Security alerts and urgent notes on vulnerabilities that affect websites and servers, with what to do now.
Alerts ·
CISA confirms active attacks on CVE-2026-111357 in Ivanti Connect Secure. Attackers chain it with CVE-2026-104935 and CVE-2026-118527. Apply Ivanti's mitigations and check gateways for signs of compromise.
Alerts ·
A use-after-free in the Linux kernel's IPv4 TCP handshake code (CVE-2026-98432, CVSS 9.8) can be triggered during connection setup. Install your distribution's kernel update and reboot.
Alerts ·
An OS command injection in the Collabora Online built-in CODE server for Nextcloud allows remote code execution and is being actively exploited. Update or disable the app now.
Alerts ·
An actively exploited flaw in GitLab Community and Enterprise Edition (CVE-2026-97229, CVSS 10) lets unauthenticated attackers run code on the server through a crafted regular expression in CI/CD configuration. Update self-managed instances now.
Alerts ·
A missing authorization check in the CryptoPayment Gateway WordPress plugin 1.2.1 to 1.2.2, known since September 2026, is now being exploited. Attackers can delete files, change payment settings and read wallet credentials.
Alerts ·
CVE-2026-41709 in Broadcom VMware ESX, public since July 30, 2026, lets an attacker with admin access perform certain operations without being logged. CISA confirmed active exploitation on October 28, 2026.
Alerts ·
An actively exploited file upload vulnerability in Adobe Commerce and Magento (CVE-2026-48356, CVSS 9.3) can lead to arbitrary code execution. Apply Adobe's APSB26-73 update and check your shops for signs of compromise.
Alerts ·
A Linux kernel flaw in IPsec ESP input processing, CVE-2026-46300, is being actively exploited. Chained with two other CVEs, it is used to implant PHP webshells and run commands as root.
You came through a link of one of our partners. With your consent we remember this in a cookie for 90 days, so the person who recommended us receives their commission even if you sign up later. It costs you nothing.
Privacy policyThese are all cookies and browser entries we use on centoculus.com and app.centoculus.com. We use no analytics or advertising cookies and load no third-party services. Necessary cookies keep forms and sign-in working; partner attribution is only set with your consent.
These cookies and entries are needed to run the website and the service and cannot be switched off. They are not used for advertising or analytics.
Remembers the code of the partner whose link you came through for 90 days. If you sign up within this time, your account is assigned to that partner and they receive a commission. Without consent only the code in the address or a promo code you enter yourself counts.
You can change or withdraw your choice at any time under "Cookie settings" at the bottom of every page. Privacy policy