Critical bug in CrowdStrike LogScale let attackers access files
2026-04-26T20:51:44Z•3fda66e5684757f40e796d28ee47d1518d6d4c9473880f2d957a1422fde6dca6
APTBreeze-CacheCISACVE-2026-3844CVE-2026-40050CVE-2026-41651China-linkedCisco ASACrowdStrikeFIRESTARTERGoGopherWhisperLogScaleMongoliaTrigonaWordPresscriticalexfiltrationexploitationpath-traversalphishingprivilege-escalationransomwareunauthenticated-accessvulnerability
What happened
Multiple high-impact security developments: CrowdStrike fixed a critical unauthenticated path-traversal in LogScale (CVE-2026-40050) that could expose arbitrary server files. WordPress Breeze Cache plugin is being actively exploited (CVE-2026-3844, CVSS 9.8) to upload files without authentication, affecting hundreds of thousands of sites. A long‑standing PackageKit privilege-escalation bug (Pack2TheRoot, CVE-2026-41651, CVSS 8.8) allows local users to gain root. ESET uncovered a China-aligned APT dubbed GopherWhisper targeting Mongolian government entities with Go-based loaders and backdoors.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 3fda66e5684757f40e796d28ee47d1518d6d4c9473880f2d957a1422fde6dca6
- Enrichment time
- 2026-04-26T20:51:44Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.