Topics
rce
N-able Pulls N-central Cloud Offline After 33 Zero-Days (Able2Shell) Dropped with PoC Exploits
Researcher Sean Bales published Able2Shell — 30+ unpatched N-central vulnerabilities with PoC scripts reaching root — and N-able took its hosted N-central offline and told on-prem customers to shut servers down.
Zyxel GS1900 Patched Switches Stay Exposed: New Patch 3 Firmware Fixes It as CVE-2026-107441
Binarly found the June patch for an exploited Zyxel GS1900 switch flaw leaves the same pre-auth root RCE open; firmware 2.90 Patch 3, fixing it as CVE-2026-107441, is out for ten models after roughly 996 switches were looted.
WordPress CVE-2026-119977: Patching an Exploited Updater Race Condition Can Briefly Reopen It
CVE-2026-119977 — a WordPress updater race now on CISA KEV — is fixed in 7.1.4 and branch backports to 4.7.39; the fixing update itself unpacks with old code, so block wp-content/upgrade access before patching.
PHP2Shell: Critical RCE Vulnerabilities in PHP Core
The PHP Group patched two critical core flaws (CVE-2026-109618, CVE-2026-109619, rated 9.2) that allow unauthenticated remote code execution; exploitation in the wild is confirmed and CISA urges immediate patching.