JPCERT‑AT issued an advisory for CVE‑2026‑66066, a remote‑code‑execution flaw in Ruby on Rails Active Storage when using libvips. The advisory details affected versions, exploitation conditions, available mitigations, and forensic detection steps.
JPCERT/CC warns that CVE‑2026‑8452 enables unauthenticated remote code execution on Citrix NetScaler ADC and Gateway when used as SAML SP or IdP, affecting multiple older versions. Upgrade is the only mitigation.
WordPress 7.0.4 is a critical security release addressing a Remote Code Execution (RCE) flaw in the Imagick library. Authenticated users with Author+ privileges can exploit this vulnerability via malicious file uploads. Immediate updates are recommended for all sites using Ghostscript and Imagick.
