InfoSecBulletin Cybersecurity for mankind
ServiceNow issued security updates for three new serious AI Platform problems that can be used in code injection, SQL injection, and privilege escalation attacks.
The ServiceNow AI Platform, which was once called the Now Platform, is a strong Platform-as-a-Service (PaaS). It helps add AI to important business tasks and supports over 100,000 business AI apps at 85% of all Fortune 500 companies.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
In a Thursday update, the company said it fixed its cloud platform for three major security issues (CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820) and told customers to protect their self-hosted systems.
The first flaw lets attackers run unwanted code. The second comes from a flaw that lets them gain higher access. The third lets bad actors reach or change data using SQL injection attacks.
All three security problems can be used by unauthorized attackers in simple attacks that don’t need user action.
On Thursday, ServiceNow shared about a security flaw (CVE-2026-6876) in its platform. This issue could allow attackers with basic access to run code on targeted systems.
“We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so,” the company said.
ServiceNow did not say that any of the flaws fixed on Thursday were being used in attacks, but many security issues in ServiceNow products have been attacked in the past few years.
Two years ago, bad actors used three ServiceNow problems (CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217) with open-source exploits to steal data from private companies and government groups around the world.
More recently, in July, the threat intelligence company Defused said that hackers are now using another serious flaw (CVE-2026-6875). This flaw lets them escape the sandbox in the ServiceNow AI Platform before logging in.
ServiceNow shared in private that there was a security issue last month. This issue happened when security researchers or customers used a weakness in an API to get data from customer accounts without permission.
