Blog
Cybersecurity
Breaches, vulnerabilities and the state of security.
Cybersecurity posts, page 1 of 3
- 5 min read
PHP RCE Flaws CVE-2026-109618 and 109619 Hit CISA KEV: Patch Now
Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12; CISA added both critical flaws to its exploited list on 26 October 2026.
- 4 min read
Brotli flaw CVE-2026-111497: fixed versions for Node.js, .NET, Python
CVE-2026-111497 is a critical Brotli bug patched in Node.js, .NET and Python; update to Node 22.23.4, 24.22.1 or 26.12.1 and .NET 8.0.33, 9.0.22 or 10.0.14.
- 4 min read
Nextcloud Collabora Flaw CVE-2026-110447 Exploited: Update to 26.4.303
Nextcloud's built-in Collabora server has been exploited since September; update richdocumentscode to 26.4.303 and delete any shx*.php web shells.
- 5 min read
Rank Math PRO 3.0.123 Was Trojanized: Check Your Site, Then Restore
Rank Math PRO 3.0.123, downloaded 15-16 Oct 2026, carried malware (CVE-2026-111862); updating to 3.0.124 does not clean an infected site.
- 4 min read
AhsayCBS Backup Flaws Exploited: First Patch Failed, Use 10.3.4.45
Two exploited AhsayCBS flaws (CVE-2026-105133, CVE-2026-105134) survive builds 10.3.4.0 and 9.15.2.59; fixed in 10.3.4.45 and 9.15.2.70.
- 4 min read
Bricksforge Flaw CVE-2026-85097 Is Exploited: Update to 3.1.8.10
Bricksforge 3.1.8.9 and older let anyone upload PHP; attacks began 7 October. Update to 3.1.8.10 and check uploads for planted files.
- 4 min read
SharePoint Bug Patched in August Is Now Exploited in Attacks
CVE-2026-65660 lets a low-privilege user run code on SharePoint Server; attacks began 24 September and CISA set a 28 September patch deadline.
- 4 min read
WSO2 and Adobe Commerce Flaws Are Under Attack, US Deadline Passed
CISA's order to patch two actively exploited bugs in WSO2 gateways and Adobe Commerce expired September 27, and both remain under attack.
- 4 min read
Citrix Patches Two NetScaler Zero-Days Already Under Attack
Citrix fixed two critical NetScaler flaws on September 27 that attackers were already exploiting before any patch existed.
- 4 min read
Kiteworks Asks Its Whole Customer Base to Power Down for Nine Hours
Kiteworks told customers to shut down their file-transfer systems for nine hours after a still-unnamed threat was flagged by federal investigators.
- 4 min read
Gyazo Breach Exposes 23.6 Million Accounts and 490 Million Images
A hacked upload server let an attacker pull 23.6 million Gyazo account records and metadata for 490 million images.
- 4 min read
MikroTik Routers Are Being Hijacked With Zero Credentials
A flaw chain called MikroTrick lets attackers take full control of internet-exposed MikroTik routers without a password, key, or finished login.
- 4 min read
ShinyHunters Claims FBI Breach, Reuters Verifies Some Leaked Data
The extortion group claims it stole FBI personnel data via Oracle PeopleSoft, and Reuters partially verified samples of the leak.
- 4 min read
Cisco Talos Finds Malware That Lets AI Models Vote on Its Next Move
CLOSEDQUORUM is a Windows implant that asks four commercial AI models to vote on its next action instead of waiting on a human operator.
- 4 min read
Acronis Backup Bug Under Attack Gave Federal Agencies Three Days
CVE-2026-87886 lets attackers escalate to root on cPanel, WHM, and Plesk servers, and CISA confirms it is already being exploited.
- 4 min read
Cisco Patches a Maximum-Severity Zero-Day in Its Identity Services Engine
A maximum-severity flaw lets attackers skip login entirely on Cisco's Identity Services Engine, and CISA says federal agencies must patch by September 19.
- 4 min read
Cisco's Secure Email Gateway Has a Root RCE Under Active Attack
A crafted email is enough to get root on Cisco's Secure Email Gateway, and CISA gives US agencies until September 17 to patch.
- 4 min read
CISA's Latest KEV Additions Give Federal Agencies Days to Patch
A CISA advisory added five actively exploited flaws in ConnectWise, MikroTik and JFrog software, with patch deadlines this week.
- 5 min read
FulcrumSec Breached Four Firms by Hunting Hardcoded API Keys
Extortion gang FulcrumSec has hit an airport operator, a drugmaker, an engineering firm and a school group by finding API keys left in public code.
- 4 min read
GitLab's Perfect-10 Bug Was Being Scanned For Within a Day of the Patch
A maximum-severity flaw, CVE-2026-85706, let anyone pull secrets off exposed GitLab servers, and scanning began about a day after the fix shipped.
- 4 min read
Microsoft Patches Two Active Zero-Days and 20 Wormable Bugs in September
Microsoft's September 2026 update fixes two Windows flaws already under attack and a critical, unauthenticated VPN bug rated 9.8 out of 10.
- 4 min read
Citrix NetScaler Auth Bypass Under Attack, Feds Must Patch by Sept 12
CVE-2026-19490 lets attackers skip login on NetScaler gateways, and CISA gave federal agencies until September 12 to fix it.
- 4 min read
SAP Patches Maximum-Severity OVERPASS Flaw in Its September Update
SAP's September patch day fixes a maximum 10.0 severity flaw called OVERPASS that unauthenticated attackers can reach before any login check applies.
- 4 min read
Magento 'StyleSmuggler' Zero-Day Hit Stores With No Login Needed
A zero-day called StyleSmuggler let attackers plant backdoors on any Magento or Adobe Commerce store, patched or not, until Adobe's Sept 7 hotfix.