Cyber News
Ubuntu snap-confine CVE-2026-8933: Local Root on Desktop
Ubuntu snap-confine flaw CVE-2026-8933 (CVSS 7.8) lets a local user win a race condition to gain root on default 24.04/25.10/26.04 desktops. Patch snapd now.
// TRENDING
CriticalFortiMail CVE-2026-104286: Exploited Zero-Day File Write
FortiMail CVE-2026-104286 is a CVSS 9.8 unauthenticated arbitrary file write (path traversal), an exploited zero-day in CISA KEV. Affected versions and fix.
CriticalDell CSM CVE-2026-63688: Root on Kubernetes Nodes
Dell CSM CVE-2026-63688 leads six critical flaws (two CVSS 10.0) giving unauthenticated admin and root on Kubernetes nodes. Patch to CSM 1.18.0 now.
CriticalGitLab AI Gateway CVE-2026-90970: Critical RCE
GitLab AI Gateway CVE-2026-90970 (CVSS 9.9) lets a Duo user escape the prompt sandbox to run commands on self-hosted GitLab. Fixed in 19.2.4/19.3.2/19.4.1.
NotableOpenAI AI Agents Aimed SQL Injection at Government Sites
Autonomous AI agents (evidence points to OpenAI) sent 200,000+ SQL injection and XSS probes at US and Canadian government websites, per Transluce. What to know.
CriticalBifrost AI Gateway CVE-2026-90898: Unauth RCE
Bifrost AI Gateway CVE-2026-90898 is a CVSS 9.8 unauthenticated command execution via MCP stdio client registration. Upgrade to transports v2.1.0.
HighZimbra CVE-2026-73570: Exploited Unauth SNMP RCE
Zimbra CVE-2026-73570: an actively exploited unauth RCE (CVSS 8.9) in zimbra-snmp, in CISA KEV. Affected versions, fix, PoC status, and detection.
HighSolarWinds ARM CVE-2026-28326: Unauthenticated RCE
SolarWinds ARM CVE-2026-28326 is a CVSS 8.8 unauthenticated RCE via a hard-coded key. Affects Access Rights Manager 2026.2 and earlier; patch to 2026.2.1.
CriticalLinux Kernel CVE-2025-39682: 3 Flaws Exploited (CISA KEV)
Linux kernel CVE-2025-39682 and two more are in CISA KEV, exploited in the wild, plus 4 public local-root exploits. Which kernel flaws to patch now.
CriticalAzure AI Foundry CVE-2026-85889: CVSS 10.0 Privesc
Azure AI Foundry CVE-2026-85889 is a CVSS 10.0 missing-authentication privilege-escalation flaw. Microsoft mitigated it server-side; no customer action.
NotableClaude Opus 5 Used to Breach OpenAI Staff Accounts
Hacktron researchers used Claude Opus 5 to chain libheif CVE-2026-32882 with an OpenAI SSO flaw and reach internal OpenAI code. What defenders should learn.
CriticalVMware Workstation CVE-2026-59346: 9.3 VM-to-Host Escape
VMware Workstation and Fusion CVE-2026-59346 is a CVSS 9.3 VMXNET3 flaw letting a VM admin run code on the host. Affected versions and how to patch to 26H1u1.
NotableOpenAI AI Agents Linked to RubyGems Supply-Chain Attack
Researchers link OpenAI AI agents to a RubyGems supply-chain attack: hundreds of malicious AI-generated packages and RCE on RubyDoc.info. What to know.