Early warning
Most stories here need two independent sources before they get a page. These are the exceptions: a researcher disclosure, a vendor advisory, a CERT notice or a Hacker News warning from a trusted source, published the moment it appears instead of waiting for a second outlet. Each carries an EARLY SIGNAL badge until a second publisher covers it. Stories that started here stay listed once corroborated.
High Severity PHP Object Injection Vulnerability in Duplicator Plugin Discovered
3d agoOn August 30, 2026, Wordfence discovered a high severity unauthenticated PHP Object Injection vulnerability in the Duplicator and Duplicator Pro plugins, tracked as CVE-2026-82814, with a CVSS score of 8.8. This vulnerability affects over one million...
Critical RCE Vulnerability Found in Cognition Versions Prior to 0.13.0
3d agoCognition versions before 0.13.0 have been found to contain an unauthenticated remote code execution (RCE) vulnerability. This flaw arises from the default configuration of its agent sandbox backend, which allows attackers to create sessions and exec...
Critical Vulnerabilities Found in Eptura Archibus Software
4d agoRapid7 identified three significant vulnerabilities in Eptura Archibus, a software used by over 16,000 organizations, including 40% of the Fortune 500. The vulnerabilities include an authentication bypass (CVE-2026-107186, CVSS 8.6), a full database...