#уязвимости
-
Check Point Patches Two Critical Flaws in VPN Certificate Handling
Both holes carry a 9.8 rating and could, in theory, let an unauthenticated attacker execute code remotely — but the vendor won't spell out the “certain conditions.”
-
CISA: WatchGuard Firebox Flaw Now Exploited by Ransomware Gangs Too
The US cybersecurity agency has confirmed that a critical RCE vulnerability in WatchGuard Firebox firewalls is being used in ransomware attacks. Nine months after the patch shipped, thousands of unprotected devices remain online.
-
WeWorm: the first zero-click worm for WeChat calls, written with the help of AI
Researchers at Calif Research have unveiled a demonstration of a worm that spreads through WeChat calls on iOS and Android without a single action by the victim. According to them, artificial intelligence did most of the work.
-
Cisco Confirms Exploitation of Critical Secure FMC Vulnerability
The CVE-2026-20079 vulnerability, with a maximum CVSS score of 10.0, allows attackers to bypass authentication and execute commands with root privileges. Cisco has acknowledged that it is already being used in attacks, and CISA has ordered government agencies to remediate the flaw by September 12.
-
Google Patches the Seventh Chrome 0-Day of the Year, Used in Attacks
On Tuesday, Google closed 230 vulnerabilities, among them an actively exploited zero-day flaw in Chrome.
-
CISA Adds Critical N-able N-central RCE Vulnerability to Its Actively Exploited Catalog
The flaw, which carries the maximum CVSS score of 10.0, allows unauthenticated code execution and is already being used in attacks. U.S. federal agencies have been ordered to remediate it by September 11, 2026.
-
Microsoft Patches Nearly a Thousand Vulnerabilities in a Single Month — a New Record
Microsoft's September update bundle fixed no fewer than 974 vulnerabilities — the largest in the company's history. AI is speeding up the hunt for holes, but administrators can no longer keep up with testing and deploying the fixes.
-
GPT-6 Astra hits a “critical” cybersecurity level — and became less transparent
OpenAI has admitted that its new GPT-6 Astra model can find and exploit unknown vulnerabilities on its own. At the same time, its chain of reasoning has become harder to follow.
-
FreeIPA Vulnerability Chain Grants an Anonymous Client Administrator Rights
Red Hat has described a pair of defects that together let a client who has never logged in create its own Kerberos account in the directory and land in the administrators group. The fix ships in FreeIPA 4.13.4.
-
MikroTrick: attacks on MikroTik routers via internet-exposed SSH
CERT Polska warns: attackers are gaining full administrative control over MikroTik routers without authentication by exploiting an internet-accessible SSH service. The attacks have been recorded since at least September 2.
-
Broadcom Patches Critical Vulnerability in VMware Workstation and Fusion
The integer overflow flaw lets an attacker with administrator privileges inside a virtual machine execute arbitrary code on the host system. There are no workarounds — only an update helps.
-
Hackers Target Schools and Universities Through PaperCut Vulnerabilities
Attackers are chaining two recently discovered vulnerabilities in the PaperCut print management system to steal credentials at educational institutions across the US and Europe.
-
A Voting System Vulnerability: AI Reconstructed the Order of the Ballots
Nearly four years after the vulnerability was disclosed, an expert used an AI agent to exploit it again — analyzing voter behavior in the Georgia primary without ever touching the voting equipment.
-
Plex Urges Immediate Update After Patching Undisclosed Vulnerabilities
Plex has released Media Server and Desktop updates that fix several vulnerabilities, but is withholding the details for now. The company recommends installing them as soon as possible.
-
Google Patches Actively Exploited 0-Day in Chrome's V8 Engine
An emergency Chrome update fixes 12 vulnerabilities, including CVE-2026-85046 in the V8 engine, for which a working exploit already exists.
-
Cloudflare and OpenAI: Vulnerability Discovery That Accounts for Real Traffic
Cloudflare is launching an invitation-only Vulnerability Discovery and Remediation service that ties vulnerabilities found in code to production traffic and tells you what to fix first.
-
HPE Patches Critical Remote Code Execution Vulnerability in ArubaOS-CX
Hewlett Packard Enterprise has fixed a critical flaw in the ArubaOS-CX network operating system that allowed an unauthenticated attacker to remotely execute code with elevated privileges. A total of 24 vulnerabilities were patched.
-
Critical Cisco Nexus 9000 Flaw Enables Remote Code Execution With Root Privileges
Cisco has released patches for a critical hole in its Silicon One–based Nexus 9000 switches that lets an unauthenticated attacker execute code with root privileges. At the same time, a “hardening” release of IOS XR went out, closing seven CVEs, two of them rated 9.8.
-
CISA Adds Seven Exploited Vulnerabilities to Its Catalog
The U.S. agency CISA has added seven fresh vulnerabilities to its Known Exploited Vulnerabilities catalog — among them flaws in SonicWall, JFrog Artifactory and AI infrastructure that attackers are using to install reverse shells and miners.
-
A malicious .git turns AI agents into runners of someone else's code
Manifold Security has disclosed eight vulnerabilities in seven console AI coding agents: the repository itself slips in a command that the agent runs on the developer's machine — outside the sandbox and with no confirmation prompt.
- More