GTIG Counts 141 Exploited Flaws as CVE Disclosures Double
GTIG recorded 141 disclosed and exploited vulnerabilities through August 2026. Prioritize reachable edge systems and verify the access conditions on affected AI gateways.
Read article →appsec
Software vulnerabilities, dependencies, and application security.
CISA Flags Exploited SharePoint Code Injection for Authorized Users
Three on-premises SharePoint editions have affected build ranges. Match each server to its edition's update threshold and triage suspected compromise.
Read article →
ShinyHunters Bypass PeopleSoft WAF Rules and Plant Web Shells
An encoded request reaches PeopleSoft's vulnerable EMHub servlet past literal path filters. Patch PeopleTools and search every WebLogic node for encoded paths and new JSPs.
Read article →
Authlib accepts unsigned JWS payloads as verified
An empty signatures array skips Authlib's verification loop. Locate callers of the JSON JWS deserializer and reject unsigned input before trusting its payload.
Read article →
Mandiant Details How Shared CI Caches Expose Release Builds
A pull request can plant dependencies in a shared build cache for a privileged release job. Separate cache writes by branch privilege and constrain publishing identities.
Read article →
RubyDoc Builds Let Malicious Gems Run Code on Shared Servers
More than 100 malicious gems used RubyDoc documentation builds to execute supplied code. Maintainers should review package and account changes tied to legacy API keys.
Read article →
Attackers Exploit GitLab Flaw to Read Server Files Without a Login
An exploited GitLab flaw exposes arbitrary server files through the commits API. Self-managed operators should install 19.1.8, 19.2.6, or 19.3.2 immediately.
Read article →
Attackers Exploit Kestra Login Bypass That Reaches Root
Kestra OSS versions through 1.3.20 let unauthenticated requests create workflows and run commands as root inside workers. CISA confirms exploitation.
Read article →
Coder Registry Hack Sent Credential-Stealing Code to Developers
Attackers made Coder's trusted registry serve malicious Terraform modules. Operators have a 14-hour exposure window, concrete indicators, and urgent credential work.
Read article →
Public Telerik Exploit Lets Attackers Run Code on ASP.NET Servers
A public Telerik UI exploit chains two cryptographic oracles to unsafe type loading. Upgrade ASP.NET AJAX to 2026.2.708 and check IIS for post-exploit activity.
Read article →
Compromised npm Code Generator Steals Developer and Cloud Credentials
Ten malicious OpenAPI React Query Codegen releases ran on install and carried credential-stealing code with valid provenance. Teams must scope lockfiles, rebuild hosts and rotate credentials.
Read article →
LiteLLM Flaw Lets Read-Only Accounts Steal AI Gateway Secrets
Zenity saw file-read probes matching CVE-2026-35029. LiteLLM advises upgrading to 1.83.0 or later; defenders should hunt configuration changes and rotate exposed secrets.
Read article →
Magento Zero-Day Lets Attackers Backdoor Fully Patched Online Stores
StyleSmuggler turns poisoned Magento logs into server-side code execution, then hides a persistent implant outside the shop's webroot. Adobe has not issued a fix.
Read article →Showing 27–39 of 88