News Archives

Critical Drupal Core Vulnerability Puts PostgreSQL Sites at Risk of RCE

Drupal has patched a critical core vulnerability (CVE-2026-9082) that allows SQL injection on PostgreSQL-backed sites, potentially enabling data leaks, privilege escalation, or remote code execution. Apply updates immediately.

May 21, 2026

Drupal schedules urgent core security updates for today (May 20); site owners urged to reserve time

Drupal has announced a coordinated core security release for all supported branches on May 20, 2026 (05:00–21:00 UTC). Site owners are urged to reserve time to test and apply updates, with specific patch recommendations and guidance for end-of-life versions.

May 20, 2026

Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials

Threat actors hijacked popular GitHub Actions workflows (actions-cool) by redirecting tags to malicious commits that steal CI/CD credentials and exfiltrate them to an attacker-controlled server. Security researchers link the activity to the Mini Shai-Hulud campaign and advise pinning actions to full commit SHAs.

May 19, 2026

NGINX CVE-2026-42945 Under Active Attack, Causing Worker Crashes and Potential RCE

A high-severity heap overflow in NGINX is being exploited in the wild, triggering worker crashes and potential RCE in specific configurations. VulnCheck also reports active attacks against several critical openDCIM flaws.

May 18, 2026

18-Year-Old Flaw in NGINX Rewrite Module Allows Unauthenticated RCE

Researchers disclosed an 18-year-old heap overflow in NGINX rewrite module (CVE-2026-42945,

May 15, 2026

iOS 26.5 Introduces Default End-to-End Encrypted RCS Between iPhone and Android

Apple’s iOS 26.5 introduces beta support for end-to-end encrypted RCS messaging between iPhone and Android, enabled by default and delivered alongside patches for over 50 security vulnerabilities.

May 13, 2026