MH Systems Unlimited

WordPress shipped version 7.1.4 on October 28, 2026, a short-cycle security release that Wordfence says fixes 22 security vulnerabilities, and attackers wasted no time going after the worst of them. CVE-2026-119977 (CVSS 8.1 per Wordfence) is an unauthenticated remote code execution race condition in the core upgrade process that affects every release from 4.7 through […]

If you patched your Ivanti Connect Secure VPN appliances in mid-October and moved on, you need to go back. On October 29, 2026, Ivanti updated its advisory with two more vulnerabilities, CVE-2026-111357 and CVE-2026-118527, that complete the zero-day chain attackers used to get unauthenticated root on fully patched gateways, and on October 30 CISA added […]

A maximum-severity GitLab flaw has moved from patch notes to real-world attacks. CVE-2026-97229 (CVSS 10.0), an integer overflow in how GitLab compiles regular expressions in CI/CD configurations, was used against Alpine Linux’s GitLab instance on October 20 and 21, 2026, just over a week after GitLab’s October 12 fix. CISA added the bug to its […]

Palo Alto Networks confirmed on October 29, 2026 that attackers are actively exploiting the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), against PAN-OS management interfaces exposed to the internet. The update lands days after Israeli security firm Dream reported a suspected China-nexus operation that chained a custom PHP2Shell exploit with the Linux kernel bug Fragnesia […]

Tailscale has shipped version 1.104.4 to fix a set of Tailscale SSH and Serve vulnerabilities that could let an attacker who already controls one trusted device reach root-only Unix sockets, such as the Docker socket or the tailscaled local API, on other machines in the tailnet. Released on October 28, 2026, the update covers four […]

A VMware ESXi bug rated just 2.7 on the CVSS scale turns out to have been a zero-day weapon for one of China’s most capable espionage crews. CISA added CVE-2026-41709, an insufficient-logging flaw that lets an attacker with admin access perform certain operations without being logged, to its Known Exploited Vulnerabilities (KEV) catalog on October […]

Cisco has patched a high-severity zero-day in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software that attackers are already using to knock firewalls offline. Tracked as CVE-2026-76418 (CVSS 8.6, Cisco bug CSCwx26625), the flaw lives in the Remote Access SSL VPN service and lets an unauthenticated, remote attacker force the device to […]

HPE has released one of the biggest wireless security updates in recent memory, patching 72 vulnerabilities in ArubaOS (AOS-8 and AOS-10), the operating system behind Aruba Mobility Conductors, Mobility Controllers, Central-managed Gateways and access points. Eight of the flaws carry the maximum CVSS score of 10.0 and allow unauthenticated remote code execution, authentication bypass, command […]

Veeam has published a fresh batch of security bulletins covering Backup & Replication 13, Veeam Backup for Microsoft 365, Veeam Agent for Linux and Veeam ONE, and two of the fixes are rated critical. The headliner, CVE-2026-108142 (CVSS v4.0 9.1), lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service of Windows-based Backup & […]

Microsoft is bringing AI-powered, context-aware phishing detection to Microsoft Teams, and it is aimed squarely at the attacks that sail past traditional filters: social engineering chats that carry no malicious link, no file and no payload, just a convincing story. Announced in Microsoft 365 Message Center post MC1519866 on October 21, 2026, the feature analyzes […]