Panchan is a peer-to-peer crypto mining worm first identified in 2022 that propagates by stealing SSH keys and using a rootkit to maintain persistence. It targets insecure internet-facing servers, especially those with exposed SSH services lacking proper access controls. The worm uses a Discord channel as its command-and-control server and can pivot to other hosts by leveraging stolen SSH credentials. Indicators of compromise include repeated failed SSH login attempts, unusual resource usage, hidden directories with high-entropy names, and network traffic to Discord. Mitigations include implementing egress and ingress filtering, access control lists, multi-factor authentication for SSH, disabling root login, using SSH key management solutions like HashiCorp Vault, and deploying firewalls and intrusion detection/prevention systems. Monitoring via SIEM solutions is recommended for scalable detection. Systems with strong security controls are not vulnerable to this worm.
BMC Helix Network Management on-premises versions 26.3.00 prior to 26.3.01 contain a critical authentication bypass vulnerability. When SAML single sign-on is configured, unauthenticated attackers can log in as the local administrator using any password. This allows attackers to gain SuperAdmin privileges, enabling them to modify device credentials, execute device commands, and alter audit records.
Leantime versions prior to 3.10.0 contain a critical vulnerability allowing any authenticated user, including those with the lowest privilege (readonly), to escalate to full administrative access via unauthorized JSON-RPC methods. This occurs because certain JSON-RPC service methods lack proper per-method authorization checks, enabling privilege escalation and unauthorized plugin management. The vulnerability allows creation of admin accounts without authorization and bypasses web UI role checks. A proof-of-concept demonstrates full admin access gained from a low-privilege session. The CVSS 3.1 score is 8.8 (high severity). A patch is available.
A persistent cross-site scripting (XSS) vulnerability exists in GYM One gym management software versions prior to 1.4.1. The vulnerability occurs because the admin/users/index.php page renders user profile fields (firstname, lastname, email) without proper HTML encoding. An attacker able to store malicious script code in these fields can execute arbitrary scripts in an administrator's browser when they view the user list, potentially compromising administrator session data and privileges. This issue is fixed in version 1.4.1.
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
CVE-2026-62679 is a path traversal vulnerability in Lychee, a photo-management tool, affecting versions prior to 7.6.4. Under a specific non-default configuration, authenticated users can exploit improper pathname limitation to read files accessible to the web process, including sensitive application configuration and other users' private images. The vulnerability is fixed in version 7.6.4.
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
CVE-2026-61610 is an improper access control vulnerability in Lychee, an open-source photo-management tool. Prior to version 7.6.1, when the photos_star_visibility setting is configured to anonymous, unauthenticated attackers can fetch and modify photos without proper authorization checks. This allows attackers to identify private photos by response differences and change their highlight status, even for photos in private or password-protected albums. The vulnerability is limited to installations using the non-default anonymous star-visibility setting. The issue is fixed in version 7.6.1.
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.
CVE-2026-57568 is a cross-site scripting (XSS) vulnerability in Lychee, an open-source photo-management tool. Versions prior to 7.6.0 allow authenticated users with album-edit permissions to inject JavaScript URIs in album or photo Markdown descriptions due to unsafe link allowance. This malicious script is rendered and executed when a visitor, including unauthenticated users, clicks the link in a public album. The vulnerability can lead to session data exposure or unauthorized authenticated requests in the victim's browser context. This issue is fixed in Lychee version 7.6.0.
CVE-2026-85634 is a path traversal vulnerability in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library used by WildFly and JBoss EAP, affecting Red Hat Fuse 7. An attacker with the Deployer RBAC role can exploit this flaw by supplying unsanitized deployment names containing path traversal sequences to access files outside the restricted deployment directory. This can lead to deletion of arbitrary directories or creation of files with arbitrary content, enabling full privilege escalation to the management SuperUser role. No mitigation or patch is currently available that meets Red Hat's criteria for ease of use and applicability.
Debezium is a distributed platform that turns your existing databases into event streams, so applications can see and respond immediately to each row-level change in the databases.
Debezium is built on top of Apache Kafka and provides Kafka Connect compatible connectors that monitor specific database management systems. Debezium records the history of data changes in Kafka logs, from where your application consumes them. This makes it possible for your application to easily consume all of the events correctly and completely. Even if your application stops unexpectedly, it will not miss anything: when the application restarts, it will resume consuming the events where it left off.
This content discusses the capabilities and limitations of AI-driven penetration testing compared to human pentesters. It highlights that AI pentesting can discover vulnerabilities missed by humans, especially complex issues that do not fit strict testing methodologies. However, AI lacks the ability to ask clarifying questions or fully understand business context, which can affect risk assessment and scope management. The article emphasizes that neither AI nor human pentesters find all vulnerabilities consistently, and that AI excels in detailed source code analysis and remediation guidance. The content is an analysis of AI pentesting technology rather than a specific security vulnerability or threat.
CVE-2026-8145 is a medium severity vulnerability in the WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices for WordPress. It allows unauthenticated attackers to register as any existing WholesaleX role due to missing validation on the 'wholesalex_registration_role' parameter in the 'process_registration' function. This improper privilege management affects all versions up to and including 3.0.8. A partial patch was introduced in version 2.3.8, but versions up to 3.0.8 remain vulnerable.
CikaBika Bot is a Rust-based Remote Access Trojan (RAT) distributed via phishing emails containing malicious document-themed lures. It uses Discord channels for command-and-control (C&C) communications and provides attackers with capabilities including system reconnaissance, remote command execution, process management, file upload/download, and surveillance functions such as screenshots and camera streaming. The malware employs a multi-stage infection chain involving a decoy document, PowerShell scripts, and DLL sideloading to evade detection and bypass User Account Control (UAC). Data exfiltration is facilitated through Ngrok tunnels. The malware leverages legitimate services like Discord and Ngrok to mask its operations.
Microsoft fixed a known issue causing black screens, desktop loading problems, and Windows Explorer crashes after installing Windows 11 updates released since August 2026. The problem primarily affected Azure Virtual Desktop hosts using FSLogix for profile management. Microsoft released cumulative updates on October 13, 2026, that resolve the issue. A temporary workaround involves manually launching Windows Explorer via Task Manager. Enterprise customers can also apply Known Issue Rollback group policies to mitigate the problem until the update is installed.
CVE-2026-16437 is a high-severity vulnerability in Mitsubishi Electric Corporation GENESIS and related products. It involves a weak password recovery mechanism that allows an authenticated local administrator to tamper with the management file storing the challenge response. This file is protected by Windows, but administrators can read and write it, enabling potential disclosure, tampering, destruction, or deletion of internal information, or causing a denial-of-service condition. The vulnerability affects multiple GENESIS product versions and related software. A patch is available to address this issue.