Calif Publishes OpenBSD Local Root Escalation PoC
Calif researcher Andrew Griffiths has published source code and a technical description of a chain involving two patched OpenBSD kernel bugs. The PoC is intended for local privilege escalation.
Tag vulnerabilities
Updated: Drupal fixes two critical RCE flaws, including Entity List module
Alongside CVE-2026-108097 in Field UI, Drupal fixed a separate critical RCE vulnerability, CVE-2026-108099, in the Entity List module. Affected websites should update the module to version 3.0.10.
Google Raises Rewards for Chrome Memory-Safety Bugs
Google has revised the Chrome VRP rewards program. The base reward for memory corruption bugs has increased from $500 to $2,000, with higher rates also applying to other types of findings.
CISA Adds CVE-2026-96951 in Windows Shell to Actively Exploited List
Microsoft released a fix for a Windows Shell vulnerability that attackers exploited before the update was disclosed. CISA subsequently added it to the Known Exploited Vulnerabilities catalog.
Critical CVE-2026-85097 vulnerability in Bricksforge for WordPress actively exploited
A vulnerability in the Bricksforge plugin allows unauthenticated attackers to upload a file and execute PHP code on the server. Patchstack has recorded exploitation attempts and recommends updating immediately.
Updated: Ahsay Admits AhsayCBS Vulnerability Fixes Were Incomplete, Releases New Hotfixes
Ahsay said earlier fixes for two actively exploited AhsayCBS vulnerabilities were incomplete. It recommends that administrators deploy the new hotfixes and rebuild servers showing signs of compromise.
Anthropic Launches OSS Scanner for Open-Source Security Checks
Anthropic introduced the free, opt-in OSS Scanner service, which is intended to periodically search for vulnerabilities in selected open-source projects.
NetScaler Releases Fixes for Critical CVE-2026-107406 in ADC and Gateway
A critical vulnerability in NetScaler ADC and NetScaler Gateway SAML configurations could allow remote code execution or denial of service. Fixed versions are now available.
CISA Adds CVE-2021-3199 in ONLYOFFICE Docs to Actively Exploited Vulnerabilities
CISA lists CVE-2021-3199 in ONLYOFFICE Docs as actively exploited. Administrators should update Document Server to at least version 5.6.3.
CISA Adds Old Apache Struts Vulnerability to Exploited Vulnerabilities Catalog
CISA added CVE-2016-3081 in Apache Struts to the KEV catalog. The flaw enables remote code execution when Dynamic Method Invocation is enabled.