vulnerability Archives

WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

23Sep

By RBNo Comments

News

WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

WordPress has patched a critical vulnerability in its core software that enables an attacker without an account to make a site load a PHP file from outside its theme directories. On certain servers, this can go even further, letting the attacker execute their own code. The fix was released on September 22 in WordPress 7.1.2, along with patches for every branch the project still maintains, going back to 4.7, and WordPress is urging site owners to update immediately. WordPress classifies the flaw as critical, gives it a CVSS score of 9.2, and tracks it as CVE-2026-87902. Exploiting it requires no account and no action from any logged-in user. All releases between 4.7.0 and 7.1.1, inclusive, are impacted. This covers 7.1.1 as well, which came from WordPress's September 17 security r...

Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution

21Aug

By RBNo Comments

News

Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution

On Thursday, Microsoft issued a warning about a maximum-severity security vulnerability in Entra ID, claiming that it has been abused in the wild. However, the company stated that no consumer action is necessary. The IT giant's cloud-based identity and access management service is affected by a remote code execution vulnerability known as CVE-2026-69836 (CVSS score: 10.0). Azure Active Directory, or Azure AD, was its previous name. According to a Microsoft advisory issued on Thursday, the deserialization of untrusted data in Microsoft Entra ID enables an unauthorized attacker to run malware over a network. Such flaws arise when an application improperly validates the conversion of user-controlled data back into an active object or code structure. An attacker may be able to carry ...

New Linux ‘Copy Fail’ Vulnerability Enables Root Access on Major Distributions

1May

By RBNo Comments

News

New Linux ‘Copy Fail’ Vulnerability Enables Root Access on Major Distributions

A Linux local privilege escalation (LPE) vulnerability that might provide an unauthorized local user access to root has been revealed by cybersecurity experts. Xint.io and Theori have nicknamed the high-severity vulnerability CVE-2026-31431 (CVSS score: 7.8) as Copy Fail. According to the vulnerability research team at Xint.io and Theori, an unprivileged local user can get root by writing four controlled bytes into the page cache of any readable file on a Linux machine. Fundamentally, the vulnerability is caused by a logic error in the algif_aead module of the cryptography subsystem of the Linux kernel. August 2017 saw the introduction of the problem in a source code commit. If the vulnerability is successfully exploited, a straightforward 732-byte Python script might modify a se...

CISA Confirms Active Exploitation of FileZen CVE-2026-25108 Vulnerability

25Feb

By RBNo Comments

News

CISA Confirms Active Exploitation of FileZen CVE-2026-25108 Vulnerability

Citing indications of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a recently discovered FileZen vulnerability to its list of known exploited vulnerabilities (KEV) on Tuesday. The operating system (OS) command injection vulnerability, identified as CVE-2026-25108 (CVSS v4 score: 8.7), may enable an authorized user to carry out arbitrary commands through carefully constructed HTTP requests. When a user enters in to the impacted product and submits a specially constructed HTTP request, Soliton Systems K.K. FileZen has an OS command injection vulnerability, according to CISA. The following file transfer product versions are impacted by the issue, per the Japan issue Notes (JVN): Versions 4.2.1 to 4.2.8 Versions 5.0.0 to 5.0.10 ...

Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package

4Feb

By RBNo Comments

News

Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package

Threat actors have been seen taking advantage of a serious security vulnerability in the well-known "@react-native-community/cli" npm package that affects the Metro Development Server. According to cybersecurity firm VulnCheck, exploitation of CVE-2025-11953, also known as Metro4Shell, was first noticed on December 21, 2025. The vulnerability, which has a CVSS score of 9.8, enables remote unauthenticated attackers to run arbitrary operating system commands on the underlying host. JFrog originally reported the flaw's specifics in November 2025. It further stated that the "activity has yet to see broad public acknowledgment," even after it was first exploited in the wild more than a month ago. The threat actors have exploited the vulnerability in the attack that was discovered agai...

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

3Feb

By RBNo Comments

News

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

Attacks using a recently revealed Microsoft Office security vulnerability have been linked to the Russia-affiliated state-sponsored threat actor APT28 (also known as UAC-0001) as part of a campaign called Operation Neusploit. Three days after Microsoft made the bug public, on January 29, 2026, Zscaler ThreatLabz reported that it saw the hacker organization using the vulnerability as a weapon in assaults against people in Romania, Slovakia, and Ukraine. CVE-2026-21509 (CVSS score: 7.8) is a Microsoft Office security feature bypass vulnerability that could enable an unauthorized attacker to deliver a specially designed Office file and cause it to activate. According to security experts Sudeep Singh and Roy Tay, social engineering lures were created in both English and localized lan...

SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release

22Jan

By RBNo Comments

News

SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release

Two days after a fix was released, a new security vulnerability in the SmarterTools SmarterMail email program has been actively exploited in the wild. WatchTowr Labs is tracking the issue as WT-2026-0001, although it does not presently have a CVE identifier. After the exposure management platform's responsible disclosure on January 8, 2026, SmarterTools patched it with Build 9511 on January 15, 2026. A specially constructed HTTP request to the ".api/v1/auth/force-reset-password" endpoint has been characterized as an authentication bypass bug that might enable any user to reset the SmarterMail system administrator password. The worst part, of course, is that the user can directly execute OS [operating system] commands using RCE-as-a-feature functions read more about SmarterMail Au...

WebRAT malware spread via fake vulnerability exploits on GitHub

24Dec

By RBNo Comments

News

WebRAT malware spread via fake vulnerability exploits on GitHub

GitHub repositories that purport to have proof-of-concept exploits for recently discovered vulnerabilities are now being used to spread the WebRAT malware. WebRAT is a backdoor with information-stealing capabilities that first surfaced at the start of the year and was previously distributed through pirated software and hacks for games like Roblox, Counter-Strike, and Rust. WebRAT has the ability to acquire cryptocurrency wallet information and login passwords for Steam, Discord, and Telegram accounts, according to a May report by Solar 4RAYS. Additionally, it can take screenshots and use cameras to spy on victims. The operators began distributing the malware through carefully constructed repositories in September at the latest, claiming to offer an exploit for multiple vulnerabil...

React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors

16Dec

By RBNo Comments

News

React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors

According to research from Palo Alto Networks Unit 42 and NTT Security, threat actors are using the security flaw known as React2Shell to spread malware families including KSwapDoor and ZnDoor. According to a statement from Justin Moore, senior manager of threat intelligence research at Palo Alto Networks Unit 42, KSwapDoor is a professionally constructed remote access solution created with stealth in mind. By creating an internal mesh network, it enables hacked systems to communicate with one another and get beyond security measures. Most worryingly, it has a "sleeper" mode that allows attackers to get around firewalls by awakening the virus with a covert, undetectable signal. It also employs military-grade encryption to conceal its connections. The Linux backdoor has interactiv...

RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet

17Nov

By RBNo Comments

News

RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet

RondoDox, a botnet malware, has been seen to target unpatched XWiki instances in order to exploit a serious security vulnerability that might enable attackers to execute arbitrary code. CVE-2025-24893 (CVSS score: 9.8) is the vulnerability in question. It is an eval injection problem that might enable any guest user to execute arbitrary remote code by sending a request to the ".bin/get/Main/SolrSearch" endpoint. In late February 2025, the maintainers fixed it in XWiki 15.10.11, 16.4.1, and 16.5.0RC1. It wasn't until late October that VulnCheck said it had seen new attempts to weaponize the issue as part of a two-stage attack chain to deploy a bitcoin miner, despite indications that the vulnerability had been exploited in the wild since at least March. The vulnerability was then a...