Marimo version 0.20.4 is associated with a remote code execution (RCE) vulnerability identified as CVE-2026-39987. The available information is limited, with no detailed technical data or patch information provided.
FreePBX version 17.0.2 is affected by a remote code execution (RCE) vulnerability. This flaw allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects Linux systems running Debian or Ubuntu with Asterisk. No specific affected sub-versions or patch information is provided.
A remote code execution (RCE) vulnerability identified as CVE-2026-86060 affects MikroTik RouterOS versions 7.0 up to but not including 7.23.4, and versions 7.24.0 up to but not including 7.24.2. Exploit code leveraging this vulnerability is publicly available, involving MikroTik CHR 7.23.3 (x86_64) and Python3-paramiko on Kali Linux 2025.x. No official patch or vendor advisory details are provided.
A path traversal vulnerability affects WordPress version 7.0.2 and version 7.0.6, as well as versions prior to 7.1.2. This vulnerability could allow an attacker to access files outside the intended directory structure.
CVE-2026-9198 is a published vulnerability with no additional technical details, CVSS score, or known exploits currently available. No affected software versions or patch information have been provided.
A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.
In October 2026, Citrix NetScaler ADC appliances running affected 14.1 builds were compromised through a chain of two vulnerabilities: CVE-2026-88771 and CVE-2026-88779. Attackers achieved root code execution by exploiting a pre-authentication log-poisoning/RCE vulnerability and a SAML-parsing crash. The intrusion involved deploying PHP web shells, modifying system shells, creating cron jobs, and establishing boot hooks for persistence. Additional tools included TCP session managers, HTTP tunnels, and reverse agents for command-and-control. Attackers used a Go-based reconnaissance tool to map internal infrastructure and synchronized implants across appliance pairs to maintain persistence. The campaign exfiltrated NetScaler configurations, historical data, and key material, evolving from initial access to a persistent internal reconnaissance platform.
CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support versions 26.2.3 and earlier. It enables unauthenticated remote attackers to perform arbitrary file operations without user interaction. Exploitation in the wild has been confirmed, involving deployment of web shells and tunneling tools, root privilege escalation, credential vault extraction attempts, persistence mechanisms, and log deletion. The threat actor ARMORY CASTLE, linked to PRC-nexus espionage, is attributed to these attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities list. Emergency patching and thorough compromise investigations are required, as patching alone does not remove attacker persistence.
A DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center version 3.5.8.7 is actively exploited by attackers distributing a genuine signed application with malicious DLLs via unofficial channels. The vulnerable software loads attacker-supplied DLLs without validation, enabling code execution. The attack uses ClickFix social engineering to trick users into running commands. Version 4.0.9.8 patches the vulnerability with automatic updates applied on restart. No official Siemens systems or distribution channels were compromised during this campaign.
CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS affecting GlobalProtect portal and gateway components. Exploitation allows unauthorized attackers to establish VPN connections without valid credentials. Ransomware groups such as Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra actively exploit this flaw to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Attackers also pivot to virtualization infrastructure by accessing vCenter management appliances, disabling ESXi hypervisor security controls, and performing offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
BlueHammer (CVE-2026-33825) is a local privilege escalation chain targeting Windows Defender Antimalware Platform versions before 4.18.26030.3011. It requires initial code execution as a standard user and uses a series of legitimate Windows mechanisms to escalate privileges to NT AUTHORITY\SYSTEM. The exploit freezes the MsMpEng.exe process via CloudFilter manipulation and stages malicious update files. Laboratory tests demonstrated successful privilege escalation, recovery of domain-admin credentials from LSASS, and lateral movement using pass-the-hash techniques to compromise domain controllers. Exploitability depends on runtime factors such as pending signature updates, Defender state, filter drivers, VSS, and CloudFilter reachability. No known exploits are reported in the wild, and no patch information is provided.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
A critical remote code execution vulnerability (CVE-2026-109618) affects PHP versions prior to 8.3.36-1.oe2403sp3. The flaw arises from improper handling of out-of-memory errors using longjmp(), which can leave request memory uninitialized and lead to execution of arbitrary code. Additionally, related global state management issues (CVE-2026-109619) can cause stale pointers to freed memory, further enabling remote code execution. This vulnerability impacts PHP's mod_php module used with Apache HTTP Server. A security fix is available to address these issues.