This is a notice from the Information Security Office to alert you to a critical vulnerability that impacts WordPress, a common website management platform[1]. Please share this alert internally with IT admins and service owners who run the product so they are aware and know what actions to take to address this vulnerability.
Security Alerts
July 20, 2026
May 8, 2026
To the UCB-Security community,
This is a notice from the Information Security Office to alert you to critical vulnerabilities that impact Linux systems. Please share this alert internally with IT admins and service owners who run Linux so they are prepared to take action when patches become available.
This is a preliminary announcement. More information will follow when we have it.
May 6, 2026
SUMMARY
A critical double-free vulnerability in Apache HTTP Server's HTTP/2 module is vulnerable to unauthenticated Remote Code Execution (RCE) and Denial of Service (DoS) attacks. [1]
IMPACT
Attackers can potentially execute arbitrary code remotely by exploiting this vulnerability or conduct Denial of Service attacks by continually crashing Apache worker processes. .
March 18, 2026
This is a notice from the Information Security Office to alert you to multiple vulnerabilities announced by Atlassian in their entire product suite of self-hosted products, including Jira and Confluence. Atlassian-hosted products are not affected by these vulnerabilities. Please share this alert internally with IT admins and service owners who run the product so they are aware and know what actions to take to address these vulnerabilities.
January 30, 2026
To the UCB-Security community,
This is a notice from the Information Security Office to alert you to a critical vulnerability that impacts WordPress servers using the Modular DS plugin. Please share this alert internally with IT admins and service owners who run the product so they are aware and know what actions to take to address this vulnerability.
To the UCB-Security community,
This is a notice from the Information Security Office to alert you to a high severity vulnerability that impacts MongoDB Server [1]. Please share this alert internally with IT admins and service owners who run the product so they are aware and know what actions to take to address this vulnerability.
December 5, 2025
ISO is aware of a critical, actively exploited vulnerability affecting the React and Next.js ecosystems. Please share this alert internally with IT admins and service owners who run web applications utilizing Next.js or React Server Components (RSC) so they are aware and know what actions to take to address this vulnerability immediately.
April 24, 2025
This is a notice from the Information Security Office to alert you of a medium-severity vulnerability that affects the Trellix HX management console for our EDR agent. This vulnerability can only be exploited by manipulating a previously compromised endpoint agent to send a malformed event to the console. The patch was applied to the console, and no change is needed on the endpoints.
May 7, 2024
This is a notice from the Information Security Office to alert you to a vulnerability that impacts the R programming language. Please share this alert internally with IT admins, service owners, and researchers who run the product so they are aware and know what actions to take to address this vulnerability.
April 29, 2024
Shim is a bootloader that facilitates the Secure Boot process on computers using Unified Extensible Firmware Interface. The bug involves trusting the remote server’s HTTP headers while booting over HTTP, which might allow an out-of-bounds write, and privileged code execution.
xz utils is a popular data compression library found in many Linux distributions. The critical vulnerability found in recent versions of the xz library, liblzma, includes a malicious code injection designed to allow unauthorized remote access. Click for more details.
January 9, 2023
LastPass has updated the information on the Security Incident they disclosed in August. They have discovered that the attackers were able to leverage the information they got in August to gain access to some customer data including some encrypted vault backups. ISO has provided guidance to campus users of LastPass. Click for further details.
March 31, 2022
A critical vulnerability has been found in the widely used Java framework Spring Core. While Remote Code Execution (RCE) is possible and a Proof-of-Concept has already been released, how to exploit the vulnerability can vary based on system configuration and research on it is still evolving.
December 10, 2021
A critical vulnerability has been found in the widely used Java logging library log4j. This vulnerability can allow remote code execution by an unauthenticated attacker, is easy to exploit, and proof of concept code is publicly available.
September 14, 2021
Apple released a security update for macOS, watchOS, iOS, iPadOS, and Safari. Apple is aware of a report of potential exploits in the wild.
July 27, 2021
A software update was released fixing a local privilege escalation
vulnerability affecting MacOS, iPadOS, and iOS. A proof of concept
exploit has been publicly released and Apple reports this vulnerability
is currently being exploited.
April 5, 2021
Updated May 11, 2021:
UCOP Notice to UC Community: https://ucnet.universityofcalifornia.edu/data-security/index.html
Updated Apr. 15, 2021:
March 31, 2021
Mar. 31st - The Internal Revenue Service issued a warning of an ongoing IRS-impersonation scam that appears to primarily target educational institutions, including students and staff who have ".edu" email addresses. The phishing emails appear to target university and college students from both public and private, profit and non-profit institutions.
The fraudulent email displays the IRS logo and uses various subject lines such as "Tax Refund Payment" or "Recalculation of your tax refund payment." It asks people to click a link and submit a form to claim their refund.
February 11, 2021
This month Microsoft released patches for multiple serious vulnerabilities in the Windows TCP/IP network stack (including CVE-2021-24074, CVE-2021-24094)[1,2]. These vulnerabilities can allow for remote code execution. Additionally, Microsoft appears to have released patches for Windows 7 and Windows Server 2008 which are officially no longer supported.
January 26, 2021
A serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user. The flaw can be leveraged to elevate privileges to root, even if the user is not listed in the sudoers file. User authentication is not required to exploit the flaw. Researchers have developed working exploits against Ubuntu, Debian, and Fedora Linux distributions. Other UNIX-based operating systems and distributions are also likely to be exploitable. [1] [2]
- 1 of 2 Security Alerts (Current page)
- 2 of 2 Security Alerts
- next › Security Alerts
- last » Security Alerts