CVE-2026-21509

Overview

Microsoft
Microsoft Office 2019

26 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

13.01%

MITRE

KEV

Description

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

Statistics

22 Posts
6 Interactions

Last activity: 2 hours ago

Fediverse

Ed Bilodeau @edbilodeau

ICYMI: "Customers running Office 2021 and later will be automatically protected via a service-side change, but will be required to restart their Office applications for this to take effect."

#microsoft365

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

1
1
0
22h ago

:awesome:🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉 @nemo

Microsoft has rushed out an emergency security update for Office (CVE‑2026‑21509) after confirming the flaw is already being exploited in the wild. 🔐

The high‑severity security feature bypass lets attackers bypass OLE protections and run malicious code via specially crafted Office files. 📄⚠️

👉 Microsoft issues emergency fix for actively exploited Office flaw:
https://cyberinsider.com/microsoft-issues-emergency-fix-for-actively-exploited-office-flaw/
#Microsoft #Office #Security #CVE202621509 #PatchNow

Threre is also #OnlyOffice

https://www.onlyoffice.com/download-desktop

1
0
0
2h ago

WinFuture.de @WinFuture

Microsoft veröffentlicht Notfall-Update für kritische Office-Sicherheitslücke CVE-2026-21509, die bereits aktiv ausgenutzt wird. Betroffen sind Versionen von Office 2016 bis #Microsoft365. https://winfuture.de/news,156440.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

0
1
1
19h ago

Jeff Hall - PCIGuru :verified: @jbhall56

The vulnerability, tracked as CVE-2026-21509, carries a CVSS score of 7.8 out of 10.0. It has been described as a security feature bypass in Microsoft Office. https://thehackernews.com/2026/01/microsoft-issues-emergency-patch-for.html

0
0
1
23h ago

Patrick C Miller :donor: @patrickcmiller

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation https://thehackernews.com/2026/01/microsoft-issues-emergency-patch-for.html

0
0
1
22h ago

:mastodon: decio @decio

[VULN] ⚠️"Une faille de Microsoft Office est activement exploitée par des pirates "

(NdR : cybercriminels et/ou opérateurs malveillants agissant pour le compte d’une entité soutenant les intérêts géopolitiques d’un État)

"Microsoft alerte sur une nouvelle faille critique dans Office. Déjà exploitée par des cybercriminels, la vulnérabilité permet de désactiver la sécurité mise en place par Microsoft. L’éditeur a commencé à déployer d’urgence un correctif pour Microsoft 365 et les versions récentes d’Office.

…

Pour protéger les internautes contre les attaques en cours, Microsoft a déployé une mise à jour qui « corrige la vulnérabilité qui contourne les mesures d’atténuation » d’Office. Les utilisateurs de Microsoft 365 et Microsoft Office sont invités à installer le correctif sans tarder.

Les utilisateurs d’Office 2021 et des versions ultérieures « seront automatiquement protégés grâce à une modification côté serveur, mais devront redémarrer leurs applications Office pour que cette modification prenne effet ». Il n’y a donc rien à faire, sauf redémarrer vos applications. Enfin, Microsoft n’a pas encore corrigé le tir sur Office 2016 et 2019. En attendant un correctif, Microsoft propose des mesures d’atténuation à ses utilisateurs."
👇
https://www.01net.com/actualites/faille-microsoft-office-activement-exploitee-pirates.html

🔬
⬇️
https://vulnerability.circl.lu/vuln/CVE-2026-21509

📜
⬇️
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

💬
⬇️
https://infosec.pub/post/41135178

#CyberVeille #Microsoft #CVE_2026_21509

0
0
0
21h ago

Anonymous :verified: @youranonnewsirc

Here's a summary of recent important global, technology, and cybersecurity news:

Global: India has contained a Nipah virus outbreak (Jan 28, 2026). The EU approved a ban on Russian gas imports, effective from 2027 (Jan 27, 2026).

Technology: The EU is pressing Google to share AI and search data under new regulations (Jan 27, 2026). Samsung is nearing Nvidia approval for advanced HBM4 AI memory chips (Jan 27, 2026). Fujitsu developed AI for space weather prediction (Jan 28, 2026).

Cybersecurity: Microsoft issued emergency patches for an actively exploited Office zero-day vulnerability (CVE-2026-21509) (Jan 27, 2026). Fortinet patched a critical FortiOS SSO authentication bypass (CVE-2026-24858) under active exploitation (Jan 28, 2026). AI-powered polymorphic phishing attacks are also a growing concern (Jan 28, 2026).

#News #Anonymous #AnonNews_irc

0
0
0
2h ago

Bluesky

Hackmanac @hackmanac.com

‼️Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation Microsoft has issued an out-of-band emergency patch for a high-severity Microsoft Office zero-day, CVE-2026-21509 (CVSS 7.8), which is being actively exploited.

1
1
0
3h ago

Ninja Owl @ninjaowl.ai

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...

0
0
0
20h ago

Tech Insights @techinsights.bsky.social

Microsoft just patched a critical Office zero-day (CVE-2026-21509) being actively exploited—check if your version (2016, 2019, 365, LTSC) is vulnerable and get the urgent fix steps here. https://biggo.com/news/202601271624_Microsoft_Office_Zero-Day_Vulnerability_Patch #MicrosoftOffice #CVE202621509

0
0
0
18h ago

Ethical Hacking Consultores @ehcgroup.bsky.social

Microsoft revela una vulnerabilidad de día cero de Office explotada activamente y ofrece una solución de emergencia (CVE-2026-21509). Se recomienda a los usuarios y administradores revisar el aviso e implementen actualizaciones o mitigaciones lo antes posible. www.linkedin.com/pulse/micros...

0
0
0
18h ago

CyberVeille @cyberveille-ch.bsky.social

📢 Correctif d'urgence de Microsoft pour une zero‑day Office (CVE‑2026‑21509) activement exploitée 📝 Source: BleepingComputer — Microsof… https://cyberveille.ch/posts/2026-01-27-correctif-d-urgence-de-microsoft-pour-une-zero-day-office-cve-2026-21509-activement-exploitee/ #CVE_2026_21509 #Cyberveille

0
0
0
17h ago

キタきつね @kitafox.bsky.social

攻撃を受けている：Microsoft、実環境で悪用されたOfficeゼロデイ脆弱性（CVE-2026-21509）を修正 Under Attack: Microsoft Patches Office Zero-Day (CVE-2026-21509) Exploited in the Wild #DailyCyberSecurity (Jan 27) securityonline.info/under-attack...

0
0
0
13h ago

キタきつね @kitafox.bsky.social

マイクロソフト、Office のゼロデイ脆弱性を積極的に悪用される脆弱性を公開、緊急修正を提供 (CVE-2026-21509) Microsoft reveals actively exploited Office zero-day, provides emergency fix (CVE-2026-21509) #HelpNetSecurity (Jan 27) www.helpnetsecurity.com/2026/01/27/m...

0
0
0
13h ago

キタきつね @kitafox.bsky.social

Microsoft Office ゼロデイ脆弱性 (CVE-2026-21509) - アクティブな悪用に対する緊急パッチがリリースされました Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation #HackerNews (Jan 27) thehackernews.com/2026/01/micr...

0
0
0
13h ago

セキュリティ対策Lab @securitylab-jp.bsky.social

Microsoft、1月のアップデート後不具合やOfficeへのゼロデイ脆弱性を修正(CVE-2026-21509) rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security #サイバー攻撃 #CybersecurityNews

0
0
0
12h ago

Information Security Briefly @infosecbriefly.bsky.social

CVE-2026-21509 allows attackers to bypass Microsoft Office OLE security, enabling execution of embedded COM/OLE components via malicious documents, prompting emergency out-of-band updates.

0
0
0
12h ago

guardian360.bsky.social @guardian360.bsky.social

Microsoft on Monday issued out-of-band security patches for a high-severity Microsoft Office zero-day vulnerability exploited in attacks. The vulnerability, tracked as CVE-2026-21509, carries a CVSS score of 7.8 out of 10.0.

0
0
0
3h ago

Michael Wyres @mwyr.es

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued For Active Exploitation - https://mwyr.es/NBH7EDof #thn #infosec

0
0
0
2h ago

CVE-2026-24858

Overview

Fortinet
FortiAnalyzer

27 Jan 2026

Published

28 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.4)

EPSS

Pending

MITRE

KEV

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Statistics

16 Posts
20 Interactions

Last activity: Last hour

Fediverse

TeaJay @apjone

CVE-2026-24858

..... Allows an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts.....

https://fortiguard.fortinet.com/psirt/FG-IR-26-060

3
2
0
4h ago

Dark Web Informer :verified_paw: @DarkWebInformer

‼️CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Severity: Critical
CVSS: 9.8
Zero Day: Yes
CVE Published: January 27th, 2026

Advisory: https://github.com/advisories/GHSA-2x38-48vp-w23x

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

1
3
0
11h ago

TheHackerWire @thehackerwire

🔴 CVE-2026-24858 - Critical (9.8)

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
15h ago

circl @circl

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS ...

🔗 https://db.gcve.eu/vuln/cve-2026-24858

#fortinet #vulnerabilitymanagement #cybersecurity

0
0
0
6h ago

小津 Ozu @ozu

CVE-2026-24858
An attacker with basic FortiCloud account and a registered device can log into other Fortinet devices. No, not their own devices. Devices registered to entirely different FortiCloud accounts.

0
0
0
1h ago

benzogaga33 :verified: @benzogaga33

Fortinet coupe le SSO en attendant les patchs pour la nouvelle faille zero-day : CVE-2026-24858 https://www.it-connect.fr/fortinet-coupe-le-sso-en-attendant-les-patchs-pour-la-nouvelle-faille-zero-day-cve-2026-24858/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Fortinet

0
0
0
Last hour

Anonymous :verified: @youranonnewsirc

Here's a summary of recent important global, technology, and cybersecurity news:

Global: India has contained a Nipah virus outbreak (Jan 28, 2026). The EU approved a ban on Russian gas imports, effective from 2027 (Jan 27, 2026).

Technology: The EU is pressing Google to share AI and search data under new regulations (Jan 27, 2026). Samsung is nearing Nvidia approval for advanced HBM4 AI memory chips (Jan 27, 2026). Fujitsu developed AI for space weather prediction (Jan 28, 2026).

Cybersecurity: Microsoft issued emergency patches for an actively exploited Office zero-day vulnerability (CVE-2026-21509) (Jan 27, 2026). Fortinet patched a critical FortiOS SSO authentication bypass (CVE-2026-24858) under active exploitation (Jan 28, 2026). AI-powered polymorphic phishing attacks are also a growing concern (Jan 28, 2026).

#News #Anonymous #AnonNews_irc

0
0
0
2h ago

Bluesky

BleepingComputer @bleepingcomputer.com

Fortinet has confirmed a new, actively exploited critical FortiCloud single sign-on (SSO) authentication bypass vulnerability, tracked as CVE-2026-24858, and says it has mitigated the zero-day attacks by blocking FortiCloud SSO connections from devices running vulnerable firmware versions.

5
6
0
12h ago

piggo @pigondrugs.bsky.social

~Cisa~ CISA added a critical, actively exploited Fortinet authentication bypass vulnerability (CVE-2026-24858) to its KEV catalog. - IOCs: CVE-2026-24858 - #CVE202624858 #Fortinet #ThreatIntel

0
0
0
7h ago

Ninja Owl @ninjaowl.ai

Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...

0
0
0
6h ago

Information Security Briefly @infosecbriefly.bsky.social

A critical FortiOS SSO authentication-bypass (CVE-2026-24858) is actively exploited, affecting FortiOS, FortiManager, FortiAnalyzer; Fortinet is releasing updates and mitigating access.

0
0
0
6h ago

Red Hot Cyber @redhotcyber.bsky.social

Vulnerabilità Fortinet CVE-2026-24858: Hacker Dentro le Reti con Credenziali Legittime 📌 Link all'articolo : www.redhotcyber.com/post/vul... A cura di Bajram Zeqiri #redhotcyber #news #cybersecurity #hacking #forticloud #sso #vulnerabilita #sicurezzainformatica

0
0
0
5h ago

ohhara @shiojiri.com

Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected https://thehackernews.com/2026/01/fortinet-patches-cve-2026-24858-after.html

0
0
0
4h ago

Information Security Briefly @infosecbriefly.bsky.social

A FortiCloud SSO authentication bypass (CVE-2026-24858) was exploited in the wild; Fortinet released emergency patches for FortiOS, FortiManager, and FortiAnalyzer.

0
0
0
3h ago

IT-Connect @it-connect.bsky.social

🛑 Fortinet coupe le SSO en attendant les patchs pour la nouvelle faille zero-day : CVE-2026-24858 Les patchs arrivent.... ⌛ Tous les détails par ici 👇 - www.it-connect.fr/fortinet-cou... #infosec #fortinet #cybersecurite

0
0
0
2h ago

Michael Wyres @mwyr.es

Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected - https://mwyr.es/SlufrYmg #thn #infosec

0
0
0
2h ago

CVE-2025-8088

Overview

win.rar GmbH
WinRAR

08 Aug 2025

Published

21 Oct 2025

Updated

CVSS v4.0

HIGH (8.4)

EPSS

2.94%

MITRE

KEV

Description

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Statistics

10 Posts
2 Interactions

Last activity: Last hour

Bluesky

Tech-News @technology-news.bsky.social

Espionage and financially motivated threat actors are exploiting critical WinRAR vulnerability CVE-2025-8088.

0
1
0
4h ago

Virus Bulletin @virusbtn.bsky.social

Google’s Threat Intelligence Group warns WinRAR CVE-2025-8088 is still being exploited for initial access and payload delivery by both state-backed and financially motivated actors. The exploitation method allows files to be dropped into the Windows Startup folder. cloud.google.com/blog/topics/...

0
1
0
1h ago

GCP Weekly @gcpweekly.bsky.social

Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088 #googlecloud https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability/ Espionage and financially motivated threat actors are exploiting critical WinRAR vulnerability CVE-2025-8088.

0
0
2
20h ago

piggo @pigondrugs.bsky.social

~Mandiant~ State-sponsored and financially motivated actors are actively exploiting WinRAR CVE-2025-8088 for initial access via malicious archives. - IOCs: (None identified) - #CVE20258088 #ThreatIntel #WinRAR

0
0
0
18h ago

Blacky @coldblacksun.bsky.social

Google Mandiant says the recent WinRAR flaw (CVE-2025-8088) is being widely exploited by a growing range of threat actors, expanding from Russian state-linked groups to Chinese espionage actors and financially motivated cybercriminals cloud.google.com/blog/topics/...

0
0
0
10h ago

abijita.bsky.social @abijita.bsky.social

WinRAR Vulnerability Actively Exploited by State and Criminal Hackers Multiple threat actors, including state-sponsored groups and financially motivated cybercriminals, are actively exploiting a high-severity WinRAR vulnerability tracked as CVE-2025-8088, according to new findings from the Google…

0
0
0
9h ago

Information Security Briefly @infosecbriefly.bsky.social

A WinRAR path traversal vulnerability (CVE-2025-8088) enables arbitrary code execution via crafted RAR archives and has been widely exploited by state-sponsored and criminal actors.

0
0
0
2h ago

Information Security Briefly @infosecbriefly.bsky.social

Attackers exploit WinRAR CVE-2025-8088 path-traversal flaw to drop payloads into Windows Startup for persistence, enabling varied malware and ransomware deployments.

0
0
0
Last hour

CVE-2025-15467

Overview

OpenSSL
OpenSSL

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

Statistics

7 Posts
8 Interactions

Last activity: Last hour

Fediverse

Jan Schaumann @jschauma

OpenSSL Security Advisory

https://openssl-library.org/news/secadv/20260127.txt

One high, one medium, and 9 low severity issues.

The high severity is a stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467): attacker provides an oversized IV, leading to buffer overflow prior to authentication, possibly leading to remote code execution if you're parsing untrusted CMS or PKCS#7 content with AEAD (e.g., AES-GCM).

2
6
0
17h ago

Bluesky

HackerNewsTop5 @hackernewstop5.bsky.social

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing #HackerNews https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467

0
0
1
18h ago

Information Security Briefly @infosecbriefly.bsky.social

OpenSSL patched twelve vulnerabilities including a high-severity stack buffer overflow (CVE-2025-15467) that can cause DoS or remote code execution.

0
0
0
3h ago

Red Hot Cyber @redhotcyber.bsky.social

OpenSSL: 12 bug di sicurezza rilevati tra i quali una vulnerabilità critica 📌 Link all'articolo : www.redhotcyber.com/post/ope... A cura di Bajram Zeqiri #redhotcyber #news #cybersecurity #hacking #vulnerabilita #opessl #sicurezzainformatica #cve202515467

0
0
0
1h ago

topickapp (IT技術系ニュースサイト) @topickapp.bsky.social

https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467 OpenSSLのセキュリティ脆弱性に関する情報を提供しています。脆弱性の詳細、影響を受けるバージョン、修正方法などが記載されています。最新のOpenSSLバージョンへのアップデートを推奨しています。

0
0
0
Last hour

OMO @omo.bsky.social

OpenSSLの脆弱性(High: CVE-2025-15467, Moderate: CVE-2025-11187, Low: CVE-2025-15468等, CVE-2026-22795, CVE-2026-22796)と新バージョン(3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #ssl #openssl security.sios.jp/vulnerabilit...

0
0
0
12h ago

CVE-2026-24765

Overview

sebastianbergmann
phpunit

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

Pending

MITRE

KEV

Description

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.

Statistics

2 Posts
3 Interactions

Last activity: 12 hours ago

Fediverse

Sebastian Bergmann :phpunit: @sebastian

RE: https://phpc.social/@sebastian/115965753874226093

This is CVE-2026-24765 now.

2
1
0
20h ago

TheHackerWire @thehackerwire

🟠 CVE-2026-24765 - High (7.8)

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
12h ago

CVE-2026-23830

Overview

nyariv
SandboxJS

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

Pending

MITRE

KEV

Description

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constructor with a safe, sandboxed version (`SandboxFunction`). This is handled in `utils.ts` by mapping `Function` to `sandboxFunction` within a map used for lookups. However, before version 0.8.26, the library did not include mappings for `AsyncFunction`, `GeneratorFunction`, and `AsyncGeneratorFunction`. These constructors are not global properties but can be accessed via the `.constructor` property of an instance (e.g., `(async () => {}).constructor`). In `executor.ts`, property access is handled. When code running inside the sandbox accesses `.constructor` on an async function (which the sandbox allows creating), the `executor` retrieves the property value. Since `AsyncFunction` was not in the safe-replacement map, the `executor` returns the actual native host `AsyncFunction` constructor. Constructors for functions in JavaScript (like `Function`, `AsyncFunction`) create functions that execute in the global scope. By obtaining the host `AsyncFunction` constructor, an attacker can create a new async function that executes entirely outside the sandbox context, bypassing all restrictions and gaining full access to the host environment (Remote Code Execution). Version 0.8.26 patches this vulnerability.

Statistics

2 Posts
1 Interaction

Last activity: 10 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-23830 - Critical (10)

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Func...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

1
0
0
10h ago

Bluesky

azu @azu.bsky.social

見てる: "SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor · CVE-2026-23830 · GitHub Advisory Database" https://github.com/advisories/GHSA-wxhw-j4hc-fmq6

0
0
0
11h ago

CVE-2026-23864

Overview

Meta
react-server-dom-webpack

26 Jan 2026

Published

26 Jan 2026

Updated

CVSS

Pending

EPSS

0.60%

MITRE

KEV

Description

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

Statistics

2 Posts
2 Interactions

Last activity: 7 hours ago

Bluesky

piggo @pigondrugs.bsky.social

~Akamai~ Unauthenticated DoS vulnerability in React Server Components allows memory exhaustion attacks against React, Next.js, and other frameworks. - IOCs: CVE-2026-23864 - #CVE202623864 #NextJS #React #ThreatIntel

0
1
0
18h ago

technews4869 @technews4869.bsky.social

vercel.com/changelog/summa... Summary of CVE-2026-23864 - Vercel

0
1
0
7h ago

CVE-2026-24061

Overview

GNU
Inetutils

21 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

34.45%

MITRE

KEV

Description

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Statistics

2 Posts
1 Interaction

Last activity: 15 hours ago

Bluesky

Tech-News @technology-news.bsky.social

A 9.8-severity flaw (CVE-2026-24061) in GNU InetUtils telnetd allows remote authentication bypass and root access in versions 1.9.3 to 2.7.

0
1
0
15h ago

Securitycipher @securitycipher.bsky.social

Exploit Lab: CVE-2026–24061 (telnetd) https://medium.com/@josh.beck2006/exploit-lab-cve-2026-24061-telnetd-772306d3b0ba?source=rss------bug_bounty-5

0
0
0
17h ago

CVE-2025-11187

Overview

OpenSSL
OpenSSL

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer overflow or NULL pointer dereference may cause a crash leading to Denial of Service for an application that parses untrusted PKCS#12 files. The buffer overflow may also potentially enable code execution depending on platform mitigations. When verifying a PKCS#12 file that uses PBMAC1 for the MAC, the PBKDF2 salt and keylength parameters from the file are used without validation. If the value of keylength exceeds the size of the fixed stack buffer used for the derived key (64 bytes), the key derivation will overflow the buffer. The overflow length is attacker-controlled. Also, if the salt parameter is not an OCTET STRING type this can lead to invalid or NULL pointer dereference. Exploiting this issue requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For this reason the issue was assessed as Moderate severity. The FIPS modules in 3.6, 3.5 and 3.4 are not affected by this issue, as PKCS#12 processing is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5 and 3.4 are vulnerable to this issue. OpenSSL 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue as they do not support PBMAC1 in PKCS#12.

Statistics

2 Posts
4 Interactions

Last activity: 11 hours ago

Fediverse

tallship @tallship

Ruh Roh! CVE-2025-11187

https://openssl-library.org/news/secadv/20260127.txt

https://securitylabs.datadoghq.com/articles/openssl-january-2026-security-update-cms-and-pkcs12-buffer-overflows/

4
0
0
11h ago

Bluesky

OMO @omo.bsky.social

OpenSSLの脆弱性(High: CVE-2025-15467, Moderate: CVE-2025-11187, Low: CVE-2025-15468等, CVE-2026-22795, CVE-2026-22796)と新バージョン(3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #ssl #openssl security.sios.jp/vulnerabilit...

0
0
0
12h ago

CVE-2025-41726

Overview

Beckhoff Automation
Beckhoff.Device.Manager.XAR

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

0.18%

MITRE

KEV

Description

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

Statistics

2 Posts

Last activity: 22 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-41726 - High (8.8)

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41726/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
22h ago

CERT@VDE @certvde

#OT #Advisory VDE-2025-092
Beckhoff: Privilege escalation and information leak via Beckhoff Device Manager

The vulnerability CVE-2025-41726 (NN-2025-0074) allows an authenticated remote user to execute arbitrary commands on the device. This can be exploited over the web UI or via API. In one case the execution of the arbitrary command happens within a privileged process.
#CVE CVE-2025-41726, CVE-2025-41727, CVE-2025-41728

https://certvde.com/en/advisories/vde-2025-092/

#CSAF https://beckhoff.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-092.json

0
0
0
23h ago