The problem with set-and-forget devices is that you can set them up and then forget about them. This is good in terms of remembering it, but people sometimes forget that their device needs regular updates to stay secure. That’s what’s happening with Plex as hackers distribute Plex2Shell to devices that haven’t been updated since August. … Read more
Researchers warn that hackers could soon exploit a maximum severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce that could potentially allow them to execute arbitrary PHP code on store servers. According to e-commerce security firm Sansec, no attacks exploiting the vulnerability called BlockStrap have been observed so far, but threat actors are expected to find … Read more
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud. Multiple administrator reports indicate that the attacks began in mid-September, about a month before the official event Security bulletinThe GitHub AdviceAnd CVE publication. CVE-2026-110447 affects Richdocumentscode versions before 26.4.303 and … Read more
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution via specially crafted PDF files. The flaw was discovered on August 23 by researchers at Defiant platform Wordfence using their AI-powered system Argus. Ghostscript is a PostScript and PDF interpreter that can render PDFs as images, … Read more