OpenSSH SSHole Flaw Exploited Within Hours on Alpine
The OpenSSH SSHole flaw, tracked as CVE-2026-123158, is already under attack. Threat intelligence firm Previdian saw the first exploitation attempt less than nine hours after the CVE went public. It also confirmed root access on an Alpine Linux honeypot.…
Read More
WordPress Core Flaw Exploited: CISA Adds CVE-2026-119977 to KEV
Attackers are now exploiting a WordPress core flaw, so site owners should check their version today. The bug sits in how WordPress installs full-package core updates, and it can let an unauthenticated attacker run code on a site. The US cybersecurity…
Read More
ChatGPT Shared Links Could Run Attacker Code, and OpenAI Patched It
Security firm Parameter found a flaw in ChatGPT’s shared-link feature. A malicious link could run attacker code in the session of anyone who opened it. Parameter reported the bug to OpenAI on October 18 through OpenAI’s bug bounty program.…
Read More
GitLab CVE-2026-97229 Has a Public Exploit: Patch Now
GitLab CVE-2026-97229 has the highest severity score a bug can get, a 10.0 out of 10, and a working proof-of-concept exploit is now public. The flaw lets an attacker run code on a self-managed GitLab server without logging in. If your team runs its own…
Read More
PHP2Shell: Critical PHP Flaws Are Under Attack, and Most Websites Need to Update Now
Hackers are already trying to exploit PHP2Shell, two critical flaws in PHP, the programming language behind roughly 70% of websites, including those built on WordPress. The PHP project released emergency fixes on October 21. The US National Security…
Read More