root@ransomvault:~$ tail -f threat_intel.log

RANSOMVAULT

Topics

Patch10Threat Intelligence8Vulnerability7Ransomware3Zero-Day3Malware1Knowledge1
Subscribe to the newsletter →

Topic

Vulnerability

Citrix Patches 10 Critical NetScaler Vulnerabilities

Vulnerability / Patch

Citrix has released security updates fixing 10 critical vulnerabilities across its NetScaler products. Nine of them affect NetScaler ADC and NetScaler Gateway. The tenth is a separate flaw in NetScaler Console that could let unauthenticated attackers bypass access controls. Citrix also fixed many high- and medium-severity bugs, and urges customers to update as soon as possible. Nine critical memory overflow flaws in NetScaler ADC and Gateway The critical vulnerabilities come from memory overflo

Critical Red Hat Quay Flaw Lets Attackers Take Over Registry Token Signing

Vulnerability / Patch

Red Hat has disclosed a critical vulnerability in Red Hat Quay, its enterprise container registry for storing, managing, and distributing container images. The flaw is tracked as CVE-2026-123710 and has a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It lets an attacker take over registry token signing and gain full read and write access to every repository in the registry. How the attack works The flaw is in Quay’s service key server, the component that manages signing

Node.js Fixes 16 Vulnerabilities, Including HTTP/2 Crash and HTTPS Memory Leak That Can Expose TLS Private Keys

Vulnerability / Patch

The Node.js project has released security updates that fix 16 vulnerabilities in the runtime, seven of them rated high. The most serious flaws are in Node.js’s built-in HTTP/2, HTTPS, and TLS server code. They let unauthenticated clients crash servers, corrupt memory, or read memory from other connections, which can include TLS private keys and other users’ requests. Fixed versions are available for all three supported release lines: 22.23.5, 24.22.3, and 26.13.1. HTTP/2 crash (CVE-2026-123863)

Critical Apache HTTP Server Flaw in mod_http2 Enables Unauthenticated Remote Code Execution

Vulnerability / Patch

A critical vulnerability in Apache HTTP Server’s HTTP/2 module, mod_http2, could let a remote attacker run code on vulnerable servers. The flaw is tracked as CVE-2026-119618 and rated 9.8 on the CVSS scale. It affects Apache HTTP Server versions 2.4.55 through 2.4.70 and is fixed in the newly released version 2.4.71. Who is affected Only servers with HTTP/2 enabled are vulnerable. HTTP/2 is turned on with the Protocols directive: h2 enables HTTP/2 over TLS, and h2c enables HTTP/2 over plain TCP

Zoom Patches Critical Privilege Escalation Flaws in Zoom Workplace for Windows

Vulnerability / Patch

Zoom has released security updates for two vulnerabilities in Zoom Workplace for Windows. One of them is rated critical. Both let an unauthenticated attacker escalate privileges over the network, with no special permissions or prior access needed. The vulnerabilities * CVE-2026-108186 (CVSS 9.6, Critical): An improper input validation flaw. An unauthenticated user with network access could exploit it to escalate privileges. It affects Zoom Workplace for Windows from version 7.1.0 up to, but n

Critical Fortinet2Shell Vulnerability

Vulnerability / Patch

Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published the advisory on November 10, 2026. The issue is an origin validation error, classified as CWE-346. Researcher Kevin Joensen from Baldur Security discovered it during internal research and humorously dubbed it “Fortinet2Shell.” He

Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products - Updates Available

Vulnerability / Patch

Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively. Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and o