CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog

**Critical Alert:** A severe vulnerability (CVE-2026-45247) has been identified and requires immediate attention from security teams worldwide.

## The Details

https://securitycyber.uk

Resources: https://securitycyber.uk | https://www.hackthebox.com

CVE-2025-48595: Android 0-Day Actively Exploited — Patch Your Devices Now
#CyberSecurity
https://securebulletin.com/cve-2025-48595-android-0-day-actively-exploited-patch-your-devices-now/

Recent reports highlight escalating geopolitical tensions, particularly fresh US and Iranian strikes, prompting the US House to approve a resolution limiting military action. Concurrently, France has restricted Israeli participation at the Eurosatory 2026 defense exhibition.

In technology, Microsoft Build 2026 introduced advanced AI, including the MAI-Thinking-1 model and Copilot Agent Mode. However, GitHub Copilot's new token billing system is causing significant cost increases for users.

On the cybersecurity front, Google has patched an actively exploited high-severity Android flaw (CVE-2025-48595). Additionally, Russian maritime entities have been targeted by hackers, and the FBI warns of the Kali365 Phishing-as-a-Service platform.

#AnonNews_irc #Cybersecurity #News

📰 Android Zero-Day Under Attack: Google Issues Urgent Patch for Privilege Escalation Flaw

⚠️ ANDROID ZERO-DAY! Google has patched CVE-2025-48595, a privilege escalation flaw actively exploited in the wild. The fix is in the June 2026 security update, which patches 124 flaws total. Update your Android device NOW! #Android #ZeroDay #CyberSe...

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/google-patches-actively-exploited-zero-day-flaw-in-android-fram…

⚠️ CRITICAL: Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited

Google patched 124 Android vulnerabilities in June 2026, including CVE-2025-48595, a high-severity privilege escalation flaw (CVSS 8.4) in the Framework component that is actively exploited in the wild. The vulnerability affects Android 14, 15, 16, and 16 QPR2, allowing code execution through integ…

https://threatnoir.com/focus

#infosec #cybersecurity

@christopherkunz @wdormann Here's a new one to take a look at. I haven't gone through it and can't vouch for its legitimacy, but y'all know what you're doing more than I do anyway: https://github.com/Vanquishermacdetach/CVE-2026-41089-509

Atacantes explotan un fallo crítico en Windows Netlogon y ponen en jaque a los controladores de dominio

La vulnerabilidad CVE-2026-41089 permite ejecutar código de forma remota en Windows Netlogon y ya se usa en ataques reales contra controladores de dominio. Microsoft publicó parches el 12 de mayo de 2026 y las empresas deben priorizar la actualización y el endurecimiento del tráfico Netlogon dentro de la red.

https://unaaldia.hispasec.com/atacantes-explotan-un-fallo-critico-en-windows-netlogon-y-ponen-en-jaque-a-los-controladores-de-dominio/

@wdormann This writeup *seems* to make sense, were it not for the magic two letters in the TLD: https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/

@wdormann From what I read in the writeup (and the sparse other sources), you need a long enough DNS name on the victim host to trigger the overflow. I think 54 chars or more? This github has a possible explanation why the PoC fails under most normal conditions: https://github.com/ADScanPro/CVE-2026-41089-LongLogon

@wdormann https://github.com/0xABCD01/CVE-2026-41089/blob/main/poc.py#L234

@wdormann Of all the writeups, I think I like this one best, especially with it having a human name in the byline: https://adscanpro.com/blog/patch-diffing-cve-2026-41089-netlogon
"read advisories carefully before deciding how to allocate research time." made me chuckle.

CVE-2026-20230 - SSRF in Cisco Unified CM & Unified CM SME. Improper HTTP input validation. CVSS 8.6. Unpatched. No workaround available. Monitor for updates. #CVE #Cisco #infosec

https://www.valtersit.com/cve/CVE-2026-20230/

⚠️ CRITICAL: Cisco Unified CM/SME hit by SSRF vuln (CVE-2026-20230). Unauthenticated remote attackers can write files & escalate to root if WebDialer is enabled. Patch to 14SU6 ASAP. PoC out, no active exploitation. https://radar.offseq.com/threat/cisco-warns-of-available-poc-for-critical-unified--c947124b #OffSeq #Cisco #SSRF #Vuln

#DDoS: New 'HTTP/2 Bomb' DoS attack crashes major web servers in under a minute. Impacted servers include #NGINX, #Apache HTTP Server, Microsoft #IIS, Envoy, and Cloudflare Pingora. This vulnerability was discovered by Codex AI agent. CVE-2026-49975:
👇
https://www.bleepingcomputer.com/news/security/new-http-2-bomb-dos-attack-crashes-web-servers-in-under-a-minute/

💣 HTTP/2 Bomb : une "nouvelle" vulnérabilité DoS permet à un seul client d'épuiser la mémoire d'un serveur web en quelques secondes.

Les chercheurs de Calif et leurs 🤖 Codex ont démontré qu'une combinaison entre l'amplification HPACK et des techniques proches du Slowloris HTTP/2 peut provoquer une consommation mémoire massive.

⚠️ Produits concernés :
• NGINX
• Apache HTTPD
• Microsoft IIS
• Envoy
• Cloudflare Pingora
...

🩹 Rémediation :

✅ NGINX
• Mettre à jour vers 1.29.8+
• Sinon désactiver HTTP/2 temporairement

✅ Apache HTTPD
• Mettre à jour mod_http2 vers 2.0.41+
• Sinon revenir à HTTP/1.1

:debian: https://security-tracker.debian.org/tracker/CVE-2026-49975

:opensuse: https://www.suse.com/security/cve/CVE-2026-49975.html

🛡️ Mitigations complémentaires :
• Limiter la mémoire par processus (cgroups, conteneurs, ulimit)
• Surveiller les pics de consommation mémoire des workers web
• Vérifier que les protections OOM interviennent avant l'utilisation du swap

📖 Analyse :
https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb

🧪 PoC :
https://github.com/califio/publications/tree/main/MADBugs/http2-bomb

#HTTP2 #DoS #CyberVeille

#SSI #Apache #NGinx #IIS
Des failles exploitées d'Apache, NGinx et Microsoft IIS (HTTP/2 Bomb CVE-2026-49975) : une petite requête suffit à faire tomber ces serveurs en saturant leur mémoire, en moins d'1 minute.
Prêt ? à vos patchs. Partez !
https://korben.info/http-2-bomb-une-mini-requete-suffit-pour-faire-tomber-nginx-apache-ou-iis.html

CVE-2026-8206 (CVSS 9.8): Kirki WordPress Plugin Flaw Lets Attackers Steal Admin Accounts on 500,000+ Sites
#CyberSecurity
https://securebulletin.com/cve-2026-8206-cvss-9-8-kirki-wordpress-plugin-flaw-lets-attackers-steal-admin-accounts-on-500000-sites/

⚠️ CRITICAL: Critical Kirki flaw exploited to hijack WordPress admin accounts

Critical privilege escalation flaw in Kirki WordPress plugin (CVE-2026-8206) allows unauthenticated attackers to reset any user account including admins via an unvalidated REST API endpoint. Wordfence has already blocked 222+ exploitation attempts in 24 hours. Any WordPress site running Kirki versi…

https://threatnoir.com/focus

#infosec #cybersecurity

CVE-2026-41283 - Critical RCE in OpenStack Mistral. API exposure allows code exec & credential exfiltration. CVSS 9.9. No patch yet - restrict API access immediately. #CVE #OpenStack #infosec

https://www.valtersit.com/cve/CVE-2026-41283/

🚨 CRITICAL: CVE-2026-41283 in OpenStack Mistral (v20.0.0 – 22.0.0) allows remote code execution via exposed API. No patch yet. Restrict API to trusted users & monitor closely. Full system compromise possible. https://radar.offseq.com/threat/cve-2026-41283-cwe-863-incorrect-authorization-in--186d9351 #OffSeq #OpenStack #Vuln #CloudSec