LiteLLM Flaw Turns AI Gateway Into an Attack Gateway CISA added LiteLLM CVE-2026-42271 to its Known Exploited Vulnerabilities catalogue after evidence of active exploitation. The flaw is a command injection vulnerability affecting LiteLLM versions 1.74.2 through before 1.83.7, allowing authenticated users to execute arbitrary commands on the host. Researchers also showed it could be chained […]
Chrome Zero-Day: Update Before Your Browser Gets Ideas Google released Chrome security updates fixing 74 vulnerabilities, including CVE-2026-11645, a high-severity V8 zero-day exploited in the wild. The issue is an out-of-bounds memory access flaw in Chrome’s JavaScript and WebAssembly engine that could allow remote code execution inside the browser sandbox via a crafted HTML page. […]
Veeam RCE: Because Attackers Love Backups Too Veeam patched a critical remote code execution vulnerability in Backup & Replication, tracked as CVE-2026-44963 with a CVSS score of 9.4. The flaw allows an authenticated domain user to execute remote code on the backup server. It affects Veeam Backup & Replication 12.3.2.4465 and earlier version 12 builds, […]
RoguePlanet: When Microsoft Defender Needs Defending A researcher known as Chaotic Eclipse released proof-of-concept exploit code for a Microsoft Defender zero-day named RoguePlanet. The flaw is described as a race condition that can grant SYSTEM-level privileges when successfully exploited. It was reportedly tested on fully updated Windows 10 and Windows 11 systems after June 2026 […]
Microsoft Patch Tuesday Breaks Records, and Probably Some Weekend Plans Microsoft’s June 2026 Patch Tuesday fixed a record 206 vulnerabilities, including 39 critical issues and three publicly disclosed zero-days. The updates cover privilege escalation, remote code execution, information disclosure, spoofing, security bypass and denial-of-service flaws. Major issues include a Windows Kernel remote code execution vulnerability, […]
Ivanti, Fortinet and SAP Critical Patches Ivanti, Fortinet and SAP released fixes for multiple critical vulnerabilities affecting enterprise products. Fortinet patched a FortiSandbox command injection flaw. Ivanti fixed two critical Ivanti Sentry issues, including unauthenticated root-level remote code execution and authentication bypass allowing arbitrary admin account creation. SAP also addressed critical flaws across NetWeaver, ABAP […]
Cisco Secure Workload Gets the Full CVSS 10.0 Treatment Cisco has patched a critical CVSS 10.0 vulnerability affecting Secure Workload environments. The flaw could allow unauthenticated remote attackers to compromise affected systems completely. Cisco confirmed the issue impacts certain management components and urged organisations to apply updates immediately. The vulnerability highlights the continued risks associated […]
Drupal SQL Injection Bug Reminds Everyone It’s Still 2008 Somewhere An actively exploited SQL injection vulnerability has been identified in Drupal Core. The flaw could allow attackers to execute malicious database queries, potentially resulting in data exposure, authentication bypass, or remote code execution under certain conditions. Researchers have confirmed exploitation attempts in the wild, and […]
LiteSpeed Plugin Flaw Gives Hosting Admins Another Headache A critical vulnerability (CVE-2026-48172) has been identified in a LiteSpeed cPanel plugin, potentially allowing attackers to compromise hosting environments remotely. The flaw impacts systems running vulnerable plugin versions and could lead to unauthorised access or server compromise. Hosting providers and administrators are strongly advised to apply patches […]
