A long password can bypass OpenSSH authentication on musl-based Linux like Alpine when PAM is off. Update to OpenSSH 10.6p2.

Any 257 to 1024 character password can bypass OpenSSH login on musl Linux with PAM off, and attacks have started. Update to 10.6p2.

Decoded in plain English on XploitDigest.

An APT flaw lets an on-path attacker swap a package after verification and run code as root on Debian and Ubuntu. Update APT now.

A TeamViewer flaw (CVSS 8.8) lets a compromised machine hijack the technician's PC. Update past 15.83.

A race condition in WordPress core upgrades exposes versions 4.7 through 7.1.3 to RCE, with more than 240,000 exploit attempts.

Attackers are chaining four Plex Media Server flaws to drop Monero miners and proxies on QNAP devices. Update to Plex 1.43.3.

An AI model wrote an exploit that gets root on Linux servers with multipath TCP. CVE-2026-98432 is CVSS 9.8; patch your kernels.

A CVSS 9.3 Barracuda Email Security Gateway flaw lets an unauthenticated attacker take over the appliance. Version 9.4.0.030 fixes it.

TL;DR Logto published four security advisories on November 9, 2026, for its open-source identity platform. The worst of these Logto vulnerabilities is rated CVSS 9.1. It lets an attacker with any Apple ID take over a victim's account. Other flaws bypass multi-factor authentication, skip SAML audience checks and crash the developer tunnel. Logto 1.45.0 and earlier contain an Apple sign-in account takeover, an MFA bypass and a SAML authentication bypass.

A Windows Paint zero-click flaw could let one crafted network packet run code on a PC with no logon and no user interaction.

Attackers are exploiting a max-severity Node-RED flaw in Siemens SIMATIC IoT2050 devices. Update to 4.3.4.1 or later.

TL;DR Roundcube released versions 1.6.21 and 1.7.6 on November 9, 2026, fixing 17 security bugs in its open-source webmail client. This Roundcube security update covers both the 1.6 LTS branch and the current 1.7 line. The bugs range from Sieve script injection to SSRF and CSRF bypasses. No CVE IDs or in-the-wild attacks have been confirmed so far. Admins should update all production servers now.

TL;DR The Apache Software Foundation disclosed 20 security flaws on November 9, 2026. Eighteen affect Apache Airflow, and two affect Apache Storm. These Apache Airflow vulnerabilities range from leaked secrets to code execution on Celery workers. Five of the 20 are rated high severity. Airflow 3.4.0 fixes deserialization, authorization and secret-masking bugs, including one that lets anyone with Celery broker access run code.

TL;DR JPCERT/CC has warned that attackers are exploiting CVE-2026-111793, an Openwave Webtop vulnerability in the Webtop Media Transcoder. According to the advisory, "The developer states that attacks exploiting the vulnerability have been observed." The flaw affects all versions before 1.1.22.0. Webtop Media Transcoder ignores the file type limits that administrators set. As a result, a logged-in user can convert document types the admin meant to block.

TL;DR The UnrealIRCd team says attackers are now exploiting CVE-2026-114713, a critical flaw in the open-source IRC server. "We are seeing bad guys exploiting this issue on the internet right now," the project warned. This UnrealIRCd vulnerability lets any ordinary user run commands with server or IRC operator authority. CVE-2026-114713 lets normal users inject server-to-server commands through the labeled-response module.

TL;DR Google has released Chrome 157.0.8103.50/.51 to fix nine security bugs, including a Chrome zero-day that attackers are already using. The flaw, CVE-2026-125350, is a use-after-free bug in Chrome's XML component. In its advisory, Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." Why It Matters A live exploit means attackers have a working weapon right now.

TL;DR Researcher Gaspar Onesto De Luca has released a working proof-of-concept exploit for CVE-2026-97798. This Windows Error Reporting vulnerability carries a CVSS score of 7.8. The PoC turns a standard user account into an interactive SYSTEM shell. Microsoft patched the flaw in its October 13, 2026, security updates. CVE-2026-97798 is an argument injection bug in the Time Travel Debugging path of Windows Error Reporting (WER).

TL;DR The OWASP ModSecurity project has published two advisories with full technical details, and one includes a working proof-of-concept request. These ModSecurity vulnerabilities, CVE-2026-104269 and CVE-2026-73857, can bypass upload rules or corrupt server memory. Both are fixed in libmodsecurity 3.0.17, released on September 29, 2026. CVE-2026-104269 (CVSS 8.6) lets attackers sneak a dangerous filename past OWASP CRS upload rules. CVE-2026-73857 (CVSS 7.5) can crash a web server worker with one crafted XML request.