Tracked as CVE-2026-97229, the vulnerability has a maximum CVSS score of 10.0, making it a serious security risk for organizations using vulnerable GitLab installations. The issue affects both GitLab Community Edition (CE) and Enterprise Edition (EE), with patches released on October 12, 2026.

The flaw is linked to GitLab’s CI/CD regular expression compiler. If successfully exploited, it could put sensitive data, development projects, and server operations at risk. Administrators should review the affected versions and apply the available security updates as soon as possible.

How the GitLab Vulnerability Works

The vulnerability is caused by an integer overflow in the regular expression compiler used by GitLab’s CI/CD functionality. According to the security advisory, insufficient validation of regular expressions could allow an unauthenticated attacker to trigger arbitrary code execution by submitting a specially crafted expression in a CI/CD configuration.

Regular expressions are patterns used to search, match, and validate text. GitLab uses them in various processes, including CI/CD workflows. However, improper handling of specially crafted patterns can introduce security weaknesses.

In this case, an attacker could potentially exploit the flaw to execute code on the GitLab server. The published vulnerability information indicates that exploitation does not require authentication or user interaction, although the exact conditions needed to carry out an attack have not been fully disclosed.

This makes the vulnerability particularly concerning for organizations that host their own GitLab instances. Successful exploitation could affect the confidentiality, integrity, and availability of the server and its data.

GitLab credited security researcher joaxcar for reporting the issue through its HackerOne bug bounty program. The company has not stated in the cited advisory that the vulnerability has been exploited in real-world attacks.

Affected GitLab Versions and Security Updates

The vulnerability affects specific releases of GitLab Community Edition and Enterprise Edition. Administrators should check their installed versions against the following affected ranges and upgrade to the corresponding patched releases.

• GitLab 19.2: Versions before 19.2.8
• GitLab 19.3: Versions before 19.3.4
• GitLab 19.4: Versions before 19.4.2

GitLab has released security updates to address the vulnerability. Administrators running affected self-managed installations should upgrade to the appropriate patched version without delay.

According to the release notice, GitLab.com has already been updated, while GitLab Dedicated customers do not need to take action.

The same security release also addresses additional issues, including cross-site scripting (XSS), authorization weaknesses, and a prompt-related issue affecting GitLab Duo Agent Platform. Administrators should review the complete security advisory to understand all fixes included in the update.

One additional consideration is that GitLab 19.3.4 has a known issue affecting merge request pages when the Ona integration is enabled. Administrators should review the release notes and plan their upgrades accordingly while ensuring that security updates are not overlooked.

Security Recommendations

Organizations should treat this vulnerability as a high-priority patching issue because of its maximum severity rating and potential for unauthenticated code execution.

Administrators should identify all affected GitLab instances, confirm their installed versions, and apply the appropriate security updates. They should also review GitLab’s official advisory for any additional upgrade requirements or known issues.

Security teams should monitor server logs and CI/CD configuration changes for suspicious activity. Although monitoring cannot replace patching, it can help identify unusual behavior that may require further investigation.

Organizations should also follow secure CI/CD practices, restrict unnecessary access to development infrastructure, and keep GitLab components updated to reduce exposure to future vulnerabilities.

Conclusion: CVE-2026-97229 highlights the risks that can arise from flaws in CI/CD processing. With a CVSS score of 10.0 and the potential for unauthenticated remote code execution, the vulnerability requires prompt attention from administrators running affected GitLab versions. Applying the available patches and maintaining strong security controls can help protect development environments from potential attacks.

The post GitLab Security Flaw Puts Servers at Risk of Code Execution appeared first on First Hackers News.

The vulnerability is tracked as CVE-2026-65660 and has a CVSS score of 8.8. It affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

Since SharePoint environments can contain sensitive company documents and operate with powerful service accounts, a successful attack could potentially lead to credential theft, data theft, movement across the network, or continued access.

A Problem With SharePoint Security Checks

The vulnerability was discovered by Dinh Ho Anh Khoa from Viettel Cyber Security.

The issue involves SharePoint’s SafeControls protection, which is designed to prevent potentially unsafe server-side classes from being loaded while processing Web Part and page content.

The problem occurs when the ToolPane component handles specially crafted Register directives. An attacker can manipulate the way certain values are reconstructed, potentially changing the directive after SharePoint has already performed its security validation.

This can allow dangerous .NET classes to be registered and used as part of a code-execution chain.

The research demonstrated an attack chain involving XamlServices.Parse(), ExpandedWrapper, ObjectDataProvider, and LosFormatter.

The technique can also create an in-memory webshell, meaning an attacker may not need to leave a traditional webshell file on the server.

What Organizations Should Do

Microsoft released fixes for the vulnerability on August 11, 2026.

The affected SharePoint builds mentioned in the provided advisory are:

• SharePoint 2016: 16.0.5565.1001
• SharePoint 2019: 16.0.10417.20198
• SharePoint Subscription Edition: 16.0.19725.20522

Microsoft requires organizations to install all applicable update packages. SharePoint 2016 administrators may need to install both listed packages.

The research also points to a possible connection with an authentication weakness in ToolPane. Under certain configurations that allowed anonymous access, the vulnerabilities could potentially be chained to achieve pre-authentication remote code execution. The provided information says Microsoft addressed that anonymous-access route in its June 9, 2026 update.

Security teams should patch affected SharePoint servers, reduce unnecessary anonymous or internet-facing access, and review activity for suspicious Web Part requests.

During an investigation, teams should also examine IIS logs, ULS logs, Windows events, PowerShell activity, endpoint telemetry, unexpected processes, unusual assemblies, and memory activity.

SharePoint 2013 was also reportedly affected by the underlying technique, but that version reached end of support in 2023. Organizations still running it should consider migration or isolation rather than relying on a future security update.

The post SharePoint Vulnerability Enables Remote Code Execution appeared first on First Hackers News.

The vulnerability is particularly concerning because it can be exploited without authentication. An attacker who reaches a vulnerable Management Server may be able to upload and execute malicious scripts and load arbitrary Java classes.

Since these systems are used to manage security policies and collect information across enterprise networks, a successful compromise could give an attacker access to a highly privileged part of the security environment.

How the Zero-Day Works

CVE-2026-93616 involves a combination of directory traversal and unsafe file-upload behavior in the Check Point Management web service.

An attacker can manipulate file paths to make the service access files from unintended locations. According to Check Point, the vulnerability can also allow an attacker to load an arbitrary Java class without first logging in.

Check Point said it has observed a small number of targeted attacks. The company reported that the activity began before the vulnerability was publicly disclosed, which is why it is classified as a zero-day. The vendor has not publicly identified the attackers or disclosed the full objectives of the observed attacks.

Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent.

Which Versions Are Affected?

Check Point lists several affected releases, including older and currently supported versions. Administrators should check their exact release and Jumbo Hotfix level against the vendor’s advisory before deciding whether their systems are vulnerable.

Check Point says the fix is included in:

• R82.10 Take 45
• R82 Take 127
• R81.20 Take 170
• R81.10 Take 192

The company has also released an R82.20 Security Hotfix. Smart-1 Cloud is not affected because the required fix has already been applied.

What Security Teams Should Do

Organizations running affected Check Point Management products should prioritize applying the appropriate security update.

Until systems can be patched, Check Point recommends keeping Management Servers behind a Security Gateway or firewall and restricting TCP port 19009 to trusted IP addresses. Trusted Clients configured in SmartConsole should also be limited to known internal addresses.

Security teams should also review logs for signs of exploitation rather than checking only internet-facing systems. Check Point provides indicators and investigation guidance that can help identify suspicious activity.

If a vulnerable Management Server shows signs of compromise, teams should preserve relevant logs and forensic data, investigate activity that occurred after the initial access, and contact Check Point Support.

The active exploitation of this vulnerability shows why management infrastructure deserves the same patching priority as internet-facing security appliances. A compromised management server can potentially provide an attacker with access to a central administrative layer of an organization’s security environment.

The post Active Attacks Target Check Point 0-Day appeared first on First Hackers News.

Tracked as CVE-2026-76784, the flaw could allow an attacker on the same local network to send unauthorized commands to vulnerable devices. The issue has a CVSS v4.0 score of 8.7.

The vulnerability is caused by weaknesses in the security used to protect communication between Kasa devices and their local control components.

Attackers Could Manipulate Device Commands

An attacker does not need an account or special permissions to exploit the issue. However, they must have access to the same local network or wireless environment as the targeted device.

This could make shared Wi-Fi networks, compromised home networks, and poorly separated business networks potential attack environments.

Attackers could potentially capture legitimate device commands and reuse them or create their own commands.

Depending on the device, this could allow someone to:

• Turn smart plugs, switches, or lights on or off
• Interrupt connected appliances
• Change device behavior or schedules
• Repeatedly send commands and disrupt normal operation

The affected products include several Kasa smart plugs, switches, and the KL125 smart bulb, along with other models.

Firmware Updates Are Available

TP-Link has released updated firmware for affected products. Because firmware versions depend on the specific model, hardware revision, and region, users should check their exact device before installing an update.

Users can look for the latest firmware through the TP-Link Download Center or Kasa Smart app.

Until devices are updated, users and organizations can reduce their exposure by:

• Placing IoT devices on a separate network or VLAN
• Keeping smart devices away from sensitive systems
• Limiting access from guest networks
• Watching for unexpected device activity

The vulnerability is a reminder that smart home devices do not need to be directly exposed to the internet to become a security concern. An attacker who gains access to the local network may still be able to manipulate vulnerable IoT devices.

The post TP-Link Kasa Flaw Could Disrupt Smart Devices appeared first on First Hackers News.

The flaw allows remote, unauthenticated attackers to execute operating system commands with the privileges of the zimbra user. This creates a serious risk for organizations running internet-facing Zimbra mail servers.

How the Zimbra Flaw Can Be Exploited

The vulnerability is associated with Zimbra’s SNMP trap functionality. Exploitation is possible when the snmp_notify parameter is enabled and the swatchdog service is running.

Since swatchdog is enabled by default, systems using the affected SNMP configuration may be exposed without requiring an attacker to have valid credentials.

Successful exploitation could give attackers access to the underlying mail server, allowing them to run commands, create or modify files, steal email data, deploy web shells, establish persistence, or attempt to move deeper into the organization’s network.

Active Exploitation and Detection

CERT Polska has confirmed that the vulnerability is being used in an ongoing attack campaign, making this more than a theoretical security concern.

Zimbra has addressed the issue in version 10.1.20. Administrators should verify their installed version and upgrade affected systems as soon as possible.

Organizations that cannot patch immediately should review whether SNMP trap functionality is required and check if the snmp_notify configuration is enabled.

Security teams should also inspect /var/log/zimbra.log for unusual “Service status change” entries. Unexpected service names, commands, or changes between running and stopped states could indicate malicious activity.

It is also important to search for recently created or modified files owned by the zimbra user, particularly in:

• /opt/zimbra/jetty/webapps/
• /opt/zimbra/jetty_base/webapps/
• /tmp/

Look for unfamiliar JSP files, scripts, archives, executable files, or heavily obfuscated content. Unexpected outbound connections from the Zimbra server should also be investigated.

What Organizations Should Do

Organizations running vulnerable Zimbra installations should prioritize upgrading to version 10.1.20 or a later fixed release.

If compromise is suspected, isolate the affected server, preserve relevant logs and suspicious files for forensic investigation, rotate potentially exposed credentials, and check other connected systems for signs of lateral movement.

The active exploitation of CVE-2026-73570 highlights why internet-facing email infrastructure requires rapid patching and continuous monitoring. Patching should be followed by log analysis and threat hunting to ensure attackers have not already established persistence.

The post Critical Zimbra Bug Exploited in the Wild appeared first on First Hackers News.

The vulnerability allows remote attackers to execute commands on vulnerable devices without requiring authentication. Since LoadMaster appliances are commonly deployed at the network edge to manage application traffic, a successful attack could provide threat actors with an entry point into an organization’s infrastructure.

What Is the Vulnerability?

CVE-2026-8037 is a command injection vulnerability affecting the API component of Progress LoadMaster and related Application Delivery Controller (ADC) products.

The flaw occurs because certain user-supplied input is not properly validated before being processed by the operating system. As a result, attackers can craft malicious requests that force the appliance to execute unauthorized system commands.

Most importantly, the attack does not require valid login credentials, making internet-facing devices particularly vulnerable.

Why the Risk Is So High

Security researchers have assigned the vulnerability a CVSS score of 9.6, reflecting its critical severity.

Because LoadMaster appliances often sit at the perimeter of enterprise networks, compromising one could allow attackers to:

• Execute remote commands.
• Gain an initial foothold inside the network.
• Steal credentials.
• Move laterally to other systems.
• Deploy additional malware or backdoors.
• Modify device configurations.

Public proof-of-concept (PoC) exploit code is also available, making it easier for attackers to scan for and target vulnerable systems.

Active Exploitation Confirmed

According to CISA, the vulnerability is no longer a theoretical threat.

Evidence of active exploitation prompted the agency to add CVE-2026-8037 to its KEV catalog and advise affected organizations to apply vendor updates immediately.

Although there are currently no reports linking the flaw to ransomware campaigns, attackers are actively attempting to exploit vulnerable devices exposed to the internet.

Recommended Security Measures

Organizations using Progress LoadMaster should act immediately by:

• Identifying all affected LoadMaster appliances.
• Applying the latest security updates provided by Progress.
• Restricting management and API access to trusted networks or VPNs.
• Reviewing logs for unusual API requests and command execution attempts.
• Investigating unexpected configuration changes or unauthorized administrative activity.
• Conducting a full security assessment after patching to ensure attackers have not already established persistence.

The inclusion of CVE-2026-8037 in CISA’s Known Exploited Vulnerabilities catalog underscores the seriousness of this security issue. Since the vulnerability can be exploited without authentication and public exploit code is already available, organizations should prioritize patching affected LoadMaster systems and closely monitor their environments for signs of compromise.

Taking prompt action can significantly reduce the risk of attackers gaining access to critical network infrastructure.

The post CISA Warns of Active LoadMaster Attacks appeared first on First Hackers News.

According to security researchers at AISLE, the flaw could have allowed attackers to compromise a developer’s system simply by convincing them to click a malicious link embedded in a Git commit message.

The issue has now been fixed across all affected platforms, but it highlights the growing security risks facing modern AI-powered development tools.

How the Attack Worked

The vulnerability relied on a malicious link hidden inside a Git commit message.

If a developer clicked the link while viewing the commit inside one of the affected editors, arbitrary code could run automatically with the same permissions as the developer.

The attack required only a single click and did not display any warning, confirmation message, or security prompt, making the compromise difficult to notice.

What Attackers Could Do

Successful exploitation could have given attackers extensive control over a developer’s machine.

Potential impacts included:

• Stealing API keys and other sensitive credentials.
• Installing malware or keyloggers.
• Accessing, modifying, or deleting local files.
• Maintaining persistent access even after the editor was closed.

Because the malicious activity could remain hidden, developers might not realize their systems had been compromised.

Vulnerability Found Across Multiple Editors

AISLE first discovered the flaw in Microsoft VS Code during security testing in late 2025.

Since Cursor is built on the VS Code codebase, it inherited the same vulnerability. Later, researchers identified the identical issue in Google Antigravity, another AI-assisted coding environment based on the same architecture.

The discovery shows how a single vulnerability in a shared codebase can spread across multiple developer tools used by millions of people.

Vendors Released Security Fixes

After receiving responsible disclosure reports, all three vendors addressed the issue.

• Cursor released a security update shortly after notification.
• Google patched the vulnerability in Antigravity within days.
• Microsoft later released a fix for VS Code.

Current versions of all three editors are no longer affected.

Why This Matters

Many modern AI coding tools are developed using common open-source foundations such as VS Code. While this speeds up development and feature delivery, it also means a single security flaw can impact multiple products simultaneously.

This incident demonstrates the importance of continuous security testing and timely patch management, particularly for AI-powered development environments.

What Developers Should Do

Developers and organizations should take the following steps:

• Update VS Code, Cursor, or Google Antigravity to the latest version.
• Review recent Git activity for anything suspicious.
• Rotate API keys and credentials if older vulnerable versions were used.
• Monitor developer systems for unusual behavior or unauthorized access.

Keeping development tools fully updated and regularly reviewing credentials can help reduce the risk of future software supply chain attacks.

The post Critical Vulnerability Disclosed in VS Code, Cursor, and Google Antigravity appeared first on First Hackers News.

The vulnerability was first identified in Mozilla Firefox, and because Tor Browser is built on Firefox, it inherited the same security flaw until patches were released. Researchers from Nebula Security successfully demonstrated the exploit, highlighting the importance of keeping Tor Browser up to date.

How the Attack Works

The vulnerability exists within Firefox’s SpiderMonkey JavaScript engine, specifically in its Just-In-Time (JIT) compiler. This component improves browser performance by converting JavaScript into machine code while webpages are being loaded.

Researchers discovered that under certain conditions, the JIT compiler incorrectly manages memory during JavaScript optimization. This creates a use-after-free (UAF) vulnerability, allowing attackers to manipulate memory and execute arbitrary code within the browser process.

Unlike many browser attacks that rely on downloading malicious files or tricking users into approving software installations, this attack requires only that a victim visits a malicious webpage. Once the page loads, the exploit can be triggered automatically on vulnerable versions.

Why Tor Browser Users Are at Risk

Tor Browser is designed to protect users’ privacy and anonymity by routing internet traffic through the Tor network. However, browser-level vulnerabilities remain a significant risk because they can compromise the browser before Tor’s privacy protections can fully safeguard the user’s activity.

If attackers successfully exploit the browser, they may be able to:

• Execute malicious code on the victim’s system.
• Steal sensitive browser data.
• Bypass browser security protections.
• Potentially weaken a user’s privacy and anonymity.

This demonstrates that even privacy-focused browsers depend heavily on the security of their underlying browser engine.

Researchers Confirm the Exploit

According to the research, the vulnerability affects the browser’s JavaScript optimization process, where incorrect memory handling creates an opportunity for attackers to reuse invalid memory references. This can provide the building blocks needed to gain greater control over the browser process.

The researchers responsibly disclosed the vulnerability to Mozilla, allowing security updates to be developed and released before detailed technical information became widely available.

Security Updates Are Available

Mozilla addressed the vulnerability in Firefox 151.0.3, while the Tor Project later incorporated the fix into Tor Browser 15.0.19.

Users running the latest Tor Browser release are protected against this specific vulnerability. Anyone using older versions should update immediately to reduce the risk of exploitation.

How to Stay Protected

The best defense against browser-based attacks is to keep software fully updated. Users should always download Tor Browser from the official Tor Project website and install new security updates as soon as they become available.

In addition, organizations and individuals should:

• Keep Tor Browser updated to the latest version.
• Apply Firefox security updates promptly.
• Avoid visiting suspicious or untrusted websites.
• Use endpoint security solutions that can detect suspicious browser activity.
• Monitor systems for unusual processes or unexpected browser behavior.

Conclusion

The discovery of CVE-2026-10702 serves as a reminder that browser vulnerabilities can pose serious risks, even for applications built around privacy and anonymity. While the Tor network provides strong protection against online tracking, it cannot compensate for vulnerabilities within the browser itself. Regular software updates, timely patch management, and safe browsing practices remain essential for protecting both security and privacy against evolving browser-based threats.

The post New Attack Puts Tor Browser Users at Risk appeared first on First Hackers News.

The vulnerabilities, identified as CVE-2026-15409 and CVE-2026-15410, were observed being exploited before public disclosure. Because of the active attacks, both flaws have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, emphasizing the need for immediate action.

Exploitation Chain

The first vulnerability allows an unauthenticated attacker to reach internal services that are normally protected from external access. This provides an entry point to the appliance and enables attackers to execute commands with limited privileges.

The second vulnerability can then be used to escalate those privileges to root by abusing the appliance’s update and rollback process. Once exploited, attackers can run malicious scripts with full administrative permissions, giving them complete control over the system. Researchers also noted that the appliance may reboot after exploitation, which can make incident investigation more difficult.

Affected products include SonicWall SMA 1000 Series devices running vulnerable releases in the 12.4.3 and 12.5.0 software branches. SonicWall has confirmed that the SMA 100 Series and SSL VPN functionality on SonicWall firewalls are not affected.

Security Recommendations

Organizations using affected SonicWall SMA 1000 appliances should install the latest security hotfixes released by SonicWall as soon as possible, as no alternative mitigation is currently available.

In addition to patching, security teams should inspect appliances for signs of compromise, re-image affected systems if necessary, rotate administrator and user credentials, reset multi-factor authentication tokens following a confirmed breach, and continue monitoring VPN infrastructure for suspicious activity.

Applying the latest updates and reviewing exposed appliances promptly will help reduce the risk of compromise from these actively exploited vulnerabilities.

The post Attackers Target SonicWall SMA1000 Zero-Days appeared first on First Hackers News.

The vulnerability is linked to insecure cloud permissions and a built-in command execution feature found in certain Shark vacuum firmware. At the time of disclosure, no official patch had been released.

How the Vulnerability Works

Researchers found that the issue affects internet-connected Shark robot vacuums that communicate through AWS IoT services. By exploiting weak cloud permissions, an attacker who gains access to one vulnerable device could potentially interact with other Shark vacuums connected to the same cloud environment.

The most serious concern is a command execution feature that allows specially crafted messages to run commands on the device. During testing, researchers successfully demonstrated that credentials taken from one Shark vacuum could be used to execute commands on another compatible device.

Some Shark models also include cameras and store household maps for navigation. Researchers warned that a successful attack could allow unauthorized access to:

• Live camera feeds on supported models
• Home mapping data
• Stored Wi-Fi credentials
• Remote control of the vacuum
• Device information and telemetry

The research also identified a large number of active Shark devices communicating with the affected cloud infrastructure, indicating that the potential impact could be significant.

Recommended Security Measures

Until an official fix is released, Shark robot vacuum owners should take steps to reduce their exposure.

Recommended actions include:

• Keep the vacuum firmware updated with the latest available version.
• Monitor SharkNinja for future security updates and advisories.
• Place smart home and IoT devices on a separate Wi-Fi network whenever possible.
• Regularly review your home network for unknown or suspicious devices.
• Remove unused smart devices from your network.
• Change your Wi-Fi password if you suspect unauthorized access.

This vulnerability highlights the growing importance of securing Internet of Things (IoT) devices. As more connected devices become part of everyday life, regular updates, network segmentation, and strong security practices remain essential for protecting home networks and personal data.

The post Critical Flaw Found in Shark Robot Vacuums appeared first on First Hackers News.