Vulnerability | Breaking Cybersecurity News | The Hacker News

Two of 31 newly disclosed flaws in Progress Software's  MarkLogic Server  database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in  MarkLogic 11.3.7  and  MarkLogic 12.1.0 . Affected releases, and the release that fixes each: MarkLogic 11.x before 11.3.7: upgrade to 11.3.7 MarkLogic 12.x before 12.1.0: upgrade to 12.1.0 MarkLogic 11.3 is the long-term support (LTS) line. The 12 line, which Progress calls an innovation release, has no patched 12.0 release. Its fix is 12.1.0, which also adds new features. Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough. Those fixes arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws. Progress's CVE records and its upgrade notes for the two releases do n...

GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said in a Monday advisory. The flaw, tracked as CVE-2026-97229 , has been described as an integer overflow issue. It carries a CVSS score of 10.0. It affects the following versions - All versions from 19.2 before 19.2.8 All versions from 19.3 before 19.3.5, and All versions from 19.4 before 19.4.2 Patches for the flaw are available in versions 19.4.2, 19.3.5, and 19.2.8. Also addressed are three high-severity bugs - CVE-2026-92883 (CVSS score: 8.7) - A cross-site scripting vulnerability...

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves. Malware got better at hiding its tracks. And some systems turned out to be easier to break into than anyone would like to admit. The odd part is how normal much of it looked until someone checked closer. There's more going on here than a few bad bugs and clever attacks. Some of the smaller stories are just as telling. This week's full recap is worth a read, especially the bits that didn't make the big headlines. ⚡ Threat of the Week Atlassian Flaw Exploited in the Wild — Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian...

Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." Patches for the flaw were released by SonicWall on October 6, 2026, with versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix). The vulnerability has since started witnessing active exploitation attempts, with first signs detected by threat intelligence firms Defused Cyber and Previdian on October 8, 2026. Data from Previdian shows that a total of 135 attempts have been observed to date from two unique IP addresses located in the U.S. SonicWall has yet to update the advisory ...

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The security flaw impacts Bricksforge versions up to and including 3.1.8.9. Patches have been released in version 3.1.8.10. Bricksforge is a WordPress plugin that's advertised as a "Swiss Army knife" for Bricks, a visual website-building tool for WordPress, with support for animations, advanced forms, and scrolling video sequences. WordPress security company Patchstack said it detected exploitation efforts targeting the flaw on October 7, 2026, at 9:47 p.m. UTC. "Bricksforge validates a file's MIME type when it is first uploaded. When a form is later submitted, however, it ...