfix and hunt for the indicators below.
Patch available
PostgreSQL fixes 52 security flaws; the worst, CVE-2026-6460, lets a database user run code on the server
On Thursday 12 November 2026 the PostgreSQL project released 18.7, 17.12, 16.16, 15.20 and 14.25, fixing 52 security vulnerabilities and more than 140 other bugs. The one to focus on is CVE-2026-6460 (CVSS 8.8): a user who can create objects in the database can trigger a type confusion after ALTER … SET DATA TYPE and run arbitrary code as the operating system account the database runs under. Full protection also requires rebuilding C-language extensions. No exploitation has been reported. PostgreSQL 14.25 is the final release of the 14 branch.
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.
Actively exploited
Trezor confirms hidden implants in three Safe 5 wallets sold by CryptoBilis; firmware 2.13.1 neutralises them
Hardware wallet maker Trezor confirmed on 12 November 2026 that three Trezor Safe 5 units sold through the Asian reseller CryptoBilis contain an extra circuit board between the main board and the display. The board copies the recovery phrase whenever it appears on screen and sends it, encrypted, over the mobile network to the attackers. Firmware 2.13.1 shuts these implants down, but it cannot protect a phrase that was captured earlier. Anyone who bought a Trezor from CryptoBilis since March 2026 should move their funds to a new wallet with a new phrase.
Patch available
Apache HTTP Server 2.4.71 fixes a critical mod_http2 flaw that can lead to remote code execution
The Apache HTTP Server project released version 2.4.71 on 11 November 2026. It fixes three vulnerabilities, one of them critical: CVE-2026-119618 in mod_http2, the module that handles HTTP/2. A race condition while processing headers can corrupt the heap and, according to Apache, lead to remote code execution. Versions 2.4.55 through 2.4.70 with HTTP/2 enabled are affected. There are no reports of exploitation so far. Here is how to check whether your server is exposed and what to do until your distribution ships a fixed package.
Actively exploited
Apify breach: attacker used a compromised credential to obtain user account credentials
Web scraping and automation platform Apify detected on 11 November 2026 that an unauthorized third party had used a compromised credential on 9 and 10 November to obtain a number of account credentials and access related Apify accounts. The company closed the access path, revoked some OAuth connections including GitHub, and rotated internal secrets. Here is what is confirmed and what users need to do.
Actively exploited
Attackers abuse GSocket for stealthy access to Linux servers
On 11 November 2026 Microsoft published an analysis of intrusions in which attackers, after breaking in through a vulnerable web application, install the legitimate open-source tool GSocket on Linux servers. The connection goes out through a shared relay network, so inbound firewall rules never see it, and the attackers keep access even after the original flaw is patched. The write-up includes paths, hashes, domains and hunting queries.
Actively exploited
Cairn: CL-STA-1238 let autonomous AI agents attack chipmakers, defense firms and nonprofits
On 12 November 2026 Unit 42 (Palo Alto Networks) published an analysis of a campaign in which a China-nexus actor used a customized fork of the open-source Cairn framework. In August and September 2026 its AI agents ran 25 operations against at least 19 organizations largely on their own, from reconnaissance to persistence. Nothing about it was novel: weak passwords, open registration endpoints and old bugs. Here is what is confirmed, the indicators, and what it means for defenders.
Critical
Citrix fixes 28 NetScaler ADC and Gateway flaws, a critical NetScaler Console auth bypass and client privilege escalation
On Thursday 12 November 2026 Cloud Software Group (Citrix) published four security bulletins. The largest covers NetScaler ADC and NetScaler Gateway: 28 flaws, nine of them critical (CVSS 4.0 9.3–9.5), and one – CVE-2026-120868 – affects every deployment in its default configuration. On top of that come an unauthenticated authentication bypass in NetScaler Console (9.4) and privilege escalation in the Secure Access client for Windows and Linux. The bulletins say nothing about exploitation. NetScaler sits at the network edge and is one of attackers' favourite targets, so we would patch now.
Critical
Firefox 160 fixes 99 flaws, 57 rated high and nine sandbox escapes - update ESR too
Mozilla shipped Firefox 160 on 10 November 2026, along with Firefox ESR 153.7 and 115.45. The Firefox 160 advisory alone lists 99 vulnerabilities, 57 of them rated high. Mozilla describes nine of those as sandbox escapes, meaning flaws that can break the isolation meant to keep a malicious page away from the operating system. There are no reports of exploitation so far. Here is what to update and how to check it across a fleet.
News
Microsoft: poisoned fine-tuning data and third-party checkpoints can turn a coding agent into an attacker's tool
On 12 November 2026 Microsoft Defender Research and the Microsoft AI Red Team published two studies on backdoors planted in coding agents during post-training. Roughly 1% poisoned examples was enough for a model to answer an everyday request - "create documentation for this project" - by downloading and running an attacker's script. While hunting through public datasets, Microsoft also found rows following the same pattern. This is research, not an observed attack, but it matters to anyone who fine-tunes agents or deploys third-party models.
Critical
MongoDB fixes a critical replication flaw that lets unauthenticated attackers crash servers and, in some conditions, run code
MongoDB disclosed CVE-2026-118383 on 10 November 2026, rated 9.5 under CVSS 4.0. The use-after-free bug sits in replication and is hit when a newly elected replica set primary finishes catching up. It can be triggered by unauthenticated requests and leads to a crash or, under certain conditions, arbitrary code execution. Standalone instances are not affected, and there are no reports of exploitation so far.
Patch available
Node.js fixes 16 flaws, including remote HTTP/2 server crashes and an HTTPS bug that leaks other connections' memory
The Node.js project shipped security releases for the 26.x, 24.x and 22.x lines on 11 November 2026. They fix 16 vulnerabilities, seven of them rated high. Most sit in the built-in HTTP/2 and TLS code: an unauthenticated client can crash a server and, on HTTPS under specific conditions, read memory belonging to other connections, including TLS private keys. There are no reports of exploitation so far. Here is which servers are exposed and what to do.
Actively exploited
Openwave Webtop Media Transcoder: an old document converter flaw is now exploited
Run Openwave Webtop webmail for your customers? Media Transcoder versions before 1.1.22.0 ignore the file type restrictions the administrator has set. The vendor has confirmed attacks and CISA added the flaw to its exploited list on 10 November, even though the vendor says the fixed release shipped back in December 2021.
Actively exploited
Operation Endgame takes down Gootloader, CastleRAT and StealC servers, recovers 6.4 million victim records
On 12 November 2026 Europol announced the latest Operation Endgame strike. Police and private-sector partners actioned 235 servers and 257 domains used by the Gootloader, CastleRAT and StealC malware and found more than 6 million stolen credentials in the seized infrastructure. The data is going to services that notify victims. Here is what the three malware families do, how to check whether you are a victim, and what WordPress site owners should do.
Critical
Red Hat Quay flaw lets attackers plant their own signing key and read or overwrite private container images
Red Hat disclosed a critical vulnerability in the Red Hat Quay container registry on 11 November 2026. CVE-2026-123710 (CVSS 3.1 9.8) lets an unauthenticated client install its own approved, non-expiring signing key and mint tokens for any repository, so it can read private images and replace tags. A second critical flaw, CVE-2026-110697 (9.9), lets a user steal robot account tokens from other organizations. As of 12 November Red Hat lists no fixed build for the first flaw and advises blocking the /keys endpoint now.
Actively exploited
ScreenConnect attacks on managed service providers: ConnectWise disables RMM+ extensions
Late on 11 November 2026 ConnectWise said it is investigating unauthorized access to certain partner ScreenConnect environments, mostly managed service providers (MSPs). Its working theory is that attackers abused third-party extensions from the RMM+ family, which can run remote commands, and used them to push their own remote-access clients into customer networks. ConnectWise says it has found no vulnerability in ScreenConnect itself.
News
SignDrop: public exploit for an unpatched Windows CLFS driver flaw grants SYSTEM privileges
On 12 November 2026 researcher Abdelhamid Naceri (Nightmare Eclipse) published a proof-of-concept exploit called SignDrop on GitHub. It abuses a flaw in the Common Log File System driver (clfs.sys) – specifically in the protection Microsoft added to CLFS because of earlier attacks. According to the author, a standard user or malware on the machine can gain SYSTEM privileges. There is no fix, no CVE and no statement from Microsoft yet. Here is what it means for Windows admins.
Critical
Synology DSM fixes a critical Auth API SQL injection and an rsync authentication bypass
Synology published advisory Synology-SA-26:19 on 10 November 2026 with a DSM update for its NAS devices. The most severe flaw, CVE-2026-76954 (CVSS 9.8), is an SQL injection in the Auth API that lets an unauthenticated attacker read and write arbitrary files. A second flaw, CVE-2026-85101 (CVSS 8.6), bypasses authentication in rsync. DSM 7.2.1 through 7.4 are affected. There are no reports of exploitation so far, but Synology NAS devices are a frequent ransomware target. Here is which build to install and how to confirm your device is patched.
Actively exploited
wfx-loot: attacker uses stolen GitHub tokens to plant a CI secret stealer in thousands of repositories
On 12 November 2026 researchers at Aikido Security and StepSecurity described a campaign that has been abusing stolen GitHub tokens since 10 November. From nearly 5,000 accounts the attacker opened more than 60,000 probe pull requests, then pushed a script that drains GitHub Actions secrets and cloud credentials into every repository the token could write to - and wiped the traces afterwards. Here is how to tell whether you are affected, the indicators, and what to do right now.
Critical
Adobe Connect and Experience Manager: November fixes include five CVSS 10.0 flaws
On Tuesday 10 November 2026 Adobe shipped security updates for its Adobe Connect webinar platform (24 flaws, 17 Critical) and for Adobe Experience Manager (14 flaws, four Critical). Five of the Connect flaws carry the maximum CVSS score of 10.0 and can be exploited over the network without signing in. Adobe says it is not aware of exploitation. If you run Connect on your own server or AEM 6.5, update soon.
Actively exploited
Citrus ransomware gets in through contractor accounts and spreads Sn00py by Group Policy
On 11 November 2026 Kaspersky described Citrus, a previously undocumented Russian-speaking ransomware group. It logged in with low-privilege contractor accounts, hid its traffic in VLESS tunnels disguised as Yandex, impersonated a domain controller through an AD CS flaw patched in July and finally pushed its Go-based Sn00py encryptor to the whole domain through Group Policy.
Critical
Fortinet patches four critical flaws: FortiOS OSPF, FortiManager FGFM, FortiAnalyzer and FortiAuthenticator
On Tuesday 10 November 2026 Fortinet published at least 50 security advisories in one go. Four are rated Critical: an authentication bypass in the FortiOS OSPF daemon, unauthenticated code execution over the FGFM protocol in FortiManager, cross-VDOM access in FortiManager and FortiAnalyzer, and a hard-coded password in FortiAuthenticator. Fortinet says none is known to be exploited. All four were found by its own product security team with the help of an AI model. Here is what to patch, and in what order.
Actively exploited
IBM Aspera Faspex: an authorization flaw hands users full admin rights, and it is already exploited
Use IBM Aspera Faspex 5 to move large files? On 7 November 2026 IBM fixed CVE-2026-123218, which lets an ordinary signed-in user take full administrative control. Two days later CISA added it to its list of known exploited vulnerabilities and gave US federal agencies only until 12 November to fix it.
Critical
Ivanti patches 13 flaws: critical SQL injection in Endpoint Manager and missing authentication in CSA
On Tuesday 10 November 2026 Ivanti shipped fixes for five products: Endpoint Manager (EPM), Cloud Services Application (CSA), Endpoint Manager Mobile (EPMM), Sentry and User Workspace Manager. Two of the 13 flaws are critical, and both can be exploited without logging in: a SQL injection in the EPM Core that leads to code execution, and missing authentication in CSA that lets anyone add or delete trusted EPM Core certificates. Ivanti says none is known to be exploited. Here is what to patch first.
News
Lazarus: Microsoft shows an AI agent can be backdoored by editing fewer than ten neurons
On 10 November 2026 Microsoft Research and Microsoft Threat Intelligence published research on Lazarus, a technique that turns a capable agent model into a sleeper agent by reprogramming fewer than ten rarely used neurons – no training required. The model passes standard evaluations and only runs an attacker's command when a trigger appears. Microsoft has not seen it used in the wild, but the defences it recommends apply to anyone deploying third-party or fine-tuned models.
Actively exploited
AhsayCBS intrusion: attackers left webshells, a cryptominer and a Python implant on backup servers
On 9 November 2026 Huntress published a deep dive into an intrusion that hit three AhsayCBS backup servers through CVE-2026-105133 and CVE-2026-105134. The flaws have been public and patched since October 2026 and are listed in CISA's KEV catalog. What's new is what the attacker left behind: five webshell families, a cryptominer, a Python implant talking to an unidentified C2, tunneling tools and theft of Veeam credentials. Patching does not remove any of it.
Patch available
Apple fixes an iMessage flaw that let a remote attacker join group chats and read messages
On 9 November 2026 Apple shipped iOS 27.2.1, macOS Golden Gate 27.2.1 and updates for older systems. They fix a bug that could let a remote attacker join an iMessage group chat and receive its messages, along with several Bluetooth pairing flaws. Apple reports no exploitation, but this update is worth installing now.
Actively exploited
ARTEX: attackers let AI agents hunt GitHub secrets and hit financial firms
Microsoft (5 and 6 November 2026) and Check Point (5 November) have described real-world attacks run by the ARTEX agentic AI framework. Agents mine GitHub for leaked keys, go from those to Azure Key Vault secrets within minutes, and the Storm-3358 group has been using them against financial organisations since October. What to look for in your logs and how to defend.
Actively exploited
Attackers exploit a critical Xen Orchestra flaw to take over XCP-ng virtualization
On 10 November 2026 Vates published security advisory VSA-2026-062 for a critical flaw in Xen Orchestra, the web management console for XCP-ng. An unauthenticated attacker can make REST API requests as the owner of a valid login token, typically an administrator, and from there run code on managed XCP-ng hosts as root. Vates says a threat actor is already exploiting it. Fixed xo-server 5.213.1 and 5.211.2 shipped the same day.
Actively exploited
Barracuda Email Security Gateway: attackers are chaining two flaws to get root
On 9 November 2026 Barracuda updated its security advisory to say it has seen exploitation affecting a small number of organisations. Chaining an authorization bypass (CVE-2026-116606) with a command injection (CVE-2026-111560) can give an attacker root on the appliance. If you run a Barracuda ESG or another Barracuda appliance named in the advisory, check your patches now.
Actively exploited
Cisco BroadWorks: an August XXE flaw is now exploited, and attackers are stealing server private keys
Run Cisco BroadWorks? CVE-2026-20320 has been fixed since 19 August 2026, but CISA added it to its exploited list on 10 November. Malbear Labs has described an intrusion at a European telecoms provider in which the attacker used it to steal the server's private keys and certificates.
Actively exploited
CopperDragon supplies China-nexus spies with the Sparrow toolset
On 10 November 2026 Check Point Research published a year-long investigation into the Sparrow tool family and its likely developer, which it calls CopperDragon. According to CPR, several China-nexus espionage groups share the tools against telecoms, governments and the military – and one of the three campaigns it describes used compromised websites showing a fake Chrome certificate error.
Actively exploited
Fake ‘cracked software’ installers turn PCs into proxy and compute nodes
On 3 November 2026 Microsoft Threat Intelligence described a campaign that lures people to fake download pages for cracked software, game installers and activators. One run of the trojanized installer can quietly add proxyware, a BOINC-based compute client and adware, persisted through SYSTEM-level scheduled tasks. Here is what to look for on your endpoints.
Actively exploited
FreeSWITCH: one SIP MESSAGE is enough to run commands on your VoIP server
Run a PBX, contact centre or VoIP service built on FreeSWITCH? Check your version now. Attackers are already exploiting CVE-2026-116779, according to both the vendor and CISA, and the fix is in 1.11.3.
Actively exploited
Gorbag harvests data from frontline Ukrainian agencies with an old WinRAR flaw
On 3 November 2026 ESET Research published its analysis of Gorbag, a previously underreported Russia-aligned group. Since February 2025 it has sent targeted emails to Ukrainian justice and law enforcement bodies, border-area city councils and defence organisations. Since early 2026 it has also exploited WinRAR flaw CVE-2025-8088, which was patched back in July 2025.
Actively exploited
GPUStack: behind a same-host reverse proxy, anyone on the internet is admin
Running GPUStack to serve your own AI models? Check your version. Attackers are using CVE-2026-102895 to run code on GPU servers, and CISA added it to its exploited list on 9 November 2026 – even though the fix in version 2.2.0 shipped back in June 2026.
News
Haiou: a Codex “jailbreak” bundle quietly rewrites agent instructions to serve ads
On 3 November 2026 Check Point Research described Haiou, a freely shared bundle that strips guardrails from OpenAI's Codex coding agent and also writes an advert for a third-party LLM gateway into the agent's global instructions. There is no malicious binary – just plain-text instructions that conventional security tools don't look at. What it means for organisations whose developers use AI agents, and what to check.
Actively exploited
Chrome zero-day CVE-2026-125350 is being exploited – update to Chrome 157 now
Google released Chrome 157 on 9 November 2026 and says an exploit for one of the fixed flaws, CVE-2026-125350, already exists in the wild. If you use or manage Chrome, make sure it has updated and restarted.
Critical
Langflow: two critical no-login flaws, fixed in version 1.13.0
Building AI agents and apps with Langflow? Check your version. On 28 October 2026 IBM published fixes for four flaws in versions 1.0.0 to 1.12.8. Two are critical (CVSS 9.8), and IBM says a remote attacker can exploit them without logging in. The fix is in version 1.13.0, and IBM offers no workaround.
Actively exploited
N-central: 4EverAble2Shell exploited in the wild, even on HF2-patched servers
On 9 November 2026 a researcher published “Able2Shell”, a GitHub repository with 33 vulnerabilities and proof-of-concept exploits for the N-able N-central RMM platform. N-able took its hosted N-central environments offline as a precaution and told on-premises customers to keep their servers offline until a hotfix ships. The 2026.4 HF2 hotfix shipped on 10 November, and N-able now reports scanning tied to the public exploits. On 12 November the researcher added a new chain, 4EverAble2Shell, that still works against HF2 when the Legacy API is enabled, and within hours attackers were using it to install cryptominers. If you are an MSP or run N-central in-house, here is what to do now.
Actively exploited
Patch Tuesday November 2026: exploited Outlook flaw and critical Windows bugs
Microsoft shipped its November security updates on 10 November 2026. One flaw is already being exploited: CVE-2026-124194 in Outlook lets an attacker capture the NTLMv2 hash of a user who opens a crafted message file. The release also fixes critical CVSS 9.8 bugs in Windows LDAP and Windows Search.
Actively exploited
Railway details how an attacker got from a build server to decrypted customer secrets
Cloud hosting platform Railway published a detailed report on 10 November 2026 about the attack it suffered on 20 and 21 October. The attacker broke out of a build server's isolation, used a misconfigured OIDC binding to reach a credential that decrypts environment variables, and, by Railway's estimate, burned through roughly $740,000 of AI usage with the stolen keys. What is known, who is affected and what customers should do.
Critical
Ruby on Rails fixes 21 flaws – a crafted image upload can make ImageMagick write and read server files
On 4 November 2026 the Ruby on Rails team shipped security releases 8.1.4.1 and 8.0.5.2, fixing 21 vulnerabilities. The worst is in Active Storage, the part of Rails that handles file uploads: an app that analyses images with ImageMagick can let an unauthenticated attacker write files on the server and, in common setups, read them – secret keys included.
Critical
SAP Security Patch Day November 2026: four flaws with a perfect CVSS 10 score
On Tuesday 10 November 2026 SAP released 35 new security notes, nine of them Critical. Four flaws carry the maximum CVSS score of 10.0 and sit in core SAP components: the Internet Communication Manager, Web Dispatcher, SAP Gateway and SAML sign-in. SAP has not reported exploitation so far. If you run SAP NetWeaver or S/4HANA, schedule the kernel and SAP_BASIS updates as soon as you can.
Actively exploited
Turla's new Cereal toolset hides inside Exchange to steal government email
On 10 November 2026 ESET Research described Cereal, a previously undocumented modular toolset that it attributes to the Russia-aligned Turla group with high confidence. It sat on Exchange servers of national government bodies in Kazakhstan and Romania, filtered mail inside the transport service and took commands through ordinary-looking HTTPS requests – with no external command server at all.
Critical
Android November 2026 security update fixes critical zero-click flaws
Google's November Android security bulletin fixes three critical bugs that could let an attacker run code on a phone without the owner tapping anything. Google doesn't report any exploitation so far. Check that your phone shows a security patch level of 5 November 2026 or later.
Actively exploited
Ivanti Connect Secure: attackers chain three flaws to take over the VPN gateway
If your organisation uses Ivanti Connect Secure for remote access, check its version now. All three flaws in this chain are in CISA's catalog of exploited vulnerabilities, the attacks began on a gateway that was fully patched at the time, and Ivanti's own Integrity Checker missed them.
Actively exploited
Magento and Adobe Commerce: attackers exploit the PolyShell flaw
If you run an online store on Magento Open Source or Adobe Commerce, check that the July patch APSB26-73 is installed – and then check whether someone got in before you patched. CISA says CVE-2026-48356, nicknamed PolyShell, is being exploited to plant webshells and inject scripts into storefronts.
Actively exploited
OpenSSH on Alpine Linux: attackers can log in over SSH without knowing the password
Run servers, VMs or containers on Alpine Linux with an SSH server? Check your openssh package. Under certain conditions, CVE-2026-123158 lets anyone in who sends a long enough password. OpenSSH and Alpine shipped fixes on 5 November 2026, and attackers have been exploiting it since 7 November.
Critical
Ransomware is hitting Synology NAS devices on outdated DSM: update now
Got a Synology NAS at home or in the office? Attackers are encrypting data on devices running old DiskStation Manager (DSM) releases and demanding a ransom. They're exploiting a flaw Synology fixed back in late 2024. Check your DSM version and update.
Actively exploited
SonicWall SSLVPN CVE-2026-19868: attackers bypass SAML login and MFA
If your organisation runs SSLVPN on a SonicWall firewall with SAML sign-in, check your SonicOS version today. CISA says CVE-2026-19868 is already being exploited, and it lets an attacker with a valid password skip the SAML step – and the MFA that comes with it.
Actively exploited
WordPress: attackers exploit a flaw in the core update process
Run a WordPress site? CVE-2026-119977 lets an attacker with no account run code on your server while WordPress is updating itself, and CISA says it is being exploited. WordPress fixed it on 28 October 2026 in version 7.1.4 and in security releases for older branches.