Do Son Roundcube Webmail 1.6.21 and 1.7.6 fix 17 bugs, including Sieve injection, SSRF and CSRF bypasses. Apply the Roundcube security update now.
Do Son
Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.
QNAP warns that exploited Plex2Shell vulnerabilities in Plex Media Server 1.43.2 hit QNAP NAS users. Update to 1.43.3.10861 and check for compromise.
Apple tightens macOS Full Disk Access in macOS 27.3, requiring manual app authorization to prevent AI agents from accessing sensitive personal user files.
Microsoft introduced an Outlook DMARC email rejection rule, bouncing messages lacking DMARC records with the 550 5.7.1 authentication error.
A York University data breach exposed records from 2007 to 2026 after a departmental webforms theft. Check which faculties and students are affected.
WP Duplicate vulnerability CVE-2026-123751 is exploited in the wild, letting attackers upload files and run code. No patch exists, so remove the plugin.
Google announced the Firebase Studio shutdown for March 2027, urging developers to migrate project workspaces and export AI conversation histories.
Acronis TRU uncovered the BOSSAI attack mesh Taiwan campaign using 12 AI agents to breach emergency services, banks, and universities in 11 countries.
A bug involving AMD driver SSD writes causes atieclxx.exe to constantly write gigabytes to storage drives during idle states, prompting an AMD fix.
McAfee Labs uncovers Marsalek malware in fake game cheats. See how the dual-hook Marsalek malware drops PureLog to steal passwords from gamers and hackers.
Researchers found an open server hosting a DoNot APT toolkit targeting Pakistan nuclear, power grid, and ICS networks with Inveigh and Go shells.
Key takeaways Managed IT support affects customers directly, because most service channels now run on the same...
Introduction Few large companies run on one neat system any more. A typical firm juggles cloud servers,...
Hugging Face datasets RCE CVE-2026-57845 (CVSS 8.8) has a public proof-of-concept. The library sees 38M monthly downloads, and no fixed release exists.
Openwave Webtop vulnerability CVE-2026-111793 is exploited in the wild, per JPCERT/CC. Upgrade Webtop Media Transcoder to 1.1.22.0 or later.
ModSecurity vulnerabilities CVE-2026-104269 and CVE-2026-73857 now have public details and a proof-of-concept. Upgrade to libmodsecurity 3.0.17.
A modern WinUI Registry Editor prototype surfaced in a Microsoft repo, offering a sleek glimpse into potential Windows 11 interface redesigns.
Apple plans an Apple proactive Siri agent for iOS 28, leveraging native App Intents and overhauled development cycles to challenge rivals.
UnrealIRCd vulnerability CVE-2026-114713 is exploited in the wild, letting users run IRCOp commands. Hot-patch or upgrade to 6.2.7.1 now.
Our weekly CVE report for Nov 2-8, 2026 tracks 3,570 new CVEs and 10 exploited vulnerabilities, including Siemens and Zyxel flaws not in CISA KEV.
A uutils coreutils vulnerability (CVSS 9.9) let translation files inject code; details and a proof-of-concept are now public. Upgrade to uucore 0.12.0.
A proof-of-concept exploit for CVE-2026-97798, a Windows Error Reporting vulnerability, gives a SYSTEM shell. Install the October 2026 update now.