Wednesday , June 24 2026
MongoDB

New MongoDB Vuln Allow Hackers Crash Any MongoDB Server

A new vulnerability, CVE-2026-25611 (CVSS 7.5), has been found in MongoDB, enabling attackers to crash open servers with little bandwidth.

According to Cato CTRL, it affects all MongoDB versions where compression is enabled (v3.4+, on by default since v3.6), including MongoDB Atlas. Shodan data shows that over 207,000 MongoDB instances are publicly accessible and at risk.

LastPass says hackers stole customer data via Klue, supply chain breach

LastPass has reported a security issue with its vendor, Klue. This incident allowed an attacker unauthorized access to customer data....
Read More
LastPass says hackers stole customer data via Klue, supply chain breach

New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide

Researchers at cybersecurity firm Paradigm Shift found a new flaw called usbliter8. This flaw can get around main boot protections...
Read More
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide

India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record

A cyber attack seems to have affected one of India's top electronics companies. Tata Electronics has said there was a...
Read More
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record

Anthropic’s Mythos reportedly broke NSA classified systems in hours

The recent finding shows how powerful Mythos is: the AI can access the US government's secret networks in just a...
Read More
Anthropic’s Mythos reportedly broke NSA classified systems in hours

OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment

Test before going live is important for AI developers. But there's a problem: testing usually uses fake scenarios that often...
Read More
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment

AryStinger botnet infected thousands of D-Link routers globally

AryStinger has taken control of over 4,000 old D-Link routers to use them as proxies for harmful traffic. The team...
Read More
AryStinger botnet infected thousands of D-Link routers globally

Hacker suspected of sending alerts across Brazil

Brazil's government suspects a hacking attack triggered an unauthorized ‌alert sent to cell phones across parts of the country early...
Read More
Hacker suspected of sending alerts across Brazil

CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT

A new open-source cybersecurity tool named CyberSentinel AI v3.0 has come out. It is an important step in self-operated security...
Read More
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT

Barracuda hosts Dhaka roundtable on cyber resilience

Barracuda gathered industry people in Dhaka on 18 June 2026 for a roundtable talk about cyber resilience. The company shared...
Read More
Barracuda hosts Dhaka roundtable on cyber resilience

CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) asked Fortinet users with FortiGate devices on Thursday to act to protect...
Read More
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices

Attack Mechanism

The vulnerability exists in MongoDB’s wire protocol compression mechanism, known as OP_COMPRESSED. Cato CTRL states that when a server gets a compressed message, it allocates memory using the uncompressedSize provided by the attacker before checking the real decompressed size.

An attacker can send a small 47KB zlib-compressed packet while pretending it is 48MB uncompressed.  SentinelOne reports that the server allocates 48MB for each connection, leading to a high memory amplification ratio of 1,027:1.

vulnerable code (Source: catonetworks )

By opening multiple concurrent connections, the attacker quickly exhausts the server’s RAM, triggering an Out-of-Memory (OOM) kernel kill with exit code 137. Network defenders should watch for many TCP connections to port 27017 from one source, especially if connections are quickly made but idle.

Administrators must quickly update to patched MongoDB versions: 8.2.4, 8.0.18, or 7.0.29 to address this threat.

Check Also

June

Microsoft June Patches 200 Vulnerabilities including 3 zero days

Microsoft’s June 2026 Patch Tuesday updates fix about 200 security flaws found in the company’s …