Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 aka Earth Sirrush obtaining initial access to the target on July 16,...

Vulnerability in Google Brotli-decoder

Google has discovered a vulnerability in the Brotli decompression library. This library is used in Node.js. An unauthorized malicious actor can exploit this vulnerability to process specially crafted Brotli-compressed data remotely. Successful exploitation could lead to a denial-of-service attack...

CVE-2026-112862

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5...

Security Bulletin:Multiple vulnerabilities in zstd-jni may affect IBM Infosphere Change Data Capture (CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877)

Summary Multiple security vulnerabilities have been identified in zstd-jni, JNI bindings for Zstd native library. zstd-jni is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...

Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-91776, CVE-2026-91777)

Summary Multiple security vulnerabilities have been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediati...

Security Bulletin:Vulnerability in jetty-http-12.1.10.jar may affect IBM Infosphere Change Data Capture (CVE-2026-19203)

Summary A security vulnerability has been identified in jetty-http-12.1.10.jar, Jetty module for handling HTTP protocol logic, including requests, responses, and connection management. jetty-http is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the...

Security Bulletin:Multiple vulnerabilities in netty-codec-http2 may affect IBM Infosphere Change Data Capture (CVE-2026-93492, CVE-2026-93567, CVE-2026-93568, CVE-2026-93569, CVE-2026-93579)

Summary Multiple security vulnerabilities have been identified in netty-codec-http2, Netty/Codec/HTTP2. netty-codec-http2 is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...

Security Bulletin:Multiple vulnerabilities in zookeeper may affect IBM Infosphere Change Data Capture (CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, CVE-2026-84501)

Summary Multiple security vulnerabilities have been identified in zookeeper, ZooKeeper server. zookeeper is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details...

Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-19032, CVE-2026-83557)

Summary Multiple security vulnerabilities have been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediati...

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell " proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by...

Security Bulletin:Vulnerability in jackson-dataformat-cbor may affect IBM Infosphere Change Data Capture (CVE-2026-68495)

Summary A security vulnerability has been identified in jackson-dataformat-cbor, . is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details CVEID:CVE-2026-68495 DESCRIPTION: T...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109618 / CVE-2026-109619 PHP2Shell RCE ★ CVE-2026-10...

CVE-2026-112862

The Participants Database WordPress plugin (versions

EUVD-2026-108629

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5...

CVE-2026-112862 WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5...

CVE-2026-112862 WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 2.0 have been addressed in version 11.3.1.3-IF7 Vulnerability Details CVEID:CVE-2026-59999 DESCRIPTION: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did...

CVE-2026-112230

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...

CVE-2026-112230 Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...

EUVD-2026-108597

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...