Security news.
Critical software supply chain compromises, out-of-band enterprise patches, and rapid zero-day weaponization highlight today's security landscape. Attackers are aggressively exploiting newly disclosed flaws in edge appliances and media platforms while compromising trusted deployment channels like AOMEI and Rank Math PRO. Security teams should prioritize patching internet-facing systems, rotating exposed credentials, and auditing third-party service permissions.
F5 Issues Out-of-Band Patches for Critical NGINX Vulnerabilities
F5 has released emergency security updates to address multiple flaws in the NGINX web server, including three critical bugs that allow remote attackers to execute arbitrary code.
Plex2Shell Flaw Exploited In the Wild for Cryptominers and Backdoors
Attackers are actively weaponizing a four-vulnerability exploit chain dubbed Plex2Shell to deploy cryptocurrency miners and Linux reverse proxies just hours after public PoC availability.
Rank Math PRO WordPress Plugin Backdoored in Supply Chain Attack
Copies of the Rank Math PRO plugin downloaded or updated between October 15 and October 16 were compromised to deliver self-restoring backdoors, prompting administrators to treat affected sites as breached.
AOMEI Update Infrastructure Hijacked to Push Malware
Threat actors compromised AOMEI’s update servers, temporarily modifying configuration files tied to a built-in promotional feature to quietly deliver malware before reverting changes to evade detection.
ConnectWise Disables Cloud Backup Following M365 Tenant Compromises
ConnectWise suspended access and disabled several application identities after attackers abused compromised service integrations to breach client Microsoft 365 tenants.
Drupal Warns of Imminent Exploitation for Core RCE Vulnerability
Drupal has issued an alert regarding critical vulnerabilities in its Entity List and Field UI modules that can be chained with contributed modules to achieve remote code execution.
CISA Adds Actively Exploited Fortinet and BeyondTrust Bugs to KEV Catalog
CISA issued urgent mitigation orders after adding BeyondTrust Remote Support authentication bypass (CVE-2026-102764) and a Fortinet path traversal bug (CVE-2025-61624) to its Known Exploited Vulnerabilities catalog.
OpenCode Breach Exposes Third-Party AI Provider API Keys
OpenCode disclosed that unauthorized access to a legacy hosted console system potentially exposed customers' OpenAI, Anthropic, and Google API keys.