55 issues

All briefings

November 2026

2 Nov 2026 — Max-severity OT bug under active exploitation, plus two exploited Ivanti flaws added to CISA's KEV Monday brought an actively exploited flaw in a widely used industrial programming tool, a federal remediation order for Ivanti Connect Secure, a run of high-severity Chrome fixes, and a million-device Android TV botnet takedown.

1 Nov 2026 — Patch Chrome now — Google lists six critical flaws; FBI pins $6.3bn Binance heist on North Korea Google's advisory lists six critical Chrome vulnerabilities scored up to 9.6, while the day's other reports cover a credential-rotation breach at Northflank, an attempted GitLab RCE at Alpine Linux and the FBI's attribution of the record Binance theft.

October 2026

31 Oct 2026 — Ivanti Connect Secure flaws under active exploitation added to CISA KEV; Google ships six high-severity Chrome fixes CISA added two actively exploited Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog while Google pushed stable-channel Chrome updates closing six flaws rated up to 9.6.

30 Oct 2026 — CISA flags two actively exploited Ivanti Connect Secure flaws; Anthropic researchers build remote-root Linux MPTCP exploit A single day brought confirmed active exploitation of Ivanti Connect Secure, a remote unauthenticated root exploit for the Linux kernel, and six critical Chrome fixes.

29 Oct 2026 — CISA flags active exploitation of Ivanti Connect Secure and GitLab as China-nexus crews root firewalls and servers CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on 29 October while researchers reported live exploitation of PHP, VMware ESX and Cisco flaws, and Google shipped a Chrome release closing six critical bugs.

28 Oct 2026 — CISA flags two actively exploited flaws in VMware ESX and the Linux kernel CISA added two vulnerabilities with evidence of active exploitation to its KEV Catalog on 28 October, alongside a China-nexus espionage disclosure, fresh Oracle bugs and six high-severity Chrome fixes.

27 Oct 2026 — CISA flags two actively exploited flaws — Adobe Commerce/Magento and Google Brotli — as the Brotli bug spreads well beyond Node.js CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on 27 October on evidence of active exploitation, one of them a compression-library flaw embedded across a broad range of software.

26 Oct 2026 — CISA flags two actively exploited PHP flaws as Brotli patches cascade across vendors CISA added two exploited PHP vulnerabilities to its KEV catalog on 26 October, while PHP, Microsoft and Node.js maintainers issued emergency fixes for a Brotli compression bug that BleepingComputer dubs "HTTP2Shell."

25 Oct 2026 — PHP2Shell flaws under active exploitation — one hit a European government within two hours Two PHP vulnerabilities disclosed last week are being exploited in the wild, with attackers using agentic AI to carry out post-exploitation work.

24 Oct 2026 — CISA adds Collabora Online and Arista VeloCloud flaws to KEV, citing active exploitation The day's most urgent item is two critical vulnerabilities under active attack; alongside it came a Secure Boot-bypassing UEFI bootkit, a Brotli decoder bug reaching far beyond Node.js, and fresh browser and interpreter patches.

23 Oct 2026 — CISA flags actively exploited Arista VeloCloud SQL injection as PHP warns of an unpatched 9.8 RCE One confirmed in-the-wild flaw hit CISA's catalogue, PHP issued mitigation for an unpatched remote code execution bug, Google Chrome and Ruby shipped fixes, and researchers tallied tens of thousands of stolen edge-device credentials.

22 Oct 2026 — Arista VeloCloud Orchestrator zero-day under active attack; PHP ships emergency RCE patches Thursday 22 October 2026 brought an exploited SD-WAN management flaw, unauthenticated PHP remote code execution, a second LiteLLM supply-chain compromise and a certificate authority quitting after its private keys were guessed.

21 Oct 2026 — CISA urges immediate PHP patching as "php2shell" flaws affect all web-serving installations A pair of unauthenticated remote code execution flaws in PHP topped a day that also brought a GitLab fix reaching back to 2014 and active exploitation of Plex Media Server.

20 Oct 2026 — Eight eMudhra CA keys compromised, forcing emergency distrust across browsers — Palo Alto PAN-OS under active ransomware attack Mozilla and Google confirmed the private keys of eight eMudhra intermediate certificate authority certificates are compromised, while The Register reported multiple ransomware groups have been exploiting Palo Alto's firewall OS since June.

19 Oct 2026 — Three actively exploited flaws hit CISA's KEV list — Palo Alto, Microsoft and Ivanti all need patching CISA's Known Exploited Vulnerabilities catalog now lists three bugs under active exploitation, while supply-chain compromises at ConnectWise, Rank Math and AOMEI pushed malware and intruders into downstream networks.

18 Oct 2026 — ConnectWise disables seven of its own app identities after attackers use them to break into Microsoft 365 tenants Two actively-exploited problems led the weekend's reporting — a ConnectWise identity compromise reaching into customer Microsoft 365 tenants, and an OS command injection flaw in SiteGuard letting attackers run commands as root or SYSTEM.

17 Oct 2026 — ConnectWise Cloud Backup credential abused to sign in to 173 Microsoft 365 tenants; three flaws CISA lists as exploited The day's reporting centred on a live supply-chain campaign through ConnectWise Cloud Backup into Microsoft 365, while CISA's catalogue lists actively exploited flaws in Palo Alto Networks, Microsoft and Ivanti gear.

16 Oct 2026 — CISA adds actively-exploited BeyondTrust Remote Support auth bypass to its KEV catalog A critical authentication bypass in BeyondTrust Remote Support is being exploited for initial access, CISA warned on 16 October, alongside active exploitation flagged in PAN-OS, Windows Server and Ivanti Connect Secure.

15 Oct 2026 — Three actively-exploited flaws lead Thursday's fixes — Ivanti, Microsoft and Palo Alto CISA's catalog lists an Ivanti Connect Secure, a Windows Server and a PAN-OS vulnerability as under active exploitation, while BleepingComputer tracked live attacks on Nextcloud servers, D-Link and Ubiquiti devices, and the Arch Linux repository.

14 Oct 2026 — Palo Alto Networks patches an exploited PAN-OS zero-day as CISA flags four actively attacked flaws Firewalls, email gateways and Nextcloud servers are all under active attack, with a PAN-OS code-injection zero-day leading CISA's 14 October batch of exploited vulnerabilities.

13 Oct 2026 — Actively exploited Ivanti Connect Secure zero-day headlines a record 1,411-flaw Patch Tuesday CISA added an unauthenticated Ivanti Connect Secure remote-code-execution flaw to its Known Exploited Vulnerabilities catalog the same day Microsoft shipped its largest-ever Patch Tuesday.

12 Oct 2026 — GitLab urges an immediate patch for a max-severity RCE flaw as Google fixes six critical Chrome vulnerabilities — patch both today Two patch-now advisories landed together — a maximum-severity remote code execution flaw in GitLab and six critical Chrome vulnerabilities — alongside an actively exploited WordPress plugin and a run of disruptive attacks on European retail.

11 Oct 2026 — Six critical Chrome flaws get a fix as a cyberattack spoils food in hundreds of French supermarkets Google's advisory lists six CVSS 9.6 Chrome vulnerabilities fixed in 155.0.8059.39, while The Record reports an overnight attack disrupted refrigeration at French grocery chains.

10 Oct 2026 — Citrix NetScaler flaw under active attack leads a day dominated by Chrome fixes, arrests and AI-agent abuse A CISA-listed, actively exploited Citrix NetScaler ADC vulnerability tops a day that also brought five Chrome flaws rated 9.6 and a run of law-enforcement and AI-security news.

9 Oct 2026 — Citrix NetScaler flaw is being exploited now — CISA lists it, Google ships five critical Chrome fixes the same day An actively exploited Citrix NetScaler ADC denial-of-service flaw leads Friday's reporting, alongside a Chrome release closing five 9.6-rated bugs and unpatched AhsayCBS flaws already being exploited.

8 Oct 2026 — Citrix NetScaler flaw on CISA's exploited list tops a day dominated by a seven-government China advisory CISA added an actively exploited Citrix vulnerability to its Known Exploited Vulnerabilities catalog as the US and six partners detailed a Chinese state hacking campaign, and Google and Cisco shipped critical fixes.

7 Oct 2026 — FBI, CISA and researchers flag three edge-device flaws under active attack as Citrix NetScaler bug lands on KEV Active exploitation hit Citrix, Atlassian and Fortinet gateways, fresh critical patches landed for SonicWall and Chrome, and attackers obtained unauthorized certificates for Google domains by hijacking national domain registries.

6 Oct 2026 — Citrix NetScaler flaw is being exploited now; Chrome ships five critical fixes CISA added an actively-exploited Citrix NetScaler ADC bug to its Known Exploited Vulnerabilities catalog, Google patched five critical Chrome flaws, and researchers exploited 32 zero-days on day one of Pwn2Own Ireland.

5 Oct 2026 — CISA lists an actively exploited Citrix NetScaler flaw that crashes appliances — patch now CVE-2026-88779 is on CISA's Known Exploited Vulnerabilities catalog and is being used to knock NetScaler devices offline, while a second, separate NetScaler issue drew US and Australian warnings the same week.

4 Oct 2026 — Citrix patches an actively exploited NetScaler zero-day; CISA orders federal remediation A NetScaler denial-of-service flaw is being exploited in the wild, Citrix has shipped emergency updates, and CISA added it to its Known Exploited Vulnerabilities catalog on 4 October.

Page 1 of 2 Older →