Drupal has fixed two critical vulnerabilities that could allow attackers to remotely execute code on websites running a supported version of the content management system. The security issues affect the Field UI module of the software kernel and the contributed Entity List module. Drupal issued a warning earlier this week, urging administrators to apply updates … Read more
Researchers warn that hackers could soon exploit a maximum severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce that could potentially allow them to execute arbitrary PHP code on store servers. According to e-commerce security firm Sansec, no attacks exploiting the vulnerability called BlockStrap have been observed so far, but threat actors are expected to find … Read more
XRP Ledger developers have defended an emergency security patch used to fix a bug capable of creating XRP outside the network’s fixed supply, saying they could not wait for the network’s usual two-week validation vote without disclosing the flaw to attackers. The fix, released on September 25, came three days after a bug bounty was … Read more
Cisco on Wednesday announced patches for 35 vulnerabilities in its products, including more than a dozen critical-severity bugs. A new security hardening release from Meraki fixes several bugs grouped into seven CVEs depending on the type of underlying vulnerability. The most serious of these is CVE-2026-76464, which covers memory issues such as buffer overflows and … Read more
Atlassian is warning customers about a critical vulnerability known as CVE-2026-21589 that can be exploited for arbitrary file access in several self-hosted data center products, including Confluence, Jira and Bitbucket. The security issue allows an unauthenticated attacker to access certain files in the web root of an affected application. However, exploitation requires knowledge of the … Read more
Fortra has released patches for eight vulnerabilities in the Core Privileged Access Manager (BoKS), including three critical severity bugs. BoKS provides organizations with centralized management of Unix and Linux fleets, enabling policy enforcement and cross-account access control. On Thursday, the company warned that BoKS Manager deployments that rely on BoKS Keytab for managing Active Directory … Read more
The Warlock ransomware group continues to target SharePoint servers in attacks on critical infrastructure, government and educational institutions, Symantec reports. Warlock is believed to be operated by a China-based hacking group called Longlegs and Storm-2603, which has been linked to malicious operations such as CL-CRI-1040, CamoFei and ChamelGang. Last year, Chinese state-sponsored groups Linen Typhoon … Read more
Fortinet is warning customers about a critical FortiMail vulnerability, CVE-2026-104286, which is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. The vulnerability is classified as critical with a CVSS score of 9.8 and affects the FortiMail administration interface. “A vulnerability related to improper restriction of a pathname to … Read more
Weekly from SecurityWeek Cybersecurity News Summary provides a succinct overview of key developments that may not be covered entirely in isolation but are nonetheless relevant to the broader threat landscape. This curated summary highlights key stories about vulnerability disclosures, new attack vectors, policy updates, industry reports and other notable events to help readers stay well-informed … Read more