The Hacker Wire

Cybersecurity Chronicles 🌐 | Breaking down the latest in security news, #hacking #darkweb #Cybersecurity #InfoSec #HackingNews

[The Hacker Wire @TheHackerWire]

🚨 Google Chrome Sandbox Breakout (CVE-2026-126872)

Flaw in FileSystem authorization lets remote attackers break out of the browser sandbox to execute arbitrary code on the host OS.

⚡ Action: Update Chrome to >= 157.0.8103.78 now.

https://t.co/L2f24FAskj

#Chrome #AppSec

[The Hacker Wire @TheHackerWire]

🚨 Critical RCE in ManageEngine AssetExplorer & ServiceDesk (CVE-2026-12507, CVSS 9.1)

Reports module flaw allows authenticated users with report creation rights to execute OS commands on servers.

⚡ Action: Update immediately.

https://t.co/JvMaF1kPFO

#ManageEngine #AppSec

[The Hacker Wire @TheHackerWire]

🛡️ Daily Security Brief — Nov 12, 2026

Tracking 12 disclosures across enterprise & IoT:
• Cloud: IBM API Connect definition SSRF (CVE-2026-17353, CVSS 9.6)
• IoT: TOTOLINK CA300-PoE buffer overflows

Tracker: https://t.co/GgHhjCpKZI

#ThreatIntel #InfoSec

[The Hacker Wire @TheHackerWire]

🚨 Critical Privilege Escalation in M365 Manager Plus (CVE-2026-12591, CVSS 9.9)

Insufficient validation in delegated admin allows authenticated technicians to achieve RCE & hijack M365 tenants.

⚡ Action: Upgrade to build >= 4818.

https://t.co/2FfuJema3e

#M365 #InfoSec

[The Hacker Wire @TheHackerWire]

🚨 Buffer Overflow in TOTOLINK CA300-PoE (CVE-2026-124060, CVSS 8.5) - PoC Live

Improper bounds checking on 'File' parameter in UploadCustomModule enables memory corruption and RCE!

⚡ Action: Update firmware.
https://t.co/X8dJqvH4kO

#TOTOLINK #RouterSec

[The Hacker Wire @TheHackerWire]

🚨 Critical Flaw in Fortinet FortiMail (CVE-2026-126164, CVSS 9.4)

SQL injection in the email gateway allows unauthenticated remote attackers to execute arbitrary queries & compromise systems.

⚡ Action: Apply FortiMail updates now.

https://t.co/hHFYxicVzi

#Fortinet #AppSec

[The Hacker Wire @TheHackerWire]

🚨 Unauth SQLi to Admin Takeover in Craft CMS (CVE-2026-115934, CVSS 9.8)

Unsanitized input in https://t.co/hRs05s8N0n executes stacked SQL queries, letting attackers flip admin flags & seize the CMS.

⚡ Action: Update Craft CMS now.

https://t.co/zu9nvefcUd

#CraftCMS #AppSec

[The Hacker Wire @TheHackerWire]

🚨 Critical RCE in Fortinet FortiManager & FortiAnalyzer (CVE-2026-126170, CVSS 9.8)

Improper output encoding lets unauthenticated remote attackers execute code via crafted HTTP requests.

⚡ Action: Restrict admin ports; update now.

https://t.co/hhZx0WG6Kc

#Fortinet #InfoSec

[The Hacker Wire @TheHackerWire]

🚨 Multi-Tenant Isolation Bypass in IBM API Connect (CVE-2026-17339, CVSS 9.1)

Path traversal lets attackers cross tenant boundaries to access, overwrite, or delete restricted API contracts!

⚡ Action: Update to 12.1.1.3.
https://t.co/NM9HgcTAVI

#IBM #CloudSecurity

[The Hacker Wire @TheHackerWire]

🚨 Tenant Takeover in SuperTokens (CVE-2026-123800, CVSS 9.9)

Flawed checks let single-tenant API keys overwrite parent/sibling keys, hijack sessions & disable MFA across tenants.

⚡ Action: Update SuperTokens Core immediately.

https://t.co/QjJ2VbuaEm

#AppSec #IAM

[The Hacker Wire @TheHackerWire]

🚨 Critical Auth Flaw in Synology DSM (CVE-2026-76954, CVSS 9.8)

SQL injection in the Auth API allows unauthenticated attackers to read/write arbitrary files & hijack Synology NAS arrays.

⚡ Action: Update DSM via Control Panel.

https://t.co/0VZ8J714Ab

#Synology #NAS

[The Hacker Wire @TheHackerWire]

🚨 Unauth Path Traversal RCE in IBM API Connect (CVE-2026-17340, CVSS 9.8)

Improper path validation lets unauthenticated attackers escape web boundaries and execute code remotely!

⚡ Action: Update to 12.1.1.3 immediately.
https://t.co/HnrE3USS31

#IBM #AppSec

[The Hacker Wire @TheHackerWire]

🚨 Fortinet Fleet Alert: 5 Critical CVEs (CVE-2026-126262+)

Flaws in FortiManager, FortiAnalyzer & FortiOS allow unauth OFTP code execution and super_admin takeover via HA packets.

⚡ Action: Isolate OFTP/HA ports; update now.

https://t.co/vxgcZtbJ1u

#Fortinet #InfoSec

[The Hacker Wire @TheHackerWire]

🚨 Critical RCE in PTC Windchill (CVE-2026-126325, CVSS 9.2)

Insecure deserialization allows unauthenticated remote attackers to execute code on enterprise PLM engineering servers.

⚡ Action: Apply PTC security updates now.

https://t.co/rfTUjdpFRo

#AppSec #Industrial

[The Hacker Wire @TheHackerWire]

🚨 Critical RCE in Apache HTTP Server (CVE-2026-119618)

Race condition in mod_http2 causes heap corruption & unauthenticated RCE on Apache 2.4.55–2.4.70. Flagged by Anthropic & Google.

⚡ Action: Update to 2.4.71 or disable mod_http2.

https://t.co/hXLPAoFyRa

#Apache #AppSec

[The Hacker Wire @TheHackerWire]

🚨 Supply-Chain Flaw in Red Hat Quay (CVE-2026-123710, CVSS 9.8)

Unauthenticated attackers can install arbitrary signing keys, gaining full read/write & tag poisoning across private container images.

⚡ Action: Update Quay now.

https://t.co/UpUGZ7oDs5

#DevSecOps #AppSec

[The Hacker Wire @TheHackerWire]

🛡️ Daily Security Brief — Nov 11, 2026

Tracking 12 disclosures across enterprise & IoT:
• TOTOLINK CA300-PoE buffer overflows (CVE-2026-124057..59, PoC live)
• IBM API Connect flaws

Full Tracker: https://t.co/GgHhjCpdaa

#ThreatIntel #InfoSec

[The Hacker Wire @TheHackerWire]

🚨 3 Critical WordPress Plugin Flaws (CVE-2026-126537+)

Flaws in Ninja Forms, WooCommerce Security & AskAny allow arbitrary PHP upload, admin token leaks & wp-config deletion to RCE.

⚡ Action: Update or disable now.

https://t.co/6TcMKauJ1H

#WordPress #AppSec

[The Hacker Wire @TheHackerWire]

🚨 File Deletion to Site Takeover in Tournamatch (CVE-2026-121379, CVSS 8.8)

Subscriber+ users can delete wp-config.php during avatar reset to trigger re-install and seize the site!

⚡ Action: Update to >= 4.7.1.
https://t.co/CU5R3mJ3V1

#WordPress #BugBounty

[The Hacker Wire @TheHackerWire]

🚨 9 Critical Flaws in Adobe Connect (Triple CVSS 10.0 + Quintuple 9.9)

Adobe releases emergency updates for 3x CVSS 10.0 Auth Bypass, SSRF & CRLF RCE flaws plus multiple SQLi/traversal bugs.

⚡ Action: Update to v12.8.a now.

https://t.co/q137RJDcxp

#Adobe #AppSec