⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

Monday recap. Same mess, new week. A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should've patched years ago. Good times...

exploits

Exploits Exploits and proof-of-concept code from the team at...

Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2026-9082 CVSS score: 6.5, an...

GHSA-QJX8-664M-686J vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, langfuse, wazuh-dashboard-fips, redisinsight, saf, wazuh-dashboard, drupal, kibana, langfuse-fips...

CVE-2026-46625 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, langfuse, wazuh-dashboard-fips, redisinsight, saf, wazuh-dashboard, drupal, kibana, langfuse-fips...

GHSA-VCC8-PHRV-43WJ vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-7P85-W9PX-JPJP vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-7FXW-R6JV-74C8 vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-4J38-F5CW-54H7 vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-45VW-WH46-2VX8 vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46640 vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-24X9-R6Q4-Q93W vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46638 vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46635 vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46634 vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46633 vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46628 vulnerabilities

Vulnerabilities for packages: drupal...

Exploit for CVE-2026-9082

CVE-2026-9082 — Drupal PostgreSQL SQL Injection Mass Scanner & E...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-9082link is external Drupal Core SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses...

EUVD-2026-31377

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A token display templates: When the Token module is enabled and token display templates are configured, attacker-controlled token output e.g., term description is rendered...