Vulnerabilities
GitLab Patches a Critical Hole That Reaches Back to 2014
A second emergency fix in nine days covers every self-managed install since version 7.0, and the first round missed older branches.
PHP2Shell patches land for two bugs that hand attackers the web server
The language itself, not the apps on top of it, carries the flaws. Four releases now ship fixes.
Ransomware crews are still breaking into Palo Alto firewalls through a patched VPN flaw
Palo Alto Networks says Qilin, Inc and Settra operators keep probing CVE-2026-0257 months after the May patch, with CISA holding federal agencies to a June 1 fix deadline.
Hard-coded key in Moxa's AIG-302 gateway hands attackers the keys to industrial comms
Two flaws in Moxa's ThingsPro Edge firmware let someone on the local network read secrets and impersonate the device. A patch is out.
Hitachi Energy patches seven flaws in RTU500 grid controllers used worldwide
A new advisory from the Swiss vendor lists denial-of-service and authentication-bypass bugs in firmware that runs on remote telemetry units inside electricity networks. Fixes land in CMU Firmware 13.9.1.
Go's Emergency Patch Quietly Blocks Eight CA Keys and Won't Say Whose
Go 1.27.3 and 1.26.10 reject any TLS certificate chain running through eight intermediate keys tied to one unnamed authority. The silence around which authority is the story.
Siemens patches Software Center flaw after ClickFix crews abuse it
A local-privilege bug in Siemens' update tool, CVE-2026-110936, is being pulled into fake-fix social engineering attacks. What engineers and IT teams need to do.
Attackers Are Exploiting a Critical Flaw in SiteGuard's Web Firewall. Here's What to Know.
A command injection bug in a widely used Japanese web application firewall is under active attack, and the vendor warns that patching may wipe out the evidence.
Supermarket fridge controllers carry remote-takeover bugs, CISA warns
Advisories flag flaws in Danfoss and Copeland refrigeration systems that let a remote attacker skip the login screen and run their own code.
Three Critical Flaws in NGINX Could Let Attackers Crash or Hijack Web Servers
F5 patched eleven vulnerabilities in NGINX on October 14, three of them rated 9.2 out of 10 for severity. Under the right conditions, any of the three could hand an outsider full control of the machine.
Two Actively Exploited Flaws Added to CISA's Watch List, Including a Windows Zero-Day
A security-feature bypass in Windows Shell and an Ivanti authentication bypass are both being used in real attacks, and US federal agencies have until 16 October 2026 to fix them.
BeyondTrust Remote Support Has a Critical Bug and Attackers Are Already Inside. Federal Agencies Have Three Days.
A critical flaw in BeyondTrust's remote help software is being actively exploited. US agencies must patch by October 19.
Hackers used a Fortinet firewall flaw to steal secrets on 500-plus networks
A path traversal bug in FortiOS, now tracked as CVE-2025-61624, let attackers plant memory-only malware and ride stolen VPN sessions into a telecom's clients.
Docker Hub bug let strangers hijack access tokens and push tainted images
A critical flaw tracked as CVE-2026-105445 quietly reassigned personal access tokens during account conversions for two years before Docker patched it.
PwnEscape: a Linux kernel bug that lets one tenant peek at another
A critical flaw in the Linux networking stack, demonstrated against live Vercel sandboxes, breaks the wall between a guest machine and the host it shares with strangers.