[CRITICAL] – WooCommerce Wholesale Lead Capture Flaw Under Active Exploitation
Attackers are exploiting an unauthenticated file-upload flaw in WooCommerce Wholesale Lead Capture.
[HIGH] – Google Fixes Actively Exploited Pixel Modem Flaw
Google patched an actively exploited Pixel modem privilege-escalation flaw in its September update.
[MEDIUM] – DDRop Research Targets Confidential-Computing Memory Freshness
DDRop researchers demonstrate a DDR5 interposer attack against Intel and AMD confidential-computing technologies.
[HIGH] – LiteSpeed Enterprise Advisory Warns of Shared-Hosting Root Risk
cPanel urges LiteSpeed Enterprise administrators to update to 6.3.7 for a shared-hosting privilege-escalation flaw.
[HIGH] – Red Heron Exploits Gitea Flaw in Multinational Campaign
Acronis details Red Heron's Gitea exploitation, source-code theft, persistence, and lateral movement.
[CRITICAL] – Cisco Secure Email Gateway Zero-Day Under Active Exploitation
CISA added an actively exploited Cisco Secure Email Gateway SQL-injection flaw to KEV.
[MEDIUM] – ENISA Launches CRA Reporting Platform for Exploited Vulnerabilities
ENISA's new CRA portal centralizes manufacturer reporting of actively exploited vulnerabilities and severe incidents.
[MEDIUM] – Microsoft Confirms RDS Failures After September Security Updates
Microsoft confirms September security updates can disrupt Remote Desktop Services and supplies Known Issue Rollback policies.
[HIGH] – Telus Notifies Customers of Multi-Month Account Breaches
Telus says compromised credentials were used to access customer account records between February 2025 and June 2026.
[HIGH] – Revolut Discloses Customer Data Exposure Through Government Impersonation
Revolut says a government-domain impersonation scheme obtained sensitive records for a limited number of customers.