Kirki CVE-2026-8206
Kirki 6.0.0 through 6.0.6 can let unauthenticated attackers route password reset links to their own inbox. Update to 6.0.7 or later and audit administrator accounts.
News desk
Security News
Security incidents, exploited vulnerabilities, breach reports, malware campaigns, and urgent patch notes arranged for fast daily scanning.
October 24, 2026
Latest reports
Netlogon CVE-2026-41089 RCE
CVE-2026-41089 is now reported as actively exploited. Patch Windows Server domain controllers and review Netlogon, LSASS, and authentication logs.
WP Maps Pro CVE-2026-8732
WP Maps Pro CVE-2026-8732 lets unauthenticated attackers create WordPress administrator accounts. Update to 6.1.1 and audit admins/logs.
Flowise Chatflow RCE
Flowise CVE-2026-40933 can turn a malicious chatflow import into server-side command execution. Check self-hosted instances, MCP stdio use, and stored secrets.
Dutch Botnet Takedown Cuts Off 17M Devices
Dutch police and NCSC took down a botnet of at least 17 million infected devices. Here is what to check on PCs, routers, and…
ChatGPhish AI Summary Phish
ChatGPhish shows how a web page summarized by ChatGPT can surface phishing links, fake alerts, and QR codes inside a trusted AI answer.
EMS Patch Trap
FortiClient EMS CVE-2026-35616 was abused to push EKZ Infostealer as a fake patch. Check EMS logs, managed endpoints, browser credentials, and hotfixes.
PAN-OS CVE-2026-0257: Ransomware Moves Beyond the VPN
Unit 42’s October 19 update links GlobalProtect exploitation to Qilin, Inc and a vCenter/VMDK credential-theft case. Patch, then investigate beyond the VPN.
Gogs RCE Zero-Day: Check Open Registration
Rapid7 disclosed a critical unpatched Gogs RCE path. Check open registration, repository creation, and rebase merge settings now.