> infrastructure security
for people who build things
Tracking vulnerabilities, supply chain attacks, and threat intelligence that matters to engineers running real infrastructure.
Plex2Shell: Four-CVE Plex Media Server Chain Exploited Within a Day of PoC Release, Dropping XMRig and Proxy Malware
A public exploit chain for Plex Media Server (CVE-2026-96652, -96654, -96655, -96656) goes from SSRF to code execution; attackers began dropping XMRig and a proxy tool less than 24 hours after the PoC appeared.
PwnEscape (CVE-2026-99999): Linux Kernel Checksum Bug Lets KVM Guests Read and Corrupt Host Memory
PwnEscape, a Linux IPv4 checksum-validation flaw (CVE-2026-99999), lets a malicious guest leak host memory on KVM hosts using virtio-net/TAP networking; a leak was demonstrated against Vercel's production sandboxes.
Nextcloud Built-in CODE Server CVE-2026-110447: Unauthenticated Command Injection Exploited for Webshells Since September
A critical OS command injection in the Collabora-based built-in CODE server app for Nextcloud (richdocumentscode) has been exploited in the wild since about September 10; the CVE was published October 14, over a month after the patch.
Patching Is Not Eviction: What Ivanti, BeyondTrust, and NetScaler Teach Us About Post-Patch Compromise
Three edge-appliance zero-days in six weeks, three different persistence models, and one shared lesson: the patch closes the door but doesn't remove whoever is already inside. A practical playbook for compromise assessment after you upgrade.
SonicWall SMA1000 CVE-2026-102255: CVSS 10.0 Pre-Auth SSRF Probed Within Two Days of Patch
SonicWall's SNWLID-2026-0017 patches CVE-2026-102255, a maximum-severity pre-auth SSRF in SMA1000 that attackers reach an internal CouchDB through; exploitation attempts began two days after the fix.
GhostAction Returns: Stolen PATs Used to Push Malicious GitHub Workflows Across 30,000 Repositories
GitGuardian reports a resurgent GhostAction campaign: about 1,900 hijacked GitHub accounts pushed fake security workflows to harvest CI/CD secrets, with a spike on October 8-9 targeting over 30,000 repositories.
PEERSTITCH: Memory-Only FortiGate Implant Deployed via FortiOS CVE-2025-61624 After FortiManager Breach
Unit 42 details PEERSTITCH, a fileless implant injected into FortiOS miglogd and iked after FortiJump and a CVE-2025-61624 path traversal gave root on FortiGate firewalls.
BeyondTrust Remote Support CVE-2026-102764: Unauthenticated File-Operation Zero-Day Exploited by China-Linked Armory Castle
A CVSS 4.0 9.3 unauthenticated flaw in self-hosted BeyondTrust Remote Support has been exploited since late August by a China-linked cluster Google tracks as Armory Castle; patch BT26-05-RS and assume compromise on exposed appliances.
October Patch Tuesday Hits a Record ~1,400 CVEs; Windows Shell Mark-of-the-Web Zero-Day Exploited
Microsoft's largest Patch Tuesday yet fixes roughly 1,400 CVEs, including an actively exploited Windows Shell Mark-of-the-Web bypass and two publicly disclosed .NET-related zero-days.
Cisco Secure Email Gateway CVE-2026-76519: Unauthenticated Root File Write via AMP Exploited in the Wild
Cisco confirms in-the-wild exploitation of CVE-2026-76519, a CVSS 9.8 path traversal in Secure Email Gateway's AMP File Reputation that lets unauthenticated attackers write files and run commands as root.
Palo Alto PAN-OS CVE-2026-0322: Management Interface Code Injection Gives Root on Firewalls, Exploited as Zero-Day
Palo Alto Networks patched CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets an authenticated attacker run code as root; limited exploitation observed and CISA has added it to KEV.
Ivanti Connect Secure CVE-2026-104935: Auth-Bypass Zero-Day Chained to Root by UTA0576, Added to CISA KEV
Ivanti patched an authentication-bypass-by-spoofing zero-day in Connect Secure that Volexity saw chained with a still-unpatched privilege escalation for root access. CISA added it to KEV with an October 16 deadline.
CVE-2026-97229: Maximum-Severity Integer Overflow in GitLab's CI/CD Regex Compiler Allows Code Execution
GitLab patched a CVSS 10.0 integer overflow in the CI/CD regular expression compiler that lets a crafted pipeline expression execute code on self-managed servers.
CVE-2026-61500: Rejetto HFS Predictable Session Key Gives Unauthenticated Admin and RCE, Probed Within a Day
Rejetto HFS 3.x signs sessions with a key derived from Math.random() and leaks its outputs at login, letting unauthenticated attackers forge admin sessions and run server-side JavaScript; scanning from China began October 1.
Atlassian CVE-2026-21589: Unauthenticated File Read Hits Eight Data Center Products
Atlassian's emergency advisory for CVE-2026-21589, a CVSS 9.3 pre-auth arbitrary file read affecting Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center.
DirtyAH6, TUNderflow, PPPoEject, DiagSpill: Four Public Linux Kernel Root Exploits Land in the Networking Stack
Researcher Asim Manizada published working local-root exploits for four Linux kernel networking-stack flaws, three reachable via unprivileged user namespaces, one via SCTP diag with no special privileges.
CVE-2026-72018: AI Agent Turns a 16-Byte Linux Kernel Zero-Write Into Local Root
XBOW's autonomous agent found and weaponized a missing bounds check in the Linux kernel's DIBS loopback driver (SMC-D), escalating a constrained out-of-bounds write to root via cred structure corruption.
SubQuery's @subql/common Hijacked on npm: Credential Stealer and Reverse Shell in 5.8.3
A malicious @subql/[email protected] on npm steals cloud, SSH, GitHub and Kubernetes credentials, opens a reverse shell, and persists by injecting a rogue GitHub Actions workflow with stolen tokens.
CVE-2026-88779: NetScaler SAML Memory Overflow Zero-Day Crashes Auth, Hits Freshly Patched Appliances
Citrix confirms exploitation of a NetScaler ADC/Gateway SAML memory overflow (CVSS 8.7) that crashes authentication services; honeypot data suggests appliances patched for the previous batch are also being hit.
AhsayCBS CVE-2026-105134: Unauthenticated OS Command Injection (CVSS 10) in Backup Server
A CVSS 10 OS command injection in the AhsayCBS Replication Receiver endpoint allows unauthenticated remote code execution on backup servers up to 10.3.2. Upgrade to 10.3.4.