Plex2Shell: Why QNAP Says Your Media Server May Already Be Compromised

Plex2Shell chains four Plex Media Server CVEs into code execution on QNAP and Synology NAS. Who is affected, how to check for compromise and how to clean up.

SSHole: The OpenSSH Bug That Turns "No Password" Into Root

OpenSSH CVE-2026-123158 (SSHole) lets attackers log in to passwordless accounts on Alpine and other musl systems. Who is affected, detection and fixes.

SonicWall SSL VPN SAML MFA Bypass: A Hunt and Harden Guide

CVE-2026-19868 lets SonicWall SSL VPN users skip SAML and MFA and is in CISA KEV. How to check exposure, patch, and hunt for logins your IdP never saw.

Hacked Freezers: What the Cold-Chain Attacks Mean and What to Do

Attackers hijacked refrigeration controllers across Europe, and FBI and CISA now warn cold-chain operators. What happened, who is at risk and a hardening checklist.

Poisoned Trackers: What APT29's Plerdy Hijack Means for Your Business

APT29 hijacked the Plerdy SEO tracker to attack site visitors' phones. What it means for businesses, and a plan to control third-party scripts and devices.

cPGuard Update Hijack: What Hosting Teams Must Do Now

Attackers pushed a fake cPGuard update that stole /etc/shadow, SSH keys and DB credentials from ~2,950 servers. Who is affected, IOCs and a recovery checklist.

Node-RED Under Attack: Find, Lock Down and Hunt CVE-2026-58115

CVE-2026-58115 is being exploited to plant bots and web shells via exposed Node-RED editors. How to find them, enable adminAuth and hunt for malicious flows.

The $6.3B Binance Heist Began on One Laptop: What to Do Now

Binance lost about $6.3B after a DevOps laptop was compromised; the FBI blames North Korea's TraderTraitor. What happened, who is affected and how to defend.

WordPress Upgrade-Window RCE: What Site Owners Must Do Now

WordPress 7.1.4 fixes CVE-2026-119977, an unauthenticated upgrade-window RCE now probed at scale. How it works, who is exposed, and how to block and patch.

Ivanti Connect Secure Zero-Day Chain: A Hunt and Harden Guide

UTA0576 chained three Ivanti Connect Secure zero-days to get root and raid Active Directory. How to patch, hunt from your SIEM and AD logs, and recover safely.

GitLab CVSS 10 Regex RCE Hits CISA KEV: What Self-Managed Admins Must Do

CISA adds GitLab CVE-2026-97229 to KEV after attacks on Alpine Linux. Which versions fix both CVSS 10 regex RCEs, the Ruby catch, detection and a response checklist.