All articles tagged with #security update
WordPress released version 7.1.2 on September 22 to fix CVE-2026-87902, a critical unauthenticated path traversal vulnerability. Attackers began exploiting the flaw within hours of the patch, escalating from reconnaissance to writing malicious files that execute shell commands. The vulnerability, rated 9.2/10, affects versions 4.7 through 7.1.1 and requires specific server configurations for full remote code execution.
Microsoft rolled out a fix (KB5002665) to address the copy-paste failure in Excel 2016 caused by the September 2026 KB5002914 update. The patch mitigates the issue only for MSI-based Office 2016, with Click-to-Run editions unaffected for now. Other Excel versions may receive fixes separately. Until a universal solution lands, users can use Paste Special (Home > Paste > Paste Special or Ctrl+Alt+V) or uninstall KB5002914 to regain functionality, though uninstalling removes other security patches. The problem produced silent paste failures and was discussed on Microsoft Q&A and Reddit.
Samsung released an urgent 553 MB security patch for Galaxy smartphones to fix eight critical vulnerabilities, including Android data-validation issues; the update also enhances One UI 8.5, Android 16, and Google Play system reliability, with guidance to install via Settings > Software Update and to keep Google Play and Galaxy Store apps current for better protection and performance.
Google issued an emergency Chrome security update (Windows/macOS: 149.0.7827.102/103; Linux: 149.0.7827.102) patching 74 vulnerabilities, including a critical zero-day in the V8 engine that was observed exploited in the wild (CVE-2026-11645). The release also fixes 17 Critical flaws across core subsystems after a broad security audit, with many use-after-free memory issues that could enable remote code execution. An external researcher “303f06e3” discovered the zero-day, for which Google awarded $55,000; update guidance is to manually install the patch now via Help → About Google Chrome and relaunch, with enterprise admins urged to push the update to endpoints promptly as automatic rollout continues.
Drupal released highly critical security updates for Drupal Core to fix CVE-2026-9082, a flaw in the database abstraction API that allows anonymous attackers to perform arbitrary SQL injections on PostgreSQL sites, potentially leading to information disclosure, privilege escalation, or remote code execution (CVSS 6.5). Affected versions include 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10; Drupal 7 is not affected. End-of-life releases are patched on a best-effort basis, and the updates include upstream fixes for Symfony and Twig.
Drupal has issued a critical core security release to fix a high-exploitation vulnerability affecting Drupal 8 and newer. Administrators should plan to apply the update on May 20 UTC, upgrading to at least Drupal 10.6 or using hotfixes for older 9.x/8.x where available. Patches are released for 11.3.x, 11.2.x, 11.1.x, 10.6.x, 10.5.x, and 10.4.x; Drupal 8/9 are end-of-life and won’t receive patches, though hotfixes will be published for 9.5 and 8.9. Drupal Steward customers are protected but should still update. No technical vulnerability details are disclosed yet; admins should monitor Drupal’s security portal for official guidance.
Microsoft confirms the May 2026 Windows 11 security update KB5089549 may fail to install on devices with very little free space on the EFI System Partition, typically rolling back at 35–36% with 0x800f0922 errors. Known Issue Rollback is recommended as a workaround, and IT admins can apply a Group Policy-based mitigation in enterprise environments while Microsoft works on a fix.
Google is rolling out its May 2026 security update for Pixel devices from the Pixel 7a to the Pixel 10 (including the Pixel Tablet). The update targets a slow wireless charging issue that occurs around 75–80% battery, and persistent display problems on the Pixel 10 series (flickering/freezing), along with a camera issue where recording and zoom could freeze. It also includes a framework fix for the Pixel keyboard. The patch, labeled vCP1A.260505.005, is a bite-sized rollout that will continue over time.
cPanel released security updates to fix a critical authentication vulnerability across all supported versions, listing patched builds (11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5); Namecheap temporarily blocked cPanel/WHM ports 2083 and 2087 as a precaution, with patches rolling out and some servers already updated as of April 29, 2026.
Google released a major Chrome security update on April 15, 2026, addressing 31 vulnerabilities in all channels (Windows/macOS: 147.0.7727.101/102; Linux: 147.0.7727.101). Five are rated Critical and could allow arbitrary code execution via memory corruption in components like ANGLE, Skia, Proxy, Prerender, and XR; other high-severity fixes include Turbofan and Media issues. Users should update immediately through Chrome > Help > About Google Chrome and relaunch. Google notes bug details will be restricted until a broad user base patches to prevent exploitation.
Ubiquiti disclosed two critical-to-high vulnerabilities in UniFi Network Application: CVE-2026-22557, a path-traversal flaw that can allow unauthenticated attackers to seize full control of the underlying host, and CVE-2026-22558, an authenticated NoSQL injection enabling privilege escalation. Affected versions include UniFi Network App 10.1.85 and earlier, 10.2.93 and earlier, and UniFi Express Network App 9.0.114 and earlier. Patches are available: official 10.1.89+ (or RC 10.2.97+; UX 4.0.13+) bundling Network App 9.0.118+. Given the CVSS 10 rating for CVE-2026-22557, patch immediately and implement network segmentation/firewall controls for the UniFi management interface.
Samsung has begun a global rollout of the February 2026 security patch for the Galaxy S25 lineup (S25, S25+, S25 Ultra, S25 FE, S25 Edge), with builds ending in BZB5 or AZB6; the update started in Korea and is expanding across Asia and Europe via Settings > Software update. This patch may be the last security update before Samsung begins rolling out One UI 8.5, though a release date for 8.5 remains unclear.
Microsoft's February 10, 2026 security update KB5077181 for Windows 11 versions 24H2 and 25H2 appears to trigger boot loops on affected devices, forcing multiple restarts; while it patches 58 vulnerabilities (including six zero-days) and ships new Secure Boot certificates to improve boot integrity, users report login failures with System Event Notification Service errors, DHCP connectivity losses, and install errors such as 0x800f0983/0x800f0991, prompting uninstall guidance via Control Panel or Windows Recovery Environment and a suggested SFC scan; enterprises should test via WSUS and monitor health while Microsoft has not publicly acknowledged the issues.
Microsoft issued an out-of-band emergency patch for the January 2026 Windows security update that fixes a shutdown/hibernate bug on some Windows 11 PCs and restores remote login via credential prompts on Windows 10/11 devices; the fix also addresses Secure Launch startup-security issues. Some users still report lingering problems like blank screens or Outlook Classic crashes, and Microsoft noted related fixes from October 2025 for Windows Recovery Environment. Windows 10 users can continue with Extended Security Updates if they’re not ready to upgrade.
Microsoft’s January 13, 2026 security update KB5073455 for Windows 11 23H2 (OS Build 22621.6491) triggers a shutdown bug on Enterprise and IoT editions, causing devices to reboot instead of powering down or entering hibernation due to interference with Secure Launch (a virtualization-based security feature). IT teams report power-management issues and potential data loss; a workaround is to force shutdown via shutdown /s /t 0, while a fix is promised in a future update. Disabling Secure Launch via Group Policy can restore normal shutdown but weakens boot integrity.