Security news, decoded.

A critical vulnerability in themefusion Avada (Fusion) Builder, tracked as CVE-2026-8713 (CVSS 9.1), allows unauthenticated attackers to delete arbitrary files on affected servers without login. Versions at or below 3.15.3 are impacted, and the ability to remove sensitive files can lead to full compromise of a WordPress site. Site owners should upgrade to Avada Builder v3.15.4 or later immediately, even though there is no confirmed public exploitation reported yet.

Rebora Security Research reports critical Chrome extension vulnerabilities affecting SiderAI and MaxAI, with issues tracked as CVE-WATCHTOWER. The defects, named Spyder and MaXSS, let attackers abuse extension content scripts to trigger actions without user interaction, including stealing sensitive data and issuing unauthorized commands. Because these extensions are installed on more than 10,000,000 and 1,000,000+ devices respectively, the flaws significantly increase the risk of large-scale browser compromise.

F5 issued urgent out-of-band fixes for two high-impact NGINX vulnerabilities, CVE-2026-42530 (HTTP/3 use-after-free) and CVE-2026-42055 (conditional HTTP/2 heap-based buffer overflow). Both can be triggered by a remote, unauthenticated attacker and carry a CVSS v4.0 score of 9.2, with issues affecting NGINX worker process stability and potential security impact depending on system hardening. This matters because the flaws target widely deployed HTTP/2/HTTP/3 and specific NGINX module paths, so even limited configuration exposure can still affect a large number of deployments.

LiteLLM’s authentication can be bypassed when a malicious actor injects a crafted HTTP Host header, potentially allowing unauthenticated access to protected management routes. The issue is tracked as CVE-2026-49468 (CVSS 9.5) affecting litellm (pip) versions earlier than < 1.84.0, making it critical for deployments that expose the proxy directly. Update to 1.84.0 to remediate; no confirmed exploitation was reported at the time of disclosure.

CISA has added Splunk [CVE-2026-20253] to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw affects Splunk Enterprise versions 10.2 (below 10.2.4) and 10.0 (below 10.0.7), where an authentication weakness in the PostgreSQL sidecar service can enable pre-authenticated remote code execution. Organizations should upgrade to 10.2.4 or 10.0.7 immediately (or disable the PostgreSQL sidecar service as a temporary mitigation) to reduce the risk of compromise.

The Node.js project has issued critical and high-severity security updates that affect the 26.x, 24.x, and 22.x release lines, with patched versions listed as Node.js v22.23.1, v24.17.1, and v26.3.2. Among the fixed issues are CVE-2026-48933 (a WebCrypto AES integer overflow that can crash the process via subtle.encrypt()), and CVE-2026-48618 (a TLS authentication bypass tied to unicode dot separator handling). Additional vulnerabilities include CVE-2026-48615, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48617, CVE-2026-48935, CVE-2026-48936, and CVE-2026-48931, so organizations should upgrade promptly to reduce exposure to DoS and authentication/validation bypasses.

F5 has released patches for two high-severity vulnerabilities affecting NGINX Open Source that could be exploited by unauthenticated remote attackers to achieve remote code execution (RCE): CVE-2026-42530 and CVE-2026-42055. The issues involve a use-after-free in ngxhttpv3module when HTTP/3 QUIC is used, and a heap-based buffer overflow in ngxhttpproxyv2module/ngxhttpgrpcmodule when proxying HTTP/2 with specific settings, potentially impacting systems even with ASLR depending on attacker conditions. Users should update to the fixed versions listed by F5 (notably NGINX Open Source 1.31.2 for CVE-2026-42530 and 1.31.2 / 1.30.3 paths for CVE-2026-42055) and consider F5’s mitigations such as disabling HTTP/3 or removing/reducing the configuration options that enable the second flaw.

ShapedPlugin says multiple of its WordPress plugins were compromised in a supply-chain attack that inserted malicious code into legitimate releases delivered through the vendor’s official update mechanism. The affected paid plugins are Product Slider Pro before 3.5.4 for WooCommerce, Real Testimonials Pro 3.2.5, and Smart Post Show Pro before 4.0.2, where attackers used backdoored builds to steal credentials and enable remote file-writing via impersonated WooCommerce components. WordPress tracking for this incident includes CVE-2026-10735 (with CVE-2026-49777 submitted as a duplicate), highlighting why updating from trusted channels can still be risky when build pipelines are compromised.

Apple has released security updates for Beats Studio Buds to address a high-severity Bluetooth vulnerability that could let attackers within radio range listen via the earbuds’ microphone when the device is unpaired and seeking pair requests. The issue is tracked as CVE-2025-20701 and was fixed in Beats Firmware Update 1B211; in many cases the update is applied automatically when the earbuds pair within range of an iPhone, iPad, or Mac. Since this flaw can be combined with CVE-2025-20700 and CVE-2025-20702 for more intrusive Bluetooth control, it matters for users’ privacy and device safety.

F5 has issued out-of-band updates to fix multiple NGINX vulnerabilities, including critical issues in HTTP modules tracked as CVE-2026-42530 and CVE-2026-42055. These flaws (CVSS 9.2) could be exploited without authentication to trigger memory corruption (use-after-free or heap-based buffer overflow), potentially leading to denial-of-service and, if ASLR is disabled or bypassable, arbitrary code execution. F5 also patched additional NGINX Gateway Fabric bugs CVE-2026-11311 and CVE-2026-50107 that may let authenticated attackers inject malicious configuration directives, plus other medium-severity NGINX issues affecting memory disclosure or stability.

Zyxel has released firmware updates to address a stack-based buffer overflow in its GS1900 series switches, tracked as CVE-2026-7273 and scored 8.8 (CVSS). The issue impacts the GS1900-8, GS1900-24, and GS1900-48HPv2, among other GS1900 models running firmware version 2.90 or earlier, and could allow a LAN-based, unauthenticated attacker to execute commands and potentially take control of the device. Because affected switches are often central to network operations, patching promptly is important to reduce the risk of intrusion and lateral movement.

A vulnerability in RocketGenius Gravity SMTP is being exploited in the wild, tracked as CVE-2026-4020 (CVSS 7.5). The issue affects Gravity SMTP versions ≤ 2.1.4 by allowing unauthenticated attackers to access a REST API endpoint that returns system report details, including sensitive email integration credentials (API keys, secrets, and OAuth tokens). This matters because exposed credentials can enable account compromise and follow-on spam or phishing activity; affected users should upgrade to Gravity SMTP 2.1.5 and rotate any email integration secrets.

Researchers identified a critical LDAP injection issue in Apache Shiro’s DefaultLdapRealm that could let attackers bypass authentication by manipulating the LDAP Distinguished Name (DN) construction. The vulnerability is tracked as CVE-2026-49268 and affects Apache Shiro versions below 2.2.1, as well as versions 3.0.0-alpha-0 through 3.0.0-alpha-1, with a high CVSS score of 8.8. Organizations should remediate by updating to Apache Shiro 2.2.1 or later (or 3.0.0-alpha-2 and later) to prevent impersonation and unauthorized access.

Rockwell Automation has released security updates for vulnerabilities in several ICS products, including Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx, and the FactoryTalk automation suite. The advisories address issues such as authentication bypass and denial-of-service risks in FactoryTalk Historian Site Edition (CVE IDs not specified in the article), improper API authorization in FactoryTalk Analytics PavilionX, multiple DoS flaws in certain CompactLogix/ControlLogix and GuardLogix controllers (including CVE IDs not specified), and a critical adapter weakness that could let an unauthenticated attacker reset a web interface password. While Rockwell noted in-the-wild exploitation of an older issue tracked as CVE-2021-22681, the article says the newly patched vulnerabilities have not yet been targeted by threat actors.

Microsoft has acknowledged a publicly disclosed privilege-escalation flaw in Microsoft Defender’s Microsoft Malware Protection Engine, tracked as CVE-2026-50656 (CVSS 7.8). The issue, dubbed “RoguePlanet,” is linked to a race condition that can let attackers elevate privileges to System on Windows 10 and Windows 11, and it matters because it turns Defender into a local elevation vector. Microsoft says it is working on a high-quality security update to address CVE-2026-50656 and will provide details once the fix is available.