Application Security

The latest breaches, scams and hacks in plain English, newest first.

13 stories · Page 1 of 2

Generic server rack with computer equipment

Vulnerabilities

Critical Ghostscript flaw could let hackers take over servers via PDF uploads

A newly discovered Ghostscript vulnerability (CVE-2026-39919) could let attackers run code on servers through malicious PDF uploads. The flaw affects many systems, including WordPress sites using Ghostscript for PDF processing.

13 Oct 20263 min read

Vulnerabilities
Docker Hub flaw could have let attackers impersonate users and tamper with images
A critical vulnerability in Docker Hub allowed attackers to impersonate users and alter container images. Docker says it found no evidence of abuse before fixing the flaw.
13 Oct 20263 min read
Vulnerabilities
Critical GitLab flaw could let attackers take over servers: update now, says CERT-EU
A critical vulnerability in GitLab CE and EE could let attackers run code on servers. CERT-EU urges all users to update to the latest version immediately.
12 Oct 20262 min read
Vulnerabilities
Critical Bricksforge WordPress Plugin Flaw Under Active Attack: Unauthenticated Remote Code Execution Possible
A severe flaw in the Bricksforge WordPress plugin (CVE-2026-85097) is being actively exploited, allowing attackers to take over vulnerable sites without logging in. Patches are available, but site owners must act quickly.
12 Oct 20263 min read
Identity
Malicious GitHub Actions Workflows Stole Credentials from Thousands of Repositories
Attackers used compromised maintainer accounts to plant credential-stealing workflows in tens of thousands of GitHub repositories, targeting developer secrets and cloud credentials.
9 Oct 20263 min read
Vulnerabilities
Citrix urges urgent patching for critical NetScaler vulnerability
Citrix has fixed a critical flaw in NetScaler ADC and Gateway that could let attackers run code or disrupt services. No attacks are known yet, but users are urged to patch immediately.
9 Oct 20263 min read
Vulnerabilities
FortiBleed Attack Locks Organisations Out of Fortinet Firewalls Worldwide
Criminals using stolen credentials are locking IT teams out of Fortinet firewalls, with over 86,000 devices affected globally. The FBI and Secret Service urge urgent action to prevent further lockouts and ransomware attacks.
6 Oct 20263 min read
AI Security
Wikimedia says unauthorised OpenAI bots edited sites and caused outage
Wikimedia claims OpenAI's AI agents made unauthorised edits and millions of requests, leading to a partial outage in May. No user data was compromised, but the foundation warns of growing risks from AI bots.
6 Oct 20263 min read
Vulnerabilities
Atlassian flaw lets attackers read files in Jira, Confluence and more without logging in
A critical flaw in Atlassian's self-hosted products lets attackers read certain files without logging in. Exploitation began within hours of public disclosure, affecting Jira, Confluence, Bitbucket and others.
6 Oct 20263 min read
Vulnerabilities
Critical Flaws Found in Viidure Dashcam Android App Could Expose User Data
CISA warns that two severe vulnerabilities in the Viidure Dashcam Android app could let attackers access, change, or delete sensitive data. No public attacks are known yet, but users are urged to update and secure their devices.
29 Sept 20262 min read

The day's cyber news in 5 minutes.

Cyberend Daily is one short email with the stories that matter, written so anyone can follow.

No spam · 100% free · Unsubscribe anytime