The top payout is for high-impact architectural research demonstrating full administrative control.

The post Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward appeared first on SecurityWeek.

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.

The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.

The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.

The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.

The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek.

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.

Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs.

The post Long-Hidden Flaws Patched in EPICS Research Facility Control Software appeared first on SecurityWeek.

CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution.

The post Hackers Start Probing Fresh Oracle EBS Vulnerability appeared first on SecurityWeek.

CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.

The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.

Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.

The post Signal Vulnerability Lets Malicious Callers Block Hang-Ups appeared first on SecurityWeek.

Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.

The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on SecurityWeek.

Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.

The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek.

Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.

The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek.

Initial attempts were observed on October 17, and mass activity began shortly after patches were released.

The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek.

Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches.

The post Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU appeared first on SecurityWeek.

Google has temporarily stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP).

The post Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports appeared first on SecurityWeek.

CVE-2026-61500 allows attackers to recover the session-cookie signing key and gain administrative access and RCE.

The post Exploitation Hits Rejetto HFS Vulnerability Discovered by AI  appeared first on SecurityWeek.

Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.

The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek.

The bugs could lead to authentication bypass, shell command execution, and memory corruption.

The post Fortra Patches Critical Vulnerabilities in BoKS appeared first on SecurityWeek.

The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025.

The post Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks appeared first on SecurityWeek.

CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system.

The post Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action appeared first on SecurityWeek.