root@ransomvault:~$ tail -f threat_intel.log

RANSOMVAULT

Topics

Patch10Threat Intelligence8Vulnerability7Ransomware3Zero-Day3Malware1Knowledge1
Subscribe to the newsletter →

Topic

Patch

Citrix Patches 10 Critical NetScaler Vulnerabilities

Vulnerability / Patch

Citrix has released security updates fixing 10 critical vulnerabilities across its NetScaler products. Nine of them affect NetScaler ADC and NetScaler Gateway. The tenth is a separate flaw in NetScaler Console that could let unauthenticated attackers bypass access controls. Citrix also fixed many high- and medium-severity bugs, and urges customers to update as soon as possible. Nine critical memory overflow flaws in NetScaler ADC and Gateway The critical vulnerabilities come from memory overflo

New N-able N-central Zero-Days “4EverAble2Shell” and “Agent2Shell” Bypass Able2Shell Hotfix; Exploitation Attempts Already Seen

Malware / Patch

N-able says it is investigating a new public disclosure of more vulnerabilities in on-premise N-central servers running version 2026.4.1 HF2. That is the hotfix it released only days ago to fix the Able2Shell vulnerabilities. Public proof-of-concept (PoC) exploits are available, and threat intelligence firms have already seen targeted probing within hours of their release. Background: Able2Shell Earlier this week, independent security researcher Sean Bales disclosed several security flaws in N-

Critical Red Hat Quay Flaw Lets Attackers Take Over Registry Token Signing

Vulnerability / Patch

Red Hat has disclosed a critical vulnerability in Red Hat Quay, its enterprise container registry for storing, managing, and distributing container images. The flaw is tracked as CVE-2026-123710 and has a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It lets an attacker take over registry token signing and gain full read and write access to every repository in the registry. How the attack works The flaw is in Quay’s service key server, the component that manages signing

Node.js Fixes 16 Vulnerabilities, Including HTTP/2 Crash and HTTPS Memory Leak That Can Expose TLS Private Keys

Vulnerability / Patch

The Node.js project has released security updates that fix 16 vulnerabilities in the runtime, seven of them rated high. The most serious flaws are in Node.js’s built-in HTTP/2, HTTPS, and TLS server code. They let unauthenticated clients crash servers, corrupt memory, or read memory from other connections, which can include TLS private keys and other users’ requests. Fixed versions are available for all three supported release lines: 22.23.5, 24.22.3, and 26.13.1. HTTP/2 crash (CVE-2026-123863)

Critical Apache HTTP Server Flaw in mod_http2 Enables Unauthenticated Remote Code Execution

Vulnerability / Patch

A critical vulnerability in Apache HTTP Server’s HTTP/2 module, mod_http2, could let a remote attacker run code on vulnerable servers. The flaw is tracked as CVE-2026-119618 and rated 9.8 on the CVSS scale. It affects Apache HTTP Server versions 2.4.55 through 2.4.70 and is fixed in the newly released version 2.4.71. Who is affected Only servers with HTTP/2 enabled are vulnerable. HTTP/2 is turned on with the Protocols directive: h2 enables HTTP/2 over TLS, and h2c enables HTTP/2 over plain TCP

Zoom Patches Critical Privilege Escalation Flaws in Zoom Workplace for Windows

Vulnerability / Patch

Zoom has released security updates for two vulnerabilities in Zoom Workplace for Windows. One of them is rated critical. Both let an unauthenticated attacker escalate privileges over the network, with no special permissions or prior access needed. The vulnerabilities * CVE-2026-108186 (CVSS 9.6, Critical): An improper input validation flaw. An unauthenticated user with network access could exploit it to escalate privileges. It affects Zoom Workplace for Windows from version 7.1.0 up to, but n

Critical Fortinet2Shell Vulnerability

Vulnerability / Patch

Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published the advisory on November 10, 2026. The issue is an origin validation error, classified as CWE-346. Researcher Kevin Joensen from Baldur Security discovered it during internal research and humorously dubbed it “Fortinet2Shell.” He

Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products - Updates Available

Vulnerability / Patch

Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively. Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and o

CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability

Zero-Day / Patch

Microsoft patched a Microsoft Outlook Spoofing zero-day vulnerability that was actively exploited in attacks to steal NTLM account hashes. "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook," warns Microsoft. "Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication informa

Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026

Zero-Day / Patch

Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after it has already been freed. Successful exploitation of these vulnerabilities could allow an attacker to