Security2 hOctober 14, 2026, 04:33

Critical Ghostscript flaw lets attackers hijack servers via PDF uploads

A critical heap buffer overflow (CVE-2026-39919) in Ghostscript allows remote code execution via crafted PDFs containing JPEG 2000 images. Versions 9.21 through 10.07.1 are affected; a fix shipped September 8 in version 10.08.0.

BleepingComputer

Open source

Critical Ghostscript flaw lets attackers hijack servers via PDF uploads

CVE-2026-39919 writes 1,024 bytes into a 256-byte buffer
Ghostscript 9.21–10.07.1 affected, patched in 10.08.0 on September 8
Exploitable in WordPress when uploaded PDFs are rendered as thumbnails
Wordfence has not seen in-the-wild exploitation yet

#Ghostscript#WordPress#Wordfence#ImageMagick

Elementor Pro CVE-2026-32475: patching doesn't remove the webshell

Security

Four WordPress plugins hit by CVSS 9.8 auth bypass flaws

Security

Hackers target WordPress sites via third-party WooCommerce plugin

Security

Critical Ghostscript flaw lets attackers hijack servers via PDF uploads

Elementor Pro CVE-2026-32475: patching doesn't remove the webshell

Four WordPress plugins hit by CVSS 9.8 auth bypass flaws

Hackers target WordPress sites via third-party WooCommerce plugin

GoBalance Flaw Lets Attackers Hijack .onion Addresses via Public Data