Latest security news

Researched & explained in plain language

What website owners should know right now

CVE-2026-59310: VMware vCenter Flaw Actively Abused for Persistence

Attackers actively exploit the critical vCenter flaw CVE-2026-59310 (CVSS 9.8) using a reverse_ssh cronjob, with 361 victims across 47 countries.

LiteLLM Supply Chain Attack Threatens Over 2,500 Organizations

Compromised LiteLLM versions 1.82.7 and 1.82.8 exposed API keys, cloud credentials, and 434,000 CI/CD pipelines. What to do now.

BdThemes Plugins: Supply-Chain Attack Creates Hidden WP Admins

Manipulated JSON responses injected rogue admins, web shells and MU-plugin backdoors into WordPress – over 100,000 installations affected.

Critical Adobe Flaws: ColdFusion, Campaign Classic and Commerce Hit

Adobe patches critical flaws in ColdFusion, Campaign Classic and Commerce – CVE-2026-48362 hits CVSS 10. Update immediately now.

SAP Commerce Cloud: CVSS 10 Flaw Enables Full Takeover

Critical vulnerability CVE-2026-58231 lets unauthenticated attackers execute code and take full control of SAP Commerce Cloud. Patch now!

WordPress 7.0.4 fixes critical RCE flaw in file uploads

WordPress 7.0.4 patches an RCE flaw: malicious uploads can be exploited via Imagick and Ghostscript from the Author role up. Update now.

XSS2Shell: WordPress Flaw Actively Exploited – Update to 7.0.3 Now

One crafted link is enough: with an admin logged in, XSS2Shell enables server takeover in WordPress. Attacks are underway – patch now.

Apache Tomcat: Actively Exploited Encryption Flaw (CVE-2026-34486)

CVE-2026-34486 in Apache Tomcat is being actively exploited: attackers bypass the EncryptInterceptor and intercept cluster data in plaintext.

42 Million Euro GDPR Fine: CNIL Penalizes Free After Data Breach

24M customer records with IBANs compromised: How weak VPN authentication earned Free a record-breaking GDPR fine.

LockBit 5.0: Linux Ransomware Encrypts Offline Without C2 Server

LockBit 5.0 attacks Linux systems fully offline with ChaCha20, evading network-based detection. Here's how to protect your servers.

Defcon 2026: 401,796 Confidential Emails Intercepted via No-Reply Domains

Researchers intercepted 401,796 emails from 14,000 firms via bought no-reply domains. German companies are especially affected.

N-able N-central: Authentication Bypass CVE-2026-18577 Actively Exploited

CISA adds CVE-2026-18577 to the KEV catalog. Attackers exploit an authentication bypass to take over N-central servers. Patch available.