Security news, decoded.

LiteLLM’s authentication can be bypassed when a malicious actor injects a crafted HTTP Host header, potentially allowing unauthenticated access to protected management routes. The issue is tracked as CVE-2026-49468 (CVSS 9.5) affecting litellm (pip) versions earlier than < 1.84.0, making it critical for deployments that expose the proxy directly. Update to 1.84.0 to remediate; no confirmed exploitation was reported at the time of disclosure.

CISA has added Splunk [CVE-2026-20253] to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw affects Splunk Enterprise versions 10.2 (below 10.2.4) and 10.0 (below 10.0.7), where an authentication weakness in the PostgreSQL sidecar service can enable pre-authenticated remote code execution. Organizations should upgrade to 10.2.4 or 10.0.7 immediately (or disable the PostgreSQL sidecar service as a temporary mitigation) to reduce the risk of compromise.

The Node.js project has issued critical and high-severity security updates that affect the 26.x, 24.x, and 22.x release lines, with patched versions listed as Node.js v22.23.1, v24.17.1, and v26.3.2. Among the fixed issues are CVE-2026-48933 (a WebCrypto AES integer overflow that can crash the process via subtle.encrypt()), and CVE-2026-48618 (a TLS authentication bypass tied to unicode dot separator handling). Additional vulnerabilities include CVE-2026-48615, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48617, CVE-2026-48935, CVE-2026-48936, and CVE-2026-48931, so organizations should upgrade promptly to reduce exposure to DoS and authentication/validation bypasses.

F5 has released patches for two high-severity vulnerabilities affecting NGINX Open Source that could be exploited by unauthenticated remote attackers to achieve remote code execution (RCE): CVE-2026-42530 and CVE-2026-42055. The issues involve a use-after-free in ngxhttpv3module when HTTP/3 QUIC is used, and a heap-based buffer overflow in ngxhttpproxyv2module/ngxhttpgrpcmodule when proxying HTTP/2 with specific settings, potentially impacting systems even with ASLR depending on attacker conditions. Users should update to the fixed versions listed by F5 (notably NGINX Open Source 1.31.2 for CVE-2026-42530 and 1.31.2 / 1.30.3 paths for CVE-2026-42055) and consider F5’s mitigations such as disabling HTTP/3 or removing/reducing the configuration options that enable the second flaw.

ShapedPlugin says multiple of its WordPress plugins were compromised in a supply-chain attack that inserted malicious code into legitimate releases delivered through the vendor’s official update mechanism. The affected paid plugins are Product Slider Pro before 3.5.4 for WooCommerce, Real Testimonials Pro 3.2.5, and Smart Post Show Pro before 4.0.2, where attackers used backdoored builds to steal credentials and enable remote file-writing via impersonated WooCommerce components. WordPress tracking for this incident includes CVE-2026-10735 (with CVE-2026-49777 submitted as a duplicate), highlighting why updating from trusted channels can still be risky when build pipelines are compromised.

Apple has released security updates for Beats Studio Buds to address a high-severity Bluetooth vulnerability that could let attackers within radio range listen via the earbuds’ microphone when the device is unpaired and seeking pair requests. The issue is tracked as CVE-2025-20701 and was fixed in Beats Firmware Update 1B211; in many cases the update is applied automatically when the earbuds pair within range of an iPhone, iPad, or Mac. Since this flaw can be combined with CVE-2025-20700 and CVE-2025-20702 for more intrusive Bluetooth control, it matters for users’ privacy and device safety.

F5 has issued out-of-band updates to fix multiple NGINX vulnerabilities, including critical issues in HTTP modules tracked as CVE-2026-42530 and CVE-2026-42055. These flaws (CVSS 9.2) could be exploited without authentication to trigger memory corruption (use-after-free or heap-based buffer overflow), potentially leading to denial-of-service and, if ASLR is disabled or bypassable, arbitrary code execution. F5 also patched additional NGINX Gateway Fabric bugs CVE-2026-11311 and CVE-2026-50107 that may let authenticated attackers inject malicious configuration directives, plus other medium-severity NGINX issues affecting memory disclosure or stability.

Zyxel has released firmware updates to address a stack-based buffer overflow in its GS1900 series switches, tracked as CVE-2026-7273 and scored 8.8 (CVSS). The issue impacts the GS1900-8, GS1900-24, and GS1900-48HPv2, among other GS1900 models running firmware version 2.90 or earlier, and could allow a LAN-based, unauthenticated attacker to execute commands and potentially take control of the device. Because affected switches are often central to network operations, patching promptly is important to reduce the risk of intrusion and lateral movement.

A vulnerability in RocketGenius Gravity SMTP is being exploited in the wild, tracked as CVE-2026-4020 (CVSS 7.5). The issue affects Gravity SMTP versions ≤ 2.1.4 by allowing unauthenticated attackers to access a REST API endpoint that returns system report details, including sensitive email integration credentials (API keys, secrets, and OAuth tokens). This matters because exposed credentials can enable account compromise and follow-on spam or phishing activity; affected users should upgrade to Gravity SMTP 2.1.5 and rotate any email integration secrets.

Researchers identified a critical LDAP injection issue in Apache Shiro’s DefaultLdapRealm that could let attackers bypass authentication by manipulating the LDAP Distinguished Name (DN) construction. The vulnerability is tracked as CVE-2026-49268 and affects Apache Shiro versions below 2.2.1, as well as versions 3.0.0-alpha-0 through 3.0.0-alpha-1, with a high CVSS score of 8.8. Organizations should remediate by updating to Apache Shiro 2.2.1 or later (or 3.0.0-alpha-2 and later) to prevent impersonation and unauthorized access.

Rockwell Automation has released security updates for vulnerabilities in several ICS products, including Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx, and the FactoryTalk automation suite. The advisories address issues such as authentication bypass and denial-of-service risks in FactoryTalk Historian Site Edition (CVE IDs not specified in the article), improper API authorization in FactoryTalk Analytics PavilionX, multiple DoS flaws in certain CompactLogix/ControlLogix and GuardLogix controllers (including CVE IDs not specified), and a critical adapter weakness that could let an unauthenticated attacker reset a web interface password. While Rockwell noted in-the-wild exploitation of an older issue tracked as CVE-2021-22681, the article says the newly patched vulnerabilities have not yet been targeted by threat actors.

Microsoft has acknowledged a publicly disclosed privilege-escalation flaw in Microsoft Defender’s Microsoft Malware Protection Engine, tracked as CVE-2026-50656 (CVSS 7.8). The issue, dubbed “RoguePlanet,” is linked to a race condition that can let attackers elevate privileges to System on Windows 10 and Windows 11, and it matters because it turns Defender into a local elevation vector. Microsoft says it is working on a high-quality security update to address CVE-2026-50656 and will provide details once the fix is available.

Black Lotus Labs reports that the China-nexus JDY botnet has grown and is again scanning the internet for newly disclosed vulnerabilities within hours, using masked infrastructure and scanning techniques designed to blend into normal traffic. Compromised devices include Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys, and the activity is notably tied to Fortinet systems following publication of CVE-2026-35616. The fast weaponization window matters because edge and embedded deployments are often harder to monitor and patch, increasing the chance of pre-patch probing and exploitation.

AdGuard has released a new email filtering capability (AdGuard Email Tracking Protection) designed to stop hidden 1×1 pixel trackers in messages that reveal when an email is opened and can expose client and device details. This matters because many marketing campaigns rely on these “invisible” image loads to measure engagement and track recipients. The article also references AdGuard’s ongoing security work, including CVE-2024-36814, underscoring that privacy and protection features are now a focus across its product updates.

Attackers are exploiting security weaknesses in Joomla’s Content Editor (JCE) and the LiteSpeed cPanel plugin to gain code execution and escalate privileges. Joomla JCE Pro versions before 2.9.99.5 are affected by CVE-2026-48907, enabling unauthenticated abuse to upload arbitrary files and run PHP code; fixes were released in 2.9.99.5 and strengthened again in 2.9.99.6. Separately, LiteSpeed’s user-end cPanel plugin versions before 2.4.8 are impacted by CVE-2026-54420, where improper symlink handling can let attackers escalate to root on shared hosting running CloudLinux/CageFS; both issues have been added to CISA’s KEV catalog, underscoring the urgency to patch.