Editor

Cloudflare has addressed a security vulnerability impacting its Automatic Certificate Management Environment (ACME) validation logic that made it possible to bypass security controls and access origin servers.

"The vulnerability was rooted in how our edge network processed requests destined for the ACME HTTP-01 challenge path (/.well-known/acme-challenge/*)," the web infrastructure company's Hrushikesh Deshpande, Andrew Mitchell, and Leland Garofalo said.

The web infrastructure company said it found no evidence that the vulnerability was ever exploited in a malicious context.

ACME is a communications protocol (RFC 8555) that facilitates automatic issuance, renewal, and revocation of SSL/TLS certificates. Every certificate provisioned to a website by a certificate authority (CA) is validated using challenges to prove domain ownership.

This process is typically achieved using an ACME client like Certbot that proves domain ownership via an HTTP-01 (or DNS-01) challenge and manages the certificate lifecycle. The HTTP-01 challenge checks for a validation token and a key fingerprint located in the web server.

A maximum-severity security flaw in a WordPress plugin called Modular DS has come under active exploitation in the wild, according to Patchstack.

The vulnerability, tracked as CVE-2026-23550 (CVSS score: 10.0), has been described as a case of unauthenticated privilege escalation impacting all versions of the plugin prior to and including 2.5.1. It has been patched in version 2.5.2. The plugin has more than 40,000 active installs.

"In versions 2.5.1 and below, the plugin is vulnerable to privilege escalation, due to a combination of factors including direct route selection, bypassing of authentication mechanisms, and auto-login as admin," Patchstack said.

The problem is rooted in its routing mechanism, which is designed to put certain sensitive routes behind an authentication barrier. The plugin exposes its routes under the "/api/modular-connector/" prefix.

Central Maine Healthcare is notifying over 145,000 patients that their personal, treatment, and health insurance information was compromised in a data breach.

The incident, the healthcare provider says, was discovered on June 1, 2025, after detecting unusual activity on its IT network.

However, the intrusion spanned several months, between March and June 2025, the organization said in an incident notice.

With help from third-party cybersecurity experts, the organization completed its investigation into the attack on November 6.

The compromised information, Central Maine Healthcare says, includes names, dates of birth, Social Security numbers, treatment details, provider names, dates of service, and health insurance information.

Central Maine Healthcare says it started notifying the potentially affected individuals on July 31, and that the latest round of notifications went out on December 29.

The healthcare organization also established a dedicated, toll-free incident response line to provide the impacted individuals with additional details on the incident.

Fortinet has released updates to fix a critical security flaw impacting FortiSIEM that could allow an unauthenticated attacker to achieve code execution on susceptible instances.

The operating system (OS) injection vulnerability, tracked as CVE-2025-64155, is rated 9.4 out of 10.0 on the CVSS scoring system.

"An improper neutralization of special elements used in an OS command ('OS command injection') vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests," the company said in a Tuesday bulletin.

Fortinet said the vulnerability affects only Super and Worker nodes, and that it has been addressed in the following versions -

Social media giant Meta on Sunday confirmed an Instagram password reset vulnerability but denied being breached, amid claims that Instagram users’ data has been leaked online.

The resolved vulnerability, the company said on X, allowed third parties to send password reset requests to Instagram users.

“We fixed an issue that allowed an external party to request password reset emails for some Instagram users,” a Meta spokesperson told SecurityWeek.

While the company has not shared further details on the weakness, many users complained on X about receiving such emails.

Some users said they have been receiving them for a long time, others received them across multiple Meta products, while others said the recent messages were sent to a “mail list” and were ignored.

“We want to reassure everyone there was no breach of our systems and people’s Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused,” the spokesperson said.