Security news.
Today's security landscape is dominated by active zero-day exploitation and urgent patch releases across critical enterprise infrastructure. Palo Alto Networks and Cisco have both addressed vulnerabilities under active targeting, while developers face critical remote code execution fixes in Next.js, Drupal, and NGINX. CISA has also escalated multiple flaws across network and gateway appliances to its Known Exploited Vulnerabilities catalog.
Palo Alto Networks Patches Actively Exploited PAN-OS RCE Flaw
Updates address CVE-2026-0322, a high-severity remote code execution flaw in the PAN-OS management interface that threat actors are actively targeting in the wild.
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Tracked as CVE-2026-76519, the flaw allows unauthenticated remote attackers to write arbitrary files and execute system commands with root privileges.
CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog
The catalog now includes actively exploited bugs impacting Palo Alto Networks PAN-OS (CVE-2026-0322), Cisco Secure Email Gateway (CVE-2026-76519), and two AhsayCBS authentication flaws.
Next.js Issues Out-of-Band Security Updates for Critical RCE Bugs
The emergency release fixes two unauthenticated remote code execution vulnerabilities involving React Server Components and SVG processing via the librsvg dependency.
NGINX Addresses Multiple Vulnerabilities, Including RCE and TLS Bypass
Versions 1.30.6 and 1.31.7 fix five security issues, including memory bugs that enable potential remote code execution and a flaw allowing TLS client-certificate check bypasses.
Drupal Fixes Critical Field UI Vulnerability Enabling Server RCE
Security updates for Drupal 10 and 11 resolve an unauthenticated code execution chain made accessible through specific contributed modules.
Candiru Spyware Infiltrated Al Jazeera Devices via Zero-Click Ad Exploits
Citizen Lab revealed that targeted online display ads delivered government spyware payloads instantly upon loading without requiring any user interaction or clicks.
Malicious Arch Linux AUR Packages Distribute Malware with Root Privileges
Attackers uploaded typosquatted packages impersonating popular Arch User Repository tools yay and paru to execute malicious scripts with elevated rights.