WordPress Core Flaw Exploited During the Software Upgrade Process Itself (CVE-2026-119977)

Scope: WordPress Core, patched versions released late October 2026

Severity: Red

Read More

Years-Old Apple Pointer Authentication Bypass Back in Active Use for Espionage-Linked Malware Delivery (CVE-2024-27834)

Scope: Older Apple devices and browsers on builds predating the May 2024 security updates (iOS/iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, Safari 17.5)

Severity: Amber

Read More

Ruby on Rails Active Storage Flaw Lets Attackers Write Files and Leak Server Secrets via Image Uploads

Scope: Ruby on Rails, fixed in versions 8.1.4.1 and 8.0.5.2

Severity: Red

Read More

C3RB3R Ransomware Encrypting Synology NAS Devices on Outdated DSM Builds

Scope: Synology DSM on NAS devices, all unpatched builds across the 7.4, 7.3, 7.2.2, and 7.2.1 lines (and earlier lines per Synology’s own advisory)

Severity: Red

Read More

BTCPay Server Hot Wallets Drained on Unpatched Self-Hosted Instances

Scope: BTCPay Server, versions 2.4.1 and earlier (fixed in 2.4.2, released August 7, 2026)

Severity: Red

Read More

Over 1,000 GitLab Servers Remain Exposed to Active Exploitation Weeks After Patch (CVE-2026-97229)

Scope: Self-managed GitLab Community Edition and Enterprise Edition, instances not yet updated against CVE-2026-97229

Severity: Red

Read More