CriticalVulnerabilities
SonicWall patches exploited SonicOS flaw that weakens VPN logins
CVE-2026-19868 lets an attacker with credentials for one login method slip past SAML checks, including SAML-enforced MFA.
SecurityWeek
Vulnerabilities
8 storiesCriticalVulnerabilities
Attackers hit OpenSSH 'SSHole' flaw within hours of disclosure
A newly disclosed OpenSSH bug can let attackers sign in to accounts that have no password set. Researchers saw exploitation attempts almost immediately, and one honeypot was taken to root. Audit for passwordless accounts and update OpenSSH as soon as your distribution ships the fix.
OpenSSHLinuxRoot access
The Hacker News
CriticalVulnerabilities
PHP2Shell RCE flaws keep spreading into industrial software
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution (CVSS 9.8). Festo has updated fix guidance for FactoryViews and MES4 installs that bundle XAMPP.
daily.dev / Security Boulevard
HighVulnerabilities
D-Link warns of multiple zero-days in DGS-3130 switches
Enterprise switch owners should check D-Link's advisory and restrict management interfaces until fixes are applied.
D-LinkZero-day
Cybersecurity News roundup
CriticalVulnerabilities
Zyxel switch hacks traced to a true zero-day, not an old bug
Attacks first blamed on a patched flaw actually used CVE-2026-107441, an out-of-bounds write that allows OS commands through crafted HTTP requests.
SecurityWeek
HighVulnerabilities
Chrome 157 fixes 213 security issues, seven of them critical
Restart Chrome to apply the update. Critical browser bugs are a common first step in drive-by attacks.
ChromeBrowser
Malwarebytes Labs
CriticalVulnerabilities
CISA adds WordPress Core race condition to exploited list
CVE-2026-119977, a time-of-check/time-of-use race in WordPress Core, is now on the KEV catalog based on evidence of active exploitation.
CISA
HighVulnerabilities
Two Ivanti Connect Secure flaws join the exploited list
CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable identifiers) are being used in the wild.
IvantiVPNKEV
CISA