Tag

security patch

3 stories

Active exploitation in Drupal Commerce Core (CVE-2026-118539): urgent patching for online stores

Drupal has issued a public advisory warning that a critical flaw in the Commerce Core module is being actively exploited, placing online stores at risk of unauthorized changes to orders and other store data. Published on October 28, 2026, the advisory identifies missing access checks in routes and entity fields that could let attackers reach functions or modify data they should not control. Drupal assigned the issue a high risk…

Saugata DattaOct 31, 20264 min read124

Cybersecurity

Emergency Java Patch: Oracle Distrusts eMudhra Intermediates to Fix CVE-2026-91403

Oracle has released an emergency Java security update to address a critical certificate-trust vulnerability that could let attackers impersonate legitimate HTTPS services. Published October 21, 2026 and tracked as CVE-2026-91403 with a CVSS 3.1 score of 9.1, the issue affects the Java Secure Socket Extension (JSSE) and several GraalVM builds. Although Oracle reports no confirmed exploitations yet, the low complexity and lack of required authentication make this an urgent patch…

Saugata DattaOct 23, 20264 min read227

Cybersecurity

Admin Account Backdoor: Critical Privilege-Flaw in WordPress User Registration Plugin (CVE-2026-1492)

A critical security flaw in a widely used WordPress membership plugin has made it trivially simple for unauthenticated attackers to create administrator accounts and seize control of affected sites. The vulnerability, tracked as CVE-2026-1492, exposes a systemic weakness in how the plugin handled role assignment during user registration. This post summarizes what happened, who discovered it, the immediate risks, and the concrete steps site owners should take now. What the…

Saugata DattaMar 6, 20263 min read974

Active exploitation in Drupal Commerce Core (CVE-2026-118539): urgent patching for online stores

Emergency Java Patch: Oracle Distrusts eMudhra Intermediates to Fix CVE-2026-91403

Admin Account Backdoor: Critical Privilege-Flaw in WordPress User Registration Plugin (CVE-2026-1492)

Free Tools: IP, DNS, SSL