BTCPay Server Hot Wallets Drained on Unpatched Self-Hosted Instances

Scope: BTCPay Server, versions 2.4.1 and earlier (fixed in 2.4.2, released August 7, 2026)

Severity: Red

Read More

C3RB3R Ransomware Encrypting Synology NAS Devices on Outdated DSM Builds

Scope: Synology DSM on NAS devices, all unpatched builds across the 7.4, 7.3, 7.2.2, and 7.2.1 lines (and earlier lines per Synology’s own advisory)

Severity: Red

Read More

Over 1,000 GitLab Servers Remain Exposed to Active Exploitation Weeks After Patch (CVE-2026-97229)

Scope: Self-managed GitLab Community Edition and Enterprise Edition, instances not yet updated against CVE-2026-97229

Severity: Red

Read More

“KeyDrift” Malware Stole Cisco SD-WAN Encryption Keys for Years Before Detection (CVE-2026-20127)

Scope: Cisco Catalyst SD-WAN Controller, Manager, and Validator (patched since February 2026)

Severity: Red

Read More

s2Member WordPress Plugin Code Injection Flaw Has Public Exploit Code (CVE-2026-86596)

Scope: s2Member WordPress plugin, all versions through 260927, fixed in 261017

Severity: Red

Read More

Langflow Unauthenticated Authentication Bypass and Remote Code Execution (CVE-2026-93680 / CVE-2026-110186)

Scope: Langflow, versions 1.0.0 through 1.12.8, fixed in 1.13.0

Severity: Red

Read More