Check Point patched a critical flaw in its management servers that lets an unauthenticated attacker run code as root. Tracked as CVE-2026-91843 and scored 9.8, it is a stack overflow in the login process, which handles requests before a user authenticates, and it can be triggered by a login request carrying an overly long username. It affects Quantum management, Log, and Multi-Domain servers, through the Trusted Clients path. Customers with automatic updates are already protected, and others should apply the vendor's live patch. Check Point reports no exploitation yet, but this is the third serious management-server flaw it has disclosed in weeks, and compromising it means control over the whole firewall estate.
N-able released its fourth hotfix in five weeks for its N-central remote monitoring and management platform, this time for a flaw that gives an unauthenticated attacker full "god-mode" access to the console. Tracked as CVE-2026-86218 and scored 10.0, the pre-authentication remote code execution zero-day is being exploited and supersedes all earlier hotfixes, so on-premises systems still on the third hotfix remain vulnerable and must apply the fourth. Hosted instances have already been patched. Researchers also disclosed a separate chain that lets attackers bypass access controls to create unauthorized administrator accounts. Because N-central manages many downstream endpoints, a compromise can cascade across every customer it serves.
Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval function inside vBulletin and run code on an unpatched forum server. The attack needs no account, administrative access, or interaction from another user, making any internet-facing vulnerable forum a direct target. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier and 6.1.6 and earlier as affected, without giving a lower version boundary. Forum software is an attractive target because it is public by design, often runs with limited maintenance, and a single compromised server can host web shells, redirect visitors, or expose community member data. Administrators should confirm their version and patch level.
Public exploit code is now available for wp2shell, a pair of WordPress core flaws that chain into pre-authentication remote code execution against a stock site with no plugins installed. CVE-2026-63030 is a route confusion bug in the REST API batch endpoint, which has shipped enabled by default since 2020, and CVE-2026-60137 is a SQL injection in the author parameter handling of WP_Query. Chained, an anonymous HTTP request can run code on the server. The chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, fixed in 6.9.5 and 7.0.2, and WordPress enabled forced automatic updates given the severity.
A critical flaw in Progress Kemp LoadMaster lets an unauthenticated attacker run commands as root on the appliance by sending a crafted request to its API. Rated 9.8, the bug (CVE-2026-8037) sits in a function meant to sanitize input before it reaches a shell command, and LoadMaster's position as an edge load balancer and application delivery controller makes a pre-authentication flaw especially dangerous, since it can turn a protective choke point into a direct foothold. Progress patched it in early June, and researchers at watchTowr published a full technical write-up with a working proof-of-concept on June 29. No exploitation has been reported yet, but Progress also makes MOVEit, a past mass-exploitation target.
TrustStrike Labs