Vulnerability Management

Cybersecurity 4 min SAP Rates a Python SDK Flaw 10 Out of 10. Whether It Hits You Depends on One Field CVE-2026-89111 lets an attacker steal OAuth2 client credentials from multi-tenant BTP apps that let outsiders... KE Kenji Tanaka 15 Oct Cybersecurity 5 min A Docker Hub Flaw Let Anyone Mint a Token for Someone Else's Account for Two Years Docker fixed CVE-2026-105445 within four hours and found no sign of abuse in 304,000 pushes, but says an unuse... KE Kenji Tanaka 15 Oct Cybersecurity 5 min Attackers Chained Three Ivanti VPN Flaws to Get Root, and One Is Still Unpatched Volexity traced break-ins on fully patched Connect Secure gateways back to 3 October. The attackers patched co... KE Kenji Tanaka 14 Oct Cybersecurity 4 min Microsoft Patched a Record 1,411 Flaws in October and Suggested a New Way to Sort Them One Windows Shell bug was already being exploited. On the same day, Microsoft proposed grouping vulnerabilitie... KE Kenji Tanaka 14 Oct Cybersecurity 4 min Attackers Are Exploiting AhsayCBS Backup Servers, and the Latest Version Is Not Safe Huntress saw attackers chain two AhsayCBS flaws to plant webshells and a cryptominer. Version 10.3.4, named as... PR Priya Nair 12 Oct Cybersecurity 3 min Attackers Probed a Maximum-Severity SonicWall Flaw Three Days After the Fix CVE-2026-102255 lets anyone with network access make SMA1000 gateways reach their own internal services. There... KE Kenji Tanaka 12 Oct Cybersecurity 5 min A Third Citrix NetScaler Flaw Hit Appliances That Had Installed Last Week's Emergency Fix CVE-2026-88779 affects boxes that use SAML sign-in. Citrix calls it a crash; a researcher found malware runnin... KE Kenji Tanaka 5 Oct AI & ML 4 min Google Stopped Paying for One Kind of Open-Source Bug Report After a Flood of Invalid Ones Since 1 October, Google's reward programme no longer pays for flaws in the code itself, blaming automated subm... MA Maya Lin 5 Oct Cybersecurity 3 min Dell Fixed Two 10.0 Storage Flaws, and Its Own Old Guide Used 'supersecret' as a Signing Key Thirteen flaws in Dell's Kubernetes storage add-on include one that hands attackers every array's admin creden... KE Kenji Tanaka 3 Oct AI & ML 5 min Microsoft Says AI Is Finding Software Flaws Faster Than Anyone Can Fix Them Its annual threat report expects a record 72,000 tracked vulnerabilities this year, exploits within a day of d... MA Maya Lin 2 Oct Cybersecurity 4 min A Wiki Add-On Was Fixed Quietly. Attacks Began a Day After the Flaw Was Made Public. CVE-2026-100382 in MediaWiki's External Data extension lets anyone run commands on a wiki's server. Bots plant... KE Kenji Tanaka 1 Oct Cybersecurity 4 min Apple Patched an Exploited Flaw in iOS 26, Which Most iPhones Still Run The CoreGraphics bug was used against targeted people on versions before iOS 27. Nearly 80% of iPhones were st... KE Kenji Tanaka 30 Sep Cybersecurity 3 min Kiteworks Told Customers to Switch Off for Nine Hours, Then Found a Critical Flaw Acting on a federal warning, the file-sharing company ordered a precautionary shutdown on 25 September. No bre... KE Kenji Tanaka 30 Sep Cybersecurity 4 min Two Citrix NetScaler Flaws Were Exploited Before the Fix, and One Hits Default Setups Fixes for eight flaws shipped on 27 September. US federal agencies have until 30 September and are told to loo... KE Kenji Tanaka 28 Sep Cyber Threat Intel 4 min The MikroTik Router Takeover Used a Different Flaw Than First Reported. The Same Updates Fix It. CERT Polska now says the chain pairs CVE-2026-67279 with CVE-2026-86060. Routers updated in early September ar... PR Priya Nair 27 Sep Cybersecurity 5 min A SharePoint Flaw Filed as Spoofing Is Now Being Used in Attacks Microsoft reclassified CVE-2026-65660 as remote code execution in August and confirmed attacks on 25 September... KE Kenji Tanaka 27 Sep Cybersecurity 6 min Attackers Probed a WordPress Core Flaw the Same Day It Was Patched A critical bug in WordPress's core software affects every release from 4.7 to 7.1.1. Code execution needs a pa... KE Kenji Tanaka 27 Sep Cybersecurity 5 min Four Exploited Appliance Flaws, and the Deadline Is Today Security appliances from Arista, F5 and Check Point are being attacked, and United States agencies must patch... KE Kenji Tanaka 25 Sep Cybersecurity 6 min CISA Ordered a Compromise Hunt Without Naming the Attack Three Linux kernel flaws joined the exploited catalogue on 18 September. No attacker, no victim and no techniq... KE Kenji Tanaka 21 Sep Cybersecurity 6 min A Crafted Email Is Enough to Get Root on Cisco's Secure Email Gateway A mail gateway reads every message a company receives. Cisco's can be taken over by one of them, and the flaw... KE Kenji Tanaka 16 Sep Cybersecurity 6 min A Plesk Backup Restore Lets a Hosting Customer Get Root on the Whole Server CVE-2026-68488 needs only a customer's own panel login and FTP access. On shared hosting, that turns one accou... KE Kenji Tanaka 15 Sep Cybersecurity 6 min A PAN-OS Flaw Gives Root on Palo Alto Hardware, and There Is No Workaround CVE-2026-0310 is reachable through a dataplane interface, not only the management plane, and Palo Alto lists n... KE Kenji Tanaka 15 Sep Cybersecurity 6 min Microsoft Has Patched 2,760 Flaws This Year. The Old Record Was 1,139. Microsoft shipped 974 fixes in September, a monthly record. The year is the number that matters: 2,760 so far... KE Kenji Tanaka 14 Sep Cybersecurity 6 min The Dutch Warned About Check Point's VPN Flaws Before Anyone Exploited Them Two pre-authentication flaws in Check Point VPN were patched on 9 September. Three days later the Dutch NCSC s... KE Kenji Tanaka 14 Sep