Vulnerabilities
Verify OAuth Secrets After Researcher Exposes Google Dev Site RCE Flaw
A security researcher demonstrates unauthenticated remote code execution on Google developer sites via a leaked signing key in session cookies.
DarkWeb Dispatch Vulnerability Desk
The DarkWeb Dispatch Vulnerability Desk is the part of the DarkWeb Dispatch newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 11 articles so far. See the editorial policy or report an error.
Vulnerabilities
Apply Fixes for IBM i HTTP Server Admin to Mitigate Critical CVE-2026-96119 Authenticated RCE Threat
A critical vulnerability in IBM i allows remote attackers to execute code via the HTTP Server Administration web application, affecting versions 7.3 through 7.6.
Vulnerabilities
Update AhsayCBS 10.3.4: Huntress finds chained CVEs still allow webshells and miners on unpatched systems
Huntress researchers report that threat actors are chaining two vulnerabilities in AhsayCBS to deploy webshells and disguised cryptocurrency miners on unpatched systems.
Vulnerabilities
Remediate BIND, Struts, Strapi, ONLYOFFICE, ProFTPD flaws by Oct 11, 2026 CISA KEV deadline
CISA added five exploited vulnerabilities to its catalog. Each entry lists a due date of 11 October 2026 for remediation.
Vulnerabilities
Secure AhsayCBS Backup Servers Against Active Zero-Day Exploits
Threat actors are exploiting two unpatched vulnerabilities in Ahsay Cloud Backup Server to gain SYSTEM-level access and deploy malicious payloads on exposed infrastructure.
Vulnerabilities
Patch Privasys Go Before v0.5.1 to Block Critical Enclave Impersonation via CVE-2026-108267
A critical vulnerability in Privasys Go allows attackers to relay attestation certificates, enabling them to impersonate secure enclages on remote servers.
Vulnerabilities
Upgrade Apache Camel Karavan to 4.22.1 Immediately to Mitigate Critical RCE via Path Traversal
Authenticated users can exploit CVE-2026-103412 in Apache Camel Karavan to execute remote code via path traversal, requiring an immediate upgrade to version 4.22.1.
Vulnerabilities
Update Vikunja to 2.4.0 now to prevent attackers from hijacking accounts via leaked database tokens
Open-source task manager Vikunja patched a high-severity flaw where database leaks allowed attackers to hijack accounts using exposed password-reset tokens.
Vulnerabilities
Fix Protection Mechanism Failure in IBM Identity to Stop Authenticated RCE via CVE-2026-16916
A protection mechanism failure in IBM identity products allows authenticated attackers to run arbitrary code, posing a severe risk to enterprise access controls.
Vulnerabilities
Patch ISC BIND TKEY flaw before CISA’s 11 October deadline
CISA has added CVE-2015-5477 to its Known Exploited Vulnerabilities list, urging immediate mitigation for affected DNS servers.
Vulnerabilities
Inspect Logs Now: CERT-EU Urges Patching 8 Atlassian Products Amid Wild Exploitation
CERT-EU advises urgent upgrades for eight products after VulnCheck confirms wild exploitation of a critical arbitrary file access vulnerability.