Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions.

The post Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites appeared first on SecurityWeek.

Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.

The post HPE Patches Critical RCE Vulnerabilities in AOS-CX appeared first on SecurityWeek.

Tracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.

The post Sangoma Switchvox Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.

Dubbed PostGREShell, CVE-2026-6471 turns low-level replication access into code execution, permanent superuser privileges and a persistent database backdoor.

The post 12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover appeared first on SecurityWeek.

The flaws could allow attackers with administrative access to a virtual machine to execute code on the host system.

The post VMware Workstation and Fusion Updates Patch Critical Vulnerability appeared first on SecurityWeek.

Google’s Chrome 152 security update resolves 12 vulnerabilities, including a high-severity type confusion flaw in the V8 engine.

The post Google Patches 6th Chrome Zero-Day of 2026 appeared first on SecurityWeek.

Midnight Blizzard has been stealing Microsoft account credentials via compromised Wi-Fi networks at hospitality organizations.

The post Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking appeared first on SecurityWeek.

The flaw can be exploited by unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (RCE).

The post Ruby on Rails Patches Critical Vulnerability appeared first on SecurityWeek.

The internet giant has built an agent harness to find vulnerabilities across Chrome’s codebase.

The post Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace appeared first on SecurityWeek.

Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access.

The post Critical Flaw Allowed to Azure Cosmos DB Pwnage appeared first on SecurityWeek.

The startup has built an AI-powered Identity Operating System that governs all identities across an organization’s environment.

The post Oak Emerges From Stealth Mode With $60 Million in Funding appeared first on SecurityWeek.

The flaws could allow attackers to access credentials and data, take over accounts, and escalate their privileges.

The post Splunk, Zoom Patch Critical Vulnerabilities appeared first on SecurityWeek.

Attackers could exploit the bugs to modify configurations, terminate or restart processes, cross security boundaries, leak memory, and execute code.

The post F5 Patches Multiple NGINX, BIG-IP Vulnerabilities appeared first on SecurityWeek.

Signed by Microsoft, the vulnerable UEFI shim bootloaders could be abused on any system, regardless of the OS.

The post Old UEFI Shims Expose Systems to Secure Boot Bypass appeared first on SecurityWeek.

The researcher stripped the proof-of-concept (PoC) exploit to prevent immediate exploitation of the vulnerability.

The post Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day  appeared first on SecurityWeek.

The attackers deployed a new Go-based backdoor that uses Microsoft Teams servers for command-and-control.

The post Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack appeared first on SecurityWeek.

The public PoC code exploits a race condition in Microsoft Defender to spawn a command prompt with System privileges.

The post Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day appeared first on SecurityWeek.

The browser updates address multiple memory safety bugs that could potentially lead to remote code execution.

The post Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities appeared first on SecurityWeek.

The flaw allows attackers to execute arbitrary code remotely and has been exploited in the wild for two months.

The post Everest Forms Vulnerability Exploited to Hack WordPress Sites appeared first on SecurityWeek.

Hackers accessed personal information stored on certain Lansing Community College systems in February 2025.

The post 174,000 Impacted by Lansing Community College Data Breach appeared first on SecurityWeek.