Servers, Cloud & Remote Access
Linux, VMware, Oracle, remote-support and cloud platforms: server flaws and what to patch this week.
Mittwald MCP Server Breach: An Attacker Used a Web Host's AI Assistant Connector to Compromise 56 Customer Projects, What Is Confirmed and What to Check
German web host Mittwald says an attacker got in through the MCP server customers use to connect AI assistants, compromising 56 projects. Here is what is confirmed, what is only claimed, and what to check this week.
LNbits Attack: Operators Told to Shut Down Bitcoin Lightning Wallet Servers, What Is Confirmed and What to Do Before Restarting
LNbits told everyone running its Bitcoin Lightning wallet server to stop it immediately after a wave of attacks. One operator reports 2,285,545 sats withdrawn. Here is what is confirmed and what to do.
NotC2 AWS Bedrock C2: Researchers Turn Stolen Cloud Credentials Into a Hidden AI Control Channel, and What to Check This Week
Varonis built NotC2, a proof of concept that uses AWS services and Bedrock AI as a hidden control channel after credentials are stolen. There is no patch, so permissions and logs are what count.
ModSecurity Vulnerability CVE-2026-104269: File Uploads Can Slip Past WAF Rules, Three Flaws Rated High, and the Fixed Versions to Install
ModSecurity published eight security advisories on September 30, 2026, three rated High, including a file upload bypass of WAF filename rules. What is confirmed, what is not, and the versions to install.
Plex2Shell Vulnerability: Attackers Are Hitting Unpatched Plex Media Servers With Crypto Miners and Proxy Software, and the Build to Install
Plex says attackers are widely exploiting unpatched, internet-facing Plex Media Servers through the Plex2Shell flaws. Here is what is confirmed, the build to install, and what to do if yours was exposed.
GhostAction GitHub Attack: Stolen Logins Targeted More Than 30,000 Repositories for Cloud and AI Keys, What Is Confirmed and What to Check This Week
GhostAction uses stolen GitHub logins to plant a fake security workflow that hunts cloud keys, AI keys and publishing tokens. Here is what researchers confirmed, what is unknown and what to check this week.
React Server Components RCE: Critical Flaw GHSA-xqc2-xf4c-x3h3 Lets Attackers Run Code With No Login, and the Fixed Versions to Install
React disclosed a critical flaw, rated 9.5 out of 10, that can let an attacker with no login run code on the server. Here is who is affected, what is not known, and the versions to install.
ForgeRock Default Password: admin:admin Let Researchers Into Two Automakers' Login Systems and Start a Car, and What to Check on Yours
Researchers say a default admin:admin password on ForgeRock identity servers exposed customer accounts at two unnamed automakers and let them unlock and start a car. Here is what is confirmed and what to check.
Lindnor Backdoor SQL Server Attack: New Malware Disguised as Chrome and VMware Files in Anubis Ransomware Intrusion, What Is Confirmed and How to Check Yours
Symantec found a new backdoor called Lindnor on two Microsoft SQL Servers in an October 2026 Anubis ransomware attack. The encryption was blocked. Here is what is confirmed, what is not, and how to check your servers.
