CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264: Four CVEs in Ruby’s regular expression engine, discovered by GitLab, up to 10.0 rating 🔥 Last week, the Ruby team released patches for several bugs in Ruby’s regular expression engine (Onigmo). GitLab found that these bugs could be exploited for RCE on GitLab servers. The same risk applies to any other Ruby application that compiles user-supplied regular expressions. 👉 nt.ls/1j93T

CVE-2026-114625: Actively exploited SQL injection flaw in Arista VeloCloud Orchestrator, 9.9 rating 🔥 Arista has disclosed a new SQL injection vulnerability in VeloCloud Orchestrator that allows any authenticated user to gain operator privileges and impersonate a local user with "superuser operator" privileges. This issue is known to be actively exploited! 👉 nt.ls/Z5tBM

📟Fingerprinting Exposed Siemens S7 PLCs with Netlas In 2010, Stuxnet targeted Siemens PLCs. Over 15 years later, thousands still expose their model, firmware version, and internal names on TCP port 102. See how a few Netlas queries narrow thousands of exposed S7 services to the ones worth a closer look. 👉 netlas.io/blog/fingerprintin…

🎥Turning Recon Data into Findings with Netlas In his video, ZACK0X01 walks through the reconnaissance and scanning workflow behind his AI agent, showing how Netlas turns raw recon data into actionable findings. You'll see how certificate and favicon hash searches find assets missed by subdomain enumeration, and how scanning reveals services and tech in JSON. 👉 youtube.com/watch?v=v9v9eGpy…

CVE-2026-110264 and others: 12 new vulnerabilities in GitLab, up to 10.0 rating 🔥 GitLab has disclosed 12 new vulnerabilities affecting GitLab CE & EE. The most severe allows an unauthenticated remote attacker to execute arbitrary code on the GitLab server. 👉 nt.ls/dxdTf

CVE-2026-109618 & CVE-2026-109619: Two RCE vulnerabilities in PHP (PHP2Shell), rating 9.2 for both 🔥 Today the PHP security team released an emergency update addressing two critical vulnerabilities in the PHP core, which allow unauthenticated remote code execution as the web worker account. Details of the two vulnerabilities were disclosed by researchers yesterday, ahead of today’s release. 👉 nt.ls/MDn37

🔍Using Netlas in Houdin One ThreatFox indicator, one default certificate, and Netlas data in between: Houdin traces how a single alert turns into a list of servers running CyberStrikeAI, an open-source platform for AI-assisted attacks. 👉 netlas.io/blog/using_netlas_…

Token-based API guard authentication bypass in Laravel, no CVE assigned yet, 9.2 rating ‍🔥 An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by Laravel's built-in TokenGuard when configured with a standard token-based API guard. This flaw affects applications using certain MySQL or MariaDB database configurations. 👉 nt.ls/kfDww

Multiple vulnerabilities in Roundcube, no CVE assigned 🤷🏻‍♂️ The Roundcube project today disclosed multiple vulnerabilities in Roundcube Webmail, including IMAP command injection, mail header injection, SSRF, CSRF, XSS, and other security issues. 👉 nt.ls/Hq2Fn

🤝Netlas supported the DRIFT Linux project DRIFT Linux is an open-source, not-for-profit project in digital forensics, OSINT, and cybersecurity. It shares knowledge and builds tools for incident investigation. Netlas has supported independent research within the project. In the future, we hope to see Netlas integrated into DRIFT Linux as one of its tools. Read more about project: driftlinux.org

CVE-2026-89067, CVE-2026-87093, and others: 12 new vulnerabilities in Progress MOVEit Transfer, up to 8.8 rating ‍🔥 Progress Software has disclosed twelve new vulnerabilities in MOVEit Transfer, including authentication bypass, local privilege escalation, SQL injection, and XSS. Successful exploitation could allow an attacker to gain unauthorized access or administrative control and could also lead to data exposure, service instability, and resource exhaustion. 👉 nt.ls/JYNPz

⚙️Hunting Exposed LLM Infrastructure with Netlas In this new article by CyberBit, we explore how any publicly accessible instance of a self-hosted LLM platform can reveal the models it uses and even the runtime environment on which the AI service operates. 👉 netlas.io/blog/hunting_expos…

CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176: Three new vulnerabilities in NGINX, 9.2 rating ‍🔥 F5 has disclosed three new vulnerabilities in NGINX Plus and NGINX Open Source. All of them expose the data plane to remote DoS attacks and potential RCE. An unauthenticated attacker can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. 👉 nt.ls/Jv7X3

CVE-2026-74040, CVE-2026-74041 and others: 15 new vulnerabilities in Wazuh, up to 9.1 rating ‍🔥 Wazuh has disclosed 15 new vulnerabilities in its open-source platform. Two of them could allow an attacker to execute code as root. 👉 nt.ls/lD8bp

CVE-2026-97229: Unauthenticated RCE in GitLab, 10.0 rating ‍🔥 A vulnerability in GitLab disclosed last week allows an unauthenticated attacker to execute arbitrary code on the server via a specially crafted regular expression in a CI/CD configuration. 👉 nt.ls/HVOHN

CVE-2026-102255: Pre-authentication SSRF via unintended forward-proxy in SonicWall SMA1000, 10.0 rating ‍🔥 SonicWall recently disclosed a critical pre-authentication SSRF vulnerability in its SMA1000 appliances. An unauthenticated attacker can exploit this flaw to make the appliance send requests on their behalf, reach internal functionality, and perform unauthorized actions. This vulnerability has also been observed being exploited in the wild! 👉 nt.ls/fbAnv

CVE-2026-76268 and others: Multiple vulnerabilities in Splunk Enterprise, up to 9.8 rating ‍🔥 Splunk has disclosed multiple vulnerabilities in Splunk Enterprise. The most serious is CVE-2026-76268, which allows an unauthenticated attacker to execute operating system commands through the Patroni REST API. 👉 nt.ls/GWmyZ