Exploited & critical
CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux
CVE-2026-123158 (*sshole) enables an OpenSSH authentication bypass on Alpine Linux. Review lab results, exposure conditions, fixes, and mitigations.
LXD has restricted project bypass leading to arbitrary command execution
Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qe
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file write on client due to trusted image hash
Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the serve
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has argument injection in backup compression algorithm leading to AFW and ACE
Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly le
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it se
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file read+write on host via templates/ symlink in malicious image
Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/sto
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260203144152-d1c8ba15d160 or later.
Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. [...]
LXD has arbitrary file write on host via exec-output symlink in crafted image
Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named exec
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260626085134-124f90100640 or later.
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacke
D-Link warns of multiple zero-days in DGS-3130 Series switches
D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches. [...]
More from Exploited & critical
Actively exploited: SonicWall SonicOS SSLVPN (CVE-2026-19868)
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Hackers backdoor Linux servers using trojanized CWP web server
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
Vercel rolls out new protection against stolen session cookie attacks
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
NIKKE PC game launcher hacked to spread remote access, data-stealing malware
Google Calendar phishing campaign hijacks sessions, bypasses MFA
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
CISA flags WordPress RCE flaw as actively exploited in attacks
Actively exploited: Apple Multiple Products (CVE-2024-27834)
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Binance says fake job interview led to $6.3 billion crypto heist
Google: LLMjacking attacks rack up $1 million in cloud AI charges
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered .constructor member access
Elo Ruby backend has Remote Code Execution via unescaped #{...} interpolation in emitted string literals and subtype-constraint labels
cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
Malicious Files: Find What Supply Chain Attacks Leave Behind in Your GitHub Repositories and on Developer Machines
Actively exploited: WordPress WordPress Core (CVE-2026-119977)
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
Composer 2.11 Adds Dependency Cooldowns
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
Ivanti patches two more Connect Secure zero-days chained in attacks
Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)
Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
Threat Researcher’s Notebook: How Attackers Redirect Crypto Payments