Critical SonicWall Vulnerability Exploited in Attacks Following Disclosure

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical SonicWall SMA1000 flaw, CVE-2026-102255 (CVSS 10.0), is being actively exploited days after disclosure, allowing unauthenticated attackers to make vulnerable appliances send requests on their behalf. Threat intelligence firms detected exploitation attempts beginning October 8, two days after SonicWall …

Massive DDoS Attack Disrupts Ubuntu’s Canonical Websites and Security APIs

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Canonical, the company behind Ubuntu Linux, suffered a sustained distributed denial-of-service attack on October 8, 2026, disrupting its main websites and security information services. The outage lasted four hours and 12 minutes, according to OMG! Ubuntu. It was Canonical’s second …

Yandex Data Center Outage Disrupts Access to Cloud Files Following Drone Attack

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Yandex has confirmed a major service outage after drone attacks damaged three data centers in Russia, leaving some users unable to access cloud files. Two facilities stopped operating, while a third lost part of its infrastructure. The disruption affected Yandex …

WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Attackers are targeting a critical security flaw in the Bricksforge WordPress plugin that lets them upload and run arbitrary PHP code without logging in. Tracked as CVE-2026-85097, the vulnerability carries a maximum CVSS score of 10.0 and can lead to …

LG webOS Flaws Let Remote Attackers Execute Commands as Root Without Authentication

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Security researchers have disclosed four serious vulnerabilities in LG webOS smart TVs that could allow an attacker to bypass authentication, create a privileged account, and ultimately execute commands with root-level access. The flaws, tracked as CVE-2023-6317 through CVE-2023-6320, affect selected …

Ahold Delhaize Takes Systems Offline Following Cybersecurity Incident

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Ahold Delhaize has taken some systems offline after identifying a security issue within its network, the food retail group said on October 12, 2026. The company, based in Zaandam, the Netherlands, said its teams were assessing the issue and taking …

Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical vulnerability in Google’s shared DevSite platform could have allowed an unauthenticated attacker to forge Flask session cookies and trigger remote code execution across several Google-owned developer websites, according to researcher Simon Koeck. The issue affected the OAuth flow …

Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

GitLab has released urgent security updates to fix a critical vulnerability that could allow attackers to execute arbitrary code on affected servers without logging in. Tracked as CVE-2026-97229, the flaw carries the maximum CVSS score of 10.0 and affects both …

WhatsApp Attachment Deploys Malware That Gains SYSTEM Access on Windows

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A malicious WhatsApp attachment is being used to deploy a Windows remote access trojan that can reach SYSTEM-level access, giving its operators deep control over infected machines. The campaign begins with a ZIP archive carrying a financial-document lure and an …

Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A Google account phishing kit uses live WebSocket connections to guide victims through fake sign-in screens, relay authentication requests, and steal authenticated sessions. The campaign shows how attackers can get past MFA by forwarding login steps in real time rather …