Threats tagged 'remote'

A new remote code execution (RCE) vulnerability (CVE-2026-115560) in PHP affects systems with a rare combination of configuration settings involving session serialization handlers and upload progress. No patch is currently available. The PHP security team recommends disabling session upload progress as a mitigation. This vulnerability is distinct from recently patched critical PHP2Shell RCE flaws. Exploitation requires unusual runtime changes to session serialization handlers, making it unlikely in typical deployments.

A critical heap-based buffer overflow vulnerability in NoMachine nxwebrunner allows remote attackers to execute arbitrary code without authentication. The vulnerability is assigned CVE-2026-114549 and has a CVSS rating of 9.8 by the Zero Day Initiative. No patch or affected versions are specified in the available data.

A remote code execution vulnerability exists in NVIDIA Megatron Bridge due to unsafe YAML file parsing that allows code injection. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is assigned CVE-2026-24250 and has a high severity rating.

A stack-based buffer overflow vulnerability in Cisco Snort's OLE VBA decompression component allows remote attackers to execute arbitrary code without authentication. The vulnerability is identified as CVE-2026-20218 and has a high severity rating with a CVSS score assigned by ZDI of 8.1. No affected versions or patch information are provided in the available data.

Two critical unauthenticated remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP core versions since 5.4. These flaws, collectively dubbed “php2shell,” can be triggered by a plain HTTP request before any application code runs. The vulnerabilities arise from improper handling of out-of-memory conditions and use-after-free stale internal states. The impact spans the entire PHP ecosystem, including popular applications like WordPress, Drupal, Magento, and others. PHP 8.1 and older versions are end-of-life and will not receive patches, while PHP 8.2 support ends December 31, 2026. No active exploitation has been observed as of October 21, 2026. Cisco Talos recommends immediate upgrading to fixed releases and provides intrusion prevention signatures for detection. Some configuration mitigations may reduce exposure but do not fully protect against these vulnerabilities.

Bulletin ID: 2026-054-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/14/2026 13:00 PM PDT Description: AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. We identified CVE-2026-15643, a server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint via a crafted next_token parameter. The server does not validate that pagination URLs point back to the expected HealthLake endpoint, allowing an actor to redirect subsequent requests to an actor-controlled server. Impacted versions: < 0.0.14 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions: >=1.0.3 AND <=1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-051-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/01/2026 12:45 PM PDT Description: The AWS Advanced JDBC Wrapper is an open-source JDBC driver wrapper that extends a JDBC driver to enable Amazon Aurora and AWS Cloud features such as failover handling and caching. We identified CVE-2026-14265, an issue in the RemoteQueryCachePlugin of the AWS Advanced JDBC Wrapper. When this plugin is enabled, query results read from the shared Redis/Valkey cache are deserialized without class filtering. An actor with write access to the shared cache infrastructure could insert a crafted serialized Java object that, when read by an application, results in execution of arbitrary code on the application server. Impacted versions: >=3.3.0 AND <=4.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

This content discusses cybersecurity challenges faced by small and medium-sized businesses (SMBs), focusing on vulnerabilities in people, processes, and technology that can lead to cyberattacks. It highlights how attackers exploit gaps such as unpatched software, insufficient employee training, and inadequate protection of cloud infrastructure. A real-world case study describes an ERP system breach during cloud migration, where attackers used phishing and exploited unpatched vulnerabilities to gain administrator access and steal confidential data. The article emphasizes the importance of targeted employee training, structured patch management, and appropriate technological defenses to mitigate risks.

F5 and Juniper Networks have released patches for multiple critical vulnerabilities affecting their products, including remote code execution (RCE) flaws that could allow unauthenticated attackers to take full control of affected devices. The vulnerabilities include buffer overflows, memory corruption, and other issues that may lead to device crashes or complete takeover. No exploitation in the wild has been reported. These patches address dozens of security defects across NGINX, Junos OS, Junos OS Evolved, and Juniper Cloud-Native Router.

CikaBika Bot is a Rust-based Remote Access Trojan (RAT) distributed via phishing emails containing malicious document-themed lures. It uses Discord channels for command-and-control (C&C) communications and provides attackers with capabilities including system reconnaissance, remote command execution, process management, file upload/download, and surveillance functions such as screenshots and camera streaming. The malware employs a multi-stage infection chain involving a decoy document, PowerShell scripts, and DLL sideloading to evade detection and bypass User Account Control (UAC). Data exfiltration is facilitated through Ngrok tunnels. The malware leverages legitimate services like Discord and Ngrok to mask its operations.

A zero-day vulnerability (CVE-2026-0322) in Palo Alto Networks PAN-OS has been exploited for remote code execution. The flaw affects the management interface of PAN-OS on PA-Series, VM-Series firewalls, and Panorama, allowing an authenticated attacker with network access to execute arbitrary code with root privileges. Palo Alto Networks has released patches and indicators of compromise (IoCs) related to limited observed exploitation. CISA has added this vulnerability to its KEV catalog, urging federal agencies to address it promptly.

Microsoft's October 2026 Patch Tuesday includes security updates addressing 1415 vulnerabilities across multiple products, with 85 marked as critical. Among these, 67 are remote code execution vulnerabilities. One vulnerability, CVE-2026-96951, a security feature bypass in Windows Shell involving command injection, has been exploited in the wild. Other notable vulnerabilities affect Windows Active Directory Domain Services, Microsoft Exchange Server, Windows Hyper-V, Microsoft Office Excel, Microsoft QUIC, and various Windows components. The vulnerabilities have CVSS base scores ranging from 7.0 to 9.8, indicating high severity. Microsoft has released patches for these issues as part of the monthly update cycle.

Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that allows attackers with upload access to execute arbitrary JavaScript in an administrator's browser. This can lead to theft of administrator authentication tokens and unauthorized access to the Shopware Administration API. If the compromised administrator has extension management privileges, attackers can upload and activate malicious plugins to achieve remote code execution on the server. No vendor patch or statement is currently available. Mitigation involves restricting media upload access to trusted users or disabling HTML file uploads.

Ivanti Connect Secure (ICS) remote access gateway is affected by a high-severity zero-day vulnerability (CVE-2026-104935) that allows authentication bypass and remote code execution without user interaction. The vulnerability affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Threat actors have exploited this flaw in the wild since at least October 1, 2026, chaining it with other vulnerabilities to achieve unauthenticated root-level code execution. Ivanti has released patches for some related flaws and is working on addressing a privilege escalation vulnerability used in the attack chain. Customers are urged to immediately apply available patches and use the Integrity Checker Tool to detect tampering.

Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities affecting file management, Smarty templating, module installation, and administrative workflows. These include remote code execution, server-side template injection, stored and reflected cross-site scripting, open redirect, and username enumeration. Exploitation requires authenticated administrative access for most issues, but some vulnerabilities enable unauthenticated attackers to enumerate valid admin usernames. No patch is currently available, and risk mitigation involves restricting administrative interface access and disabling or limiting certain features.

Citrix has issued an urgent warning for IT administrators to immediately patch a critical remote code execution (RCE) vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. The vulnerability allows remote attackers to execute arbitrary code on affected systems. No specific affected versions or patch details are provided in the available information. There is no confirmation of active exploitation in the wild at this time.

Cisco has released patches addressing 35 vulnerabilities across multiple products, including over a dozen critical issues. These vulnerabilities could allow unauthorized access, information leaks, privilege escalation, denial of service (DoS), and remote code execution. Notable affected components include Meraki, License On-Prem, NX-OS, Application Policy Infrastructure Controller (APIC), and Finesse. Cisco reports no known exploitation of these vulnerabilities in the wild. The company has provided security advisories with patches to remediate these issues.

A high-severity vulnerability (CVE-2026-88779) affects Citrix NetScaler ADC and NetScaler Gateway products, including their FIPS variants. Multiple versions prior to 14.1-73.41, 13.1-64.28, and 13.1-37.282 are impacted. The vulnerability is publicly known but no confirmed exploits have been observed in the wild. No patch or remediation information is currently available.