🚨 SlowMist TI Alert: CVE-2026-85706 🚨 🔴 A critical path traversal vulnerability in @gitlab CE/EE (CVSS 10.0) could allow unauthenticated attackers to read arbitrary files from affected GitLab servers via the Repository Commits API. 🛠️ GitLab has released security patches to address this vulnerability. ⚠️ Affected: affected from 18.7 before 19.1.8 affected from 19.2 before 19.2.6 affected from 19.3 before 19.3.2 🚨 Self-managed GitLab users should upgrade to 19.1.8, 19.2.6, or 19.3.2 immediately, and review logs and potentially exposed credentials after patching. 🔐 Stay alert and keep your infrastructure up to date. 🔗

2026 Linux 重置密码教程大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)

Two days ago JFrog dropped CVE-2026-82329, a critical authentication bypass in Artifactory. It’s a CVSS 9.8, a disastrous vulnerability score. It’s like a 9.8 earthquake on the seismic scale. It affects default configs, requires no auth, no user interaction. It’s an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that. When the OpenAI / Hugging Face news came out of agents discovering zero-days, I was wondering if it was marketing-speak or reality, because I hadn’t seen a CVE filing. Now it’s here: https://www​.cve.org/CVERecord?id=CVE-2026-82329. I don’t see any official confirmation that it’s indeed the case, but one can speculate this is what the agents discovered and exploited. I’d previously written that it was obvious agents could help in finding serious vulnerabilities *alongside humans*, but exploiting them autonomously was a bridge not yet crossed. It seems like we’re now there. Our guidance for this new world: assume everything hackable will get hacked. And it will get hacked autonomously. You must also defend yourself autonomously, because your surface of attack is likely bigger and your code more vulnerable than you expect: https://vercel​.com/blog/everything-hackable-will-get-hacked

🚨 Attackers are exploiting a Roundcube pre-auth SQL injection flaw patched in May. CVE-2026-48842 can expose mail credentials and stored messages through the virtuser_query plugin. Read:

Palo Alto Networks says attackers are actively exploiting a GlobalProtect VPN vulnerability known as CVE-2026-0257. The bug affects certain GlobalProtect portal and gateway setups and lets attackers connect to a VPN without the usual login and authentication checks. Since GlobalProtect is typically exposed to the internet, a successful attack could give cybercriminals access to an organization’s internal network. Security researchers have already observed real-world attacks targeting vulnerable systems. If your organization uses GlobalProtect, check whether you are affected and install the latest security updates. Palo Alto Networks has released fixes for supported PAN-OS versions and urges customers to update as soon as possible. Security teams should also monitor VPN logs and investigate any unusual login activity or unexpected VPN connections.

Hackers are actively exploiting a critical vulnerability in cPanel and WHM known as CVE-2026-41940. This authentication bypass allows attackers to gain full admin access to web servers without needing any login information, the issue affects all currently supported versions of cPanel and WHM. The flaw has been under active attack since February 2026 and presents a major threat to shared hosting providers and the millions of websites they host. Attackers could steal data, install malware, or take over entire servers. cPanel released security patches on April 28 and recommends updating immediately. Many large hosting companies such as HostGator and Namecheap have already deployed the fix. If your server runs cPanel, apply the update now or contact your host to make sure you are protected.

Shabbat Shalom. @Docker has issued a critical level (!!) CVE-2026-77179, reported by @Accomplish_ai researcher @orenyomtov. If you use Docker Sandboxes, run sbx --version. Make sure you’re running 0.42.0 or later. If you use Docker Desktop, you want 4.88.0 or later Docker Desktop and Docker Sandboxes are both affected. Docker Desktop is only affected if Docker VMM is turned on in Settings. It’s a good thing we found it now, because Docker VMM is scheduled to become the default for Docker Desktop at the end of October 2026! The escape is in Docker's hypervisor for Mac: a container gets complete read and write access to the host filesystem. Read the full details of this escape in our blog: