Category: Tech

A maximum-severity GitLab flaw has moved from patch notes to real-world attacks. CVE-2026-97229 (CVSS 10.0), an integer overflow in how GitLab compiles regular expressions in CI/CD configurations, was used against Alpine Linux’s GitLab instance on October 20 and 21, 2026, just over a week after GitLab’s October 12 fix. CISA added the bug to its […]

Palo Alto Networks confirmed on October 29, 2026 that attackers are actively exploiting the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), against PAN-OS management interfaces exposed to the internet. The update lands days after Israeli security firm Dream reported a suspected China-nexus operation that chained a custom PHP2Shell exploit with the Linux kernel bug Fragnesia […]

Tailscale has shipped version 1.104.4 to fix a set of Tailscale SSH and Serve vulnerabilities that could let an attacker who already controls one trusted device reach root-only Unix sockets, such as the Docker socket or the tailscaled local API, on other machines in the tailnet. Released on October 28, 2026, the update covers four […]

A VMware ESXi bug rated just 2.7 on the CVSS scale turns out to have been a zero-day weapon for one of China’s most capable espionage crews. CISA added CVE-2026-41709, an insufficient-logging flaw that lets an attacker with admin access perform certain operations without being logged, to its Known Exploited Vulnerabilities (KEV) catalog on October […]

Cisco has patched a high-severity zero-day in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software that attackers are already using to knock firewalls offline. Tracked as CVE-2026-76418 (CVSS 8.6, Cisco bug CSCwx26625), the flaw lives in the Remote Access SSL VPN service and lets an unauthenticated, remote attacker force the device to […]

HPE has released one of the biggest wireless security updates in recent memory, patching 72 vulnerabilities in ArubaOS (AOS-8 and AOS-10), the operating system behind Aruba Mobility Conductors, Mobility Controllers, Central-managed Gateways and access points. Eight of the flaws carry the maximum CVSS score of 10.0 and allow unauthenticated remote code execution, authentication bypass, command […]

Veeam has published a fresh batch of security bulletins covering Backup & Replication 13, Veeam Backup for Microsoft 365, Veeam Agent for Linux and Veeam ONE, and two of the fixes are rated critical. The headliner, CVE-2026-108142 (CVSS v4.0 9.1), lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service of Windows-based Backup & […]

Microsoft is bringing AI-powered, context-aware phishing detection to Microsoft Teams, and it is aimed squarely at the attacks that sail past traditional filters: social engineering chats that carry no malicious link, no file and no payload, just a convincing story. Announced in Microsoft 365 Message Center post MC1519866 on October 21, 2026, the feature analyzes […]

Fortinet has shipped a coordinated wave of security hardening releases for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, fixing critical and high-severity vulnerabilities that were uncovered with the help of frontier AI models, and it is doing something unusual: the fixes went out on October 22, 2026, but the CVE IDs, CVSS scores and technical advisories […]

Network teams running their own SD-WAN management plane have another urgent patch on the list. On October 22, 2026, Arista Networks disclosed CVE-2026-114625, an actively exploited SQL injection flaw in on-premises VeloCloud Orchestrator (VCO), the web portal used to configure and manage VeloCloud SD-WAN edges and gateways. The bug scores 9.9 on CVSS v3.1 and […]