hype
4
Substance
6
Brief · Security
BeyondTrust patches Remote Support zero-day exploited since August
BeyondTrust told customers to patch a critical Remote Support flaw that attackers have exploited as a zero-day since late August.
Sphere
Security
Breaches, zero-days and who patched what.
66 items · Page 3 of 6
hype
3
Substance
7
Brief · Security
Hackers exploit a Collabora flaw in Nextcloud to plant backdoors
Attackers are exploiting CVE-2026-110447, a critical command execution flaw in the Collabora Online CODE app for Nextcloud, to backdoor servers.
hype
3
Substance
6
Brief · Security
Targeted ads were used to deliver 0-click exploits for mercenary spyware
Ars Technica reports that targeted ads delivered 0-click exploits that installed mercenary malware. It calls this the first confirmed case of such spyware delivered through ads.
Analysis · Security
Container Registry Tokens and Digest Pinning: How to Verify Image Provenance Beyond the Tag
A tag is a label anyone with push rights can rewrite. Here is how to pin by digest, verify signatures, and audit registry tokens after the Docker Hub flaw CVE-2026-105445.
hype
5
Substance
5
Brief · Security
FTC reportedly probes OpenAI and Anthropic over security incidents
A report says the US Federal Trade Commission is examining whether security incidents at OpenAI and Anthropic harmed Americans. Fines could be set in line with late breach reporting.
Analysis · Security
Patch Tuesday Triage: How to Rank Hundreds of CVEs With KEV, EPSS and Exposure
A repeatable method for ranking Patch Tuesday CVEs by known exploitation, exploit likelihood and asset exposure, worked through October 2026's record batch.
hype
3
Substance
7
Brief · Security
Palo Alto Networks patches PAN-OS RCE zero-day exploited in attacks
Palo Alto Networks released fixes for CVE-2026-0322, a high-severity PAN-OS remote code execution flaw. BleepingComputer reports it is being exploited against firewalls.
hype
2
Substance
5
Brief · Security
FBI and DOJ disrupt North Korean IT worker laptop farms in Texas
The US Justice Department arrested two suspects, charged 14 people and seized nearly 187 laptops tied to North Korean remote IT worker schemes. The Famous Chollima group is named.
Analysis · Security
Processing Untrusted PDFs Safely: Sandboxing Ghostscript and Document Converters
Ghostscript’s CVE-2026-39919 is the trigger. The lasting question: what SAFER, permit lists, containers, resource limits and patching each stop in a PDF converter, and what they miss.
hype
3
Substance
6
Brief · Security
Cisco patches a second actively exploited Secure Email Gateway zero-day
Cisco has patched another zero-day in its Secure Email Gateway that is being exploited. It allows unauthenticated remote command execution as root.
hype
4
Substance
6
Brief · Security
Microsoft's October Patch Tuesday fixes more than 1,400 flaws
Microsoft issued fixes for more than 1,400 security vulnerabilities across Windows and other software. Krebs says the batch dwarfs September's record of nearly 1,000.
hype
5
Substance
6
Brief · Security
CISA urges immediate patch for Ivanti Connect Secure zero-day
CISA urged administrators to patch an Ivanti Connect Secure flaw exploited as a zero-day since at least October 1. The item does not give the flaw identifier.