4+ day, 7+ hour ago   (605+ words) The Exchange Server situation warrants front-of-queue treatment over the two named zero-days. CVE-2026-55007 allows a remote, unauthenticated attacker to execute code on an affected Exchange server by sending an email containing a malicious Visio attachment. The code runs when the…...

5+ day, 23+ hour ago   (394+ words) This is not a design flaw in HAProxy. The filter API is working as intended. The exploitation is the binary replacement itself: an attacker who can install a recompiled version of a trusted application inherits all of that application's privileges…...

1+ week, 3+ day ago   (506+ words) Security firm Wordfence published its full technical disclosure on September 2, 2026. Developer ServMask shipped a patch in version 7.110 on August 20 — thirteen days before the public advisory — but as of September 2, only about 35 percent of the install base had applied it. The…...

1+ week, 4+ day ago   (930+ words) Every compromised account shared one characteristic: none had multi-factor authentication (MFA) enabled. That single missing layer of defense is why this attack worked. Enable it now if you have not already. The attack required no phishing, no credential stuffing, and…...

1+ week, 4+ day ago   (565+ words) CVE-2026-62911 is classified as an authentication bypass by capture-replay (CWE-294) and carries a CVSS 3.1 score of 8.0 from Microsoft — confirmed in Microsoft's Security Update Guide — and 8.1 from the Zero Day Initiative. The flaw resides in Exchange's Mailbox Replication Proxy Service — the…...

2+ week, 5+ day ago   (309+ words) The attack chains two distinct vulnerabilities, tracked as CVE-2026-61979 (CVSS 8.1) and CVE-2026-15981 (CVSS 9.8), that together let an unauthenticated attacker forge a SAML authentication response and land in WordPress's administrator panel without ever possessing valid credentials. Chained together, the two bugs…...