Security news.
Today's security landscape is dominated by critical remote code execution vulnerabilities facing immediate patching and active exploitation across Linux kernels, enterprise edge hardware, and developer tooling. Meanwhile, widespread industrial sabotage targets European grocery infrastructure, and Google orchestrates the takedown of a massive pre-infected Android botnet.
Linux Kernel TCP Vulnerability Enables Remote Code Execution
Red Hat has rolled out patches for CVE-2026-98432, a critical 9.8-rated use-after-free flaw in the IPv4 TCP stack that lets unauthenticated attackers achieve remote code execution, while Ubuntu fixes remain in testing.
Critical Flaw in Siemens SIMATIC IoT2050 Actively Exploited
Attackers are weaponizing CVE-2026-58115 (CVSS 10.0), a missing authentication vulnerability in Siemens SIMATIC IoT2050 Advanced industrial devices, to install persistent remote backdoors.
Node-RED Vulnerability Under Active Attack to Drop Linux Payloads
Threat actors are actively exploiting a critical vulnerability in the Node-RED flow-based development environment to deploy webshells and Linux botnet malware.
Unpatched WordPress CryptoPayment Plugin Bug Exposes Wallets
Researchers warn that attackers are actively exploiting CVE-2026-81648 (CVSS 10.0), a zero-day flaw in the CryptoPayment Gateway plugin allowing unauthenticated remote attackers to wipe files and extract sensitive wallet credentials.
Hackers Exploit Flaw in Outdated BTCPay Servers to Drain Hot Wallets
Self-hosted crypto payment processor BTCPay Server is urging immediate upgrades after threat actors exploited instances running version 2.4.1 or older to steal Bitcoin and Litecoin directly from hot wallets.
Coordinated Cyberattacks Tamper With Supermarket Cooling Across Europe
Retailers in multiple European nations were forced to dispose of chilled and frozen goods after remote attackers breached exposed refrigeration controllers to spike temperatures.
Google Disrupts 1.3-Million-Device XCPE Android Botnet
Google collaborated with industry partners to dismantle a sprawling residential proxy and ad-fraud botnet built from compromised Android TV boxes preloaded with backdoors by device manufacturer Videostrong.
Android November 2026 Security Update Resolves 200+ Flaws
Google released its monthly security bulletin for Android addressing over 200 vulnerabilities, highlighted by a critical zero-click remote code execution bug in the core Framework.