Tag: Critical vulnerabilities
Cybersecurity Threat Advisory: Critical PHP2Shell RCE vulnerabilities
PHP recently shipped an out-of-cycle emergency release fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell. Both are rated 9.2 on CVSS v4.0 and can allow unauthenticated attackers to run code on vulnerable web servers. The...
Cybersecurity Threat Advisory: Critical SonicWall SMA1000 vulnerabilities
Barracuda Managed XDR’s Security Operations Center has observed increased scanning and profiling of internet-exposed SonicWall SMA 1000 Series appliances following the disclosure of four new vulnerabilities, including a critical pre-authentication server-side request forgery (SSRF) flaw (CVE-2026-102255, CVSS 10.0). Although SonicWall...
Cybersecurity Threat Advisory: MOVEit authentication bypass vulnerability
A vulnerability has been identified involving a critical authentication bypass in Progress MOVEit Automation, a widely used managed file transfer and automation platform. This flaw allows unauthenticated attackers to bypass authentication mechanisms and gain unauthorized access to MOVEit Automation environments....
Cybersecurity Threat Advisory: Ivanti RCE vulnerabilities
Security researchers at Ivanti have disclosed two high‑severity vulnerabilities in the Endpoint Manager Mobile (EPMM) platform, tracked as CVE‑2026‑1340 and CVE‑2026‑1281, both carrying a CVSS score of 9.8. Ivanti has released an initial patch, with full mitigation expected in an...
Cybersecurity Threat Advisory: Critical SolarWinds Web Help Desk flaws
SolarWinds has released security updates addressing multiple vulnerabilities in its Web Help Desk (WHD) product, including four critical flaws—CVE‑2025‑40551, CVE‑2025‑40552, CVE‑2025‑40553, and CVE‑2025‑40554—that enable authentication bypass and remote code execution (RCE). These issues allow attackers to gain unauthorized access and...
Cybersecurity Threat Advisory: FreePBX critical vulnerabilities
Several vulnerabilities in the FreePBX platform have been disclosed and patched, including a critical authentication bypass and flaws enabling SQL injection and arbitrary file upload. Read this Cybersecurity Threat Advisory for an analysis, remediation steps, and detection guidance. What is...
Cybersecurity Threat Advisory: Critical VMware vulnerabilities exploited
Three critical vulnerabilities (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226) are actively exploited, posing a significant threat to VMware virtualization environments. Review the details in this Cybersecurity Threat Advisory to learn how to mitigate your risks. What is the threat? These vulnerabilities present...
Cybersecurity Threat Advisory: Critical vulnerabilities in SonicWall
SonicWall disclosed three critical vulnerabilities affecting the SonicOS firmware. These flaws include an authentication bypass affecting the SSL VPN and SSH management interfaces, which can enable attackers unauthorized access upon successful exploitation. Continue reading this Cybersecurity Threat Advisory for more...
Cybersecurity Threat Advisory: Three critical Sophos firewall vulnerabilities
Sophos has disclosed three critical vulnerabilities in its firewall product that could allow remote unauthenticated attackers to perform structured query language (SQL) injection, execute arbitrary code, and gain privileged secure shell (SSH) access to affected devices. Review the details of...
Cybersecurity Threat Advisory: New critical vulnerability in Palo Alto Expedition
A vulnerability identified as CVE-2024-5910, has been disclosed by Palo Alto. With a CVSS score of 9.3, this vulnerability can lead to authentication bypass, enabling attackers to manipulate network configurations and launch further attacks. Read this Cybersecurity Threat Advisory for...
