cybersec

Vulnerability reports and security advisories: CVEs, vendor bulletins, patches and what to do about them.

Attackers Are Exploiting a SiteGuard WAF Bug to Run Commands as Root or SYSTEM

Attackers Are Exploiting a SiteGuard WAF Bug to Run Commands as Root or SYSTEM

A command injection flaw in SiteGuard Server Edition's statistics feature, on by default, is being exploited to run commands as root or SYSTEM. EG Secure Solutions has fixes and a patch. Save diagnostic data before you update, or attack traces may be lost.

A 16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Root ISP Gateways From Across the Street

A 16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Root ISP Gateways From Across the Street

Researcher Quentin Kaiser has shown that a WPS bug in Broadcom's Wi-Fi code, present since at least 2010, gives attackers in radio range root on ISP gateways without the Wi-Fi password. Broadcom refused to assign a CVE, and the Belgian ISP boxes he tested are still unpatched.

Infinity Core: Six Linux Kernel Bugs Let Local Users Become Root, and Fixes Are Still Rolling Out

Infinity Core: Six Linux Kernel Bugs Let Local Users Become Root, and Fixes Are Still Rolling Out

Researcher Hyunwoo Kim has disclosed Infinity Core, six bugs in core Linux kernel code. Five let an unprivileged local user gain root or escape a container, and exploit code is public. Fedora and Debian trixie have fixes; Ubuntu, RHEL and Debian bookworm are still waiting.

Four Critical J-Web Flaws Let Attackers Take Over Junos Devices Without Logging In

Four Critical J-Web Flaws Let Attackers Take Over Junos Devices Without Logging In

Juniper's October release fixes four CVSS 9.8 flaws in J-Web, the Junos web interface, that let unauthenticated attackers bypass login or run code as root. There are no workarounds, so patching and locking J-Web down to trusted hosts is the answer.

Five Critical BGP Bugs Let Peers Take Over Juniper Routers

Five Critical BGP Bugs Let Peers Take Over Juniper Routers

Five CVSS 9.8 stack overflows in Juniper's routing daemon can be triggered through BGP, via BMP, flowspec and EVPN-VPWS, and most lead to root code execution on Junos OS. None are known exploited. Fixed releases are out, and only one has a workaround.

Juniper's October 2026 Security Release: 153 Junos CVEs, 15 Critical, and What to Patch First

Juniper's October 2026 Security Release: 153 Junos CVEs, 15 Critical, and What to Patch First

Juniper's October 14 release fixes 153 Junos OS and Junos OS Evolved CVEs, 15 of them critical, spanning BGP, J-Web, SRX, MX and more. None are on CISA's KEV list and Juniper knows of no exploitation, but most lack workarounds, so upgrading is the fix.

Juniper Patches Four Critical Junos Flaws, Including Root Takeover on MX Routers

Juniper Patches Four Critical Junos Flaws, Including Root Takeover on MX Routers

Juniper has patched four CVSS 9.8 Junos flaws that need no login: a root code execution bug in MX routers' certificate-based IKE handling and three J-Web takeover bugs. None are known to be exploited yet, but there are no workarounds, so upgrading is the fix.

GitLab Patches CVSS 10.0 Flaw That Lets Attackers Run Code Without Logging In

GitLab Patches CVSS 10.0 Flaw That Lets Attackers Run Code Without Logging In

GitLab patched CVE-2026-97229, a CVSS 10.0 flaw that could let an unauthenticated user run code on self-managed GitLab servers through a crafted regex in CI/CD config. Fixed in 19.4.2, 19.3.5, and 19.2.8. Upgrade now.

Cybersecurity News: PoC Released for Telegram Desktop Flaw Enabling Account Takeover

Cybersecurity News: PoC Released for Telegram Desktop Flaw Enabling Account Takeover

A public PoC targets CVE-2026-107181, a Telegram Desktop IPC injection flaw before 7.2.9. A crafted link opened outside the app can leak local files, including session keys, and lead to account takeover. Update to 7.2.9 now.

[Benjojo] BGP handling bug causes widespread internet routing instability

[Benjojo] BGP handling bug causes widespread internet routing instability

At 7AM (UTC) on Tuesday May 20th 2025 a BGP message was propagated that triggered surprising (to many) behaviours with two major BGP implementations that are often used for carrying internet traffic.

[TheRegister] FreSSH bugs undiscovered for years threaten OpenSSH security

[TheRegister] FreSSH bugs undiscovered for years threaten OpenSSH security

Qualys found two OpenSSH bugs in January: CVE-2025-26465 allows machine-in-the-middle attacks on the OpenSSH client, and CVE-2025-26466 allows pre-authentication denial of service. Patches have been released, and exploit code for the MitM and DoS attacks is now available.

[NetworkSecurity] BGP Flaw Can Be Exploited for Prolonged Internet Outages #CVE-2023-38802

[NetworkSecurity] BGP Flaw Can Be Exploited for Prolonged Internet Outages #CVE-2023-38802

SecurityWeek reports on CVE-2023-38802, a flaw affecting major BGP implementations that attackers can exploit to cause prolonged internet outages. Several vendors had not patched it at the time of writing.