Do Son Critical Pterodactyl API flaw (CVE-2026-26016) allows cross-node authorization bypass. Attackers can destroy game servers. Update to version 1.12.1 now.
Pterodactyl
A critical RCE flaw (CVE-2025-49132, CVSS 10.0) in Pterodactyl game server panel allows unauthenticated arbitrary code execution. Malicious actors are already exploiting it.