Skip to main content

Years-Old Apple Pointer Authentication Bypass Back in Active Use for Espionage-Linked Malware Delivery (CVE-2024-27834)

Scope: Older Apple devices and browsers on builds predating the May 2024 security updates

Ruby on Rails Active Storage Flaw Lets Attackers Write Files and Leak Server Secrets via Image Uploads

Scope: Ruby on Rails, fixed in versions 8.1.4.1 and 8.0.5.2

WordPress Core Flaw Exploited During the Software Upgrade Process Itself (CVE-2026-119977)

Scope: WordPress Core, patched versions released late October 2026

BTCPay Server Hot Wallets Drained on Unpatched Self-Hosted Instances

Scope: BTCPay Server, versions 2.4.1 and earlier (fixed in 2.4.2, released August 7, 2026)

Over 1,000 GitLab Servers Remain Exposed to Active Exploitation Weeks After Patch (CVE-2026-97229)

Scope: Self-managed GitLab Community Edition and Enterprise Edition, instances not yet upd

C3RB3R Ransomware Encrypting Synology NAS Devices on Outdated DSM Builds

Scope: Synology DSM on NAS devices, all unpatched builds across the 7.4, 7.3, 7.2.2, and 7

s2Member WordPress Plugin Code Injection Flaw Has Public Exploit Code (CVE-2026-86596)

Scope: s2Member WordPress plugin, all versions through 260927, fixed in 261017

Subscribe to Advisories