A critical vulnerability in WordPress, identified as CVE-2026-87902, is currently being exploited by hackers. Initially, attackers were probing for sites that were vulnerable, but they have now escalated to exploiting the flaw to write files to disk that can execute shell commands when accessed. This puts numerous WordPress installations at risk, particularly those running outdated or unpatched versions of the software. Users and website administrators need to take this threat seriously, as the exploitation can lead to unauthorized access and control over affected sites. This situation underscores the importance of timely updates and security measures in maintaining website integrity.
Researchers have identified a serious vulnerability affecting MikroTik routers that allows attackers to gain full administrative control without needing a password or SSH key. Known as the MikroTrick chain, this issue arises from two flaws in the RouterOS software: an SSH state-machine vulnerability (CVE-2026-67279) and an argument-injection bug in the login process (CVE-2026-86060). These vulnerabilities can be exploited on routers that are exposed to the internet, putting numerous devices at risk. Users of MikroTik routers should take immediate action to secure their devices, as the potential for unauthorized access could lead to significant data breaches or network disruptions.
In the first half of 2026, the United Arab Emirates and Saudi Arabia faced a significant increase in cyberattacks, accounting for half of all incidents reported in the Gulf region. These attacks have become more complex, posing serious challenges for cybersecurity teams in both countries. The rise in incidents affects various sectors, raising concerns about the security of sensitive data and critical infrastructure. This situation highlights the urgent need for enhanced cybersecurity measures and collaboration among nations to combat these evolving threats. The implications of these attacks could be far-reaching, affecting not only businesses but also national security and public trust in digital systems.
A recent security analysis reveals that a Kubernetes user with limited permissions can exploit a flaw in Google Kubernetes Config Connector to gain control over an entire Google Cloud organization. This issue stems from a confused deputy problem, where the permissions granted to the Config Connector can be misused through a single Kubernetes YAML file. This vulnerability poses a significant risk because it allows unauthorized users to escalate their privileges and potentially compromise sensitive resources across the organization. Organizations using Google Cloud and Kubernetes need to be aware of this risk and take measures to secure their configurations. The implications of such a breach could be severe, affecting data integrity and access control.
Threat actors have compromised two legitimate MemTensor packages on the npm and PyPI repositories to distribute a malicious program called sckit. This implant targets Windows, Linux, and macOS systems and is designed to steal credentials. Researchers from Aikido, SafeDep, Socket, and StepSecurity have reported on the affected libraries, particularly the @memtensor/memos-cloud-openclaw-plugin versions. This incident raises significant security concerns for developers and users who may have unknowingly installed these compromised packages. It's crucial for affected users to take immediate action to safeguard their systems.
Arista Networks has addressed a zero-day vulnerability in the VeloCloud Orchestrator (VCO) On-Prem deployments, which is currently being exploited by attackers. This flaw poses a significant risk, as it allows unauthorized access to the system, potentially compromising sensitive data and network operations. Users of the VCO should apply the security patches released by Arista immediately to protect their systems. The urgency of this patching process is underscored by the fact that the vulnerability is actively being exploited in the wild. Organizations relying on VeloCloud Orchestrator must prioritize this update to mitigate the risk of an attack and safeguard their network infrastructure.
A new vulnerability in cPanel's CalDAV and CardDAV service allows anyone with a cPanel hosting account to execute code with root privileges, giving them full control of the server. This serious flaw was disclosed on September 22 and affects users who rely on cPanel for their web hosting services. Additionally, a separate issue in the WP Toolkit plugin enables account holders to modify databases belonging to other users, raising further security concerns. cPanel has responded by releasing fixed versions to address both vulnerabilities, underscoring the need for users to update their systems promptly to prevent potential exploitation.
A recently discovered flaw in the Linux kernel's AF_UNIX socket subsystem poses a significant risk to Ubuntu users running versions 22.04, 24.04, and 26.04 LTS. The vulnerability, identified as CVE-2026-80521, allows attackers to escape from a container environment and gain root access to the host system. Although the issue was patched upstream on August 6, the fixes have not yet been implemented in the affected Ubuntu releases. This situation creates a window of opportunity for potential exploitation, which could lead to serious security breaches for users running these versions. Organizations relying on these Ubuntu LTS releases should take immediate action to safeguard their systems.
Arista Networks has issued an urgent warning about a critical security flaw in its Virtual Cloud Optimizer (VCO) software that allows remote attackers to access sensitive internal features. This vulnerability poses a significant risk as it could enable unauthorized users to exploit internal functionalities, potentially leading to serious breaches. Companies using VCO are advised to act quickly to patch this vulnerability to prevent exploitation. The situation is serious, as the flaw is already being actively exploited in the wild, increasing the urgency for affected users to secure their systems. Prompt remediation is crucial to safeguard sensitive data and maintain operational integrity.
F5 Networks has reported a serious vulnerability in its BIG-IP Access Policy Manager (APM) that allows attackers to execute arbitrary code on systems without authentication. This flaw, identified as CVE-2026-94127, specifically impacts systems where APM functions as an OAuth authorization server, which is responsible for generating access tokens for applications. F5 disclosed this issue on September 22, 2023, and has since released hotfixes to address the vulnerability. Organizations using affected versions of BIG-IP APM are urged to apply these updates promptly to protect against potential exploitation. The situation is critical as attackers are actively taking advantage of this flaw, posing significant risks to the security of OAuth servers.
A Chinese hacking group known as UTA0565 has been exploiting a recently discovered exploit chain affecting Google Chrome and Microsoft Windows. The attacks, which took place on September 3 and 4, 2026, take advantage of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one in Windows (CVE-2026-85880). By using fake websites, the attackers are able to deploy a malware variant named CLEANGULP. This is concerning as it indicates a coordinated effort to target users of these widely-used platforms, potentially compromising sensitive information and system integrity. Users of both Chrome and Windows should be vigilant and consider updating their systems promptly to mitigate the risks associated with these vulnerabilities.
An Armenian man was sentenced to 24 months in prison for his role in Ryuk ransomware attacks, which targeted U.S. companies by encrypting their computer systems and demanding ransom payments. The individual was part of a larger criminal operation that exploited vulnerabilities in corporate networks, leading to significant disruptions and financial losses for the affected businesses. The case illustrates the ongoing threat posed by ransomware groups and the legal consequences that can follow cybercriminal activities. The sentencing serves as a warning to others involved in similar operations, emphasizing that law enforcement is actively pursuing those who engage in such cybercrimes. This incident also highlights the need for companies to bolster their cybersecurity measures to defend against these types of attacks.
F5 Networks has issued urgent security updates to fix a serious vulnerability in its BIG-IP APM (Access Policy Manager) product. This zero-day flaw allows attackers to execute remote code, which means they can potentially take control of affected systems. The vulnerability is actively being exploited in the wild, posing a significant risk to organizations using the software. Users of BIG-IP APM are advised to apply the patches immediately to safeguard their systems. Without these updates, organizations remain vulnerable to exploitation, which could lead to data breaches or unauthorized access to sensitive information.
A vulnerability in Next.js, a popular framework for building web applications, could allow attackers to execute arbitrary code on servers through its ImageResponse feature. This issue arises when user-controlled values, such as text from the request URL, are incorporated into generated images. Vercel, the company behind Next.js, announced the fix for this flaw on September 22, 2023, in a new software version. This vulnerability is particularly concerning for developers who might inadvertently expose their applications to risks by improperly handling user input. It’s crucial for users of Next.js to update to the latest version to mitigate potential exploitation.
Security researchers have discovered a method that allows attackers with privileged access to register a rogue external multi-factor authentication (MFA) provider. This malicious setup can capture users' passwords during legitimate login attempts, posing a significant risk to security. The attack exploits the trust users place in MFA systems, making them vulnerable to credential theft. Organizations that rely on MFA to protect user accounts need to be aware of this tactic, as it undermines the security benefits that MFA is supposed to provide. Users and companies alike must ensure that their MFA providers are legitimate and properly secured to prevent such attacks.