Vulnerabilities & patches · News & analysis
Node2Shell Makes the Running Runtime the Critical Patch Check
Node.js fixes and an independent exploitation test put the focus on deployed containers and the paths that decode untrusted compressed data.
NEWS · ALERTS · RESEARCH
Vulnerabilities & patches
Original cybersecurity reporting and practical analysis, alongside headlines from trusted publications, agencies and researchers.
Original reporting & analysis
Vulnerabilities & patches · News & analysis
Firefox Certificate Update Tests How Managed Browsers Receive Emergency Protections
Mozilla’s October 20 release brings a certificate blocklist into the browser package for systems that cannot receive the normal remote update.
Vulnerabilities & patches · News & analysis
FreeRTOS DNS Fix Requires a Configuration Change After the Upgrade
An AWS advisory makes firmware settings part of the remediation: installing the fixed network library alone does not close the DNS issue.
Vulnerabilities & patches · News & analysis
Exploited Windows Shell Flaw Gives October Patching a Clear First Priority
Microsoft confirms exploitation of CVE-2026-96951; businesses should establish which affected systems actually received the applicable fixes.
Vulnerabilities & patches · News & analysis
WP Post Author Fixes Put Website Patch Verification Under the Spotlight
Two newly disclosed SQL injection flaws show why website maintenance needs a verified fixed version, not simply a recent update.
Vulnerabilities & patches · News & analysis
Atlassian File-Access Flaw Puts Self-Hosted Collaboration Systems on the Patch List
A critical advisory spans eight Atlassian products, making a complete installation inventory the first response task.
Vulnerabilities & patches · News & analysis
FortiMail Zero-Day Forces a Decision Before Patches Arrive
Fortinet reports active exploitation of an email-security flaw and directs customers to workarounds while fixed releases remain forthcoming.
Vulnerabilities & patches · News & analysis
Exploited Cisco SD-WAN Flaw Puts Network Management on the Emergency List
Cisco’s authentication-bypass warning calls for a release check, restricted management access and a separate investigation into earlier activity.
Vulnerabilities & patches · News & analysis
Citrix NetScaler Exploitation Raises an Urgent Patching—and Evidence—Decision
CISA warns of active exploitation as administrators weigh emergency updates, service continuity and the need to preserve signs of compromise.
Vulnerabilities & patches · News & analysis
CISA Adds SharePoint and MikroTik Flaws to Its Exploited-Vulnerability List
The September 25 additions give businesses a specific inventory check, with remediation decisions grounded in affected products and vendor guidance.
Headlines from our sources
640 sourced updates · Publication dates or labeled coverage weeks shown · Read full coverage at the source
SecurityWeek
Long-Hidden Flaws Patched in EPICS Research Facility Control Software ↗
Industry newsSecurityWeek
Hackers Start Probing Fresh Oracle EBS Vulnerability ↗
Industry newsSecurityWeek
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts ↗
Industry newsThe Hacker News
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits ↗
Industry newsHelp Net Security
Bellini Capital CISO on AI security governance and the limits of patching faster ↗
Industry newsThe Hacker News
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers ↗
Industry newsThe Hacker News
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws ↗
Industry newsHelp Net Security
NIST starts the countdown to retire quantum-vulnerable encryption ↗
Industry newsCIS / MS-ISAC
Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution ↗
Threat sharingCIS / MS-ISAC
A Vulnerability in Brotli Library Could Allow for Remote Code Execution ↗
Threat sharingCanadian Centre for Cyber Security
Adobe security advisory (AV26-697) – Update 1 ↗
AgencyCanadian Centre for Cyber Security
Google security advisory (AV26-1085) - Update 1 ↗
AgencyDataBreaches.net
Pentagon ignored cybersecurity flaws before data breach, Marines’ lawsuit says ↗
Industry newsHelp Net Security
Brotli bug reaches far beyond Node.js (CVE-2026-111497) ↗
Industry newsCanadian Centre for Cyber Security
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2 ↗
AgencyCanadian Centre for Cyber Security
[Control systems] Hitachi security advisory (AV26-1091) ↗
AgencyInfosecurity Magazine
OpenAI Compaction Flaw Exposed AI Reasoning to Researchers ↗
Industry newsSecurityWeek
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws ↗
Industry newsCIS / MS-ISAC
Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution ↗
Threat sharingCanadian Centre for Cyber Security
[Control systems] Johnson Controls security advisory (AV26-1090) ↗
AgencyMicrosoft Security Response Center
CVE-2026-20942 Microsoft Edge (Chromium-based) Spoofing Vulnerability ↗
ResearchMicrosoft Security Response Center
CVE-2026-88078 Microsoft Edge (Chromium-based) Spoofing Vulnerability ↗
ResearchMicrosoft Security Response Center
CVE-2026-96196 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability ↗
ResearchMicrosoft Security Response Center
CVE-2026-62765 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability ↗
ResearchThe Hacker News
GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption ↗
Industry newsThe Hacker News
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads ↗
Industry newsCanadian Centre for Cyber Security
[Control Systems] Moxa security advisory (AV26-1089) ↗
AgencyCanadian Centre for Cyber Security
PHP security advisory (AV26-1070) - Update 1 ↗
AgencyThe Record
CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch ↗
Industry newsSecurityWeek