Volexity's first-hand teardown of the full chain to root — the only public source with the attacker's steps and the log-tampering that defeats Ivanti's own checker.
The espionage backstory to today's patch deadline — how a single Beijing contractor's infrastructure fed the whole campaign. Read it if you want the why, not just the CVE list.
An autonomous agent chained two now-exploited Zammad flaws — session fixation to code execution, then a jump to root — to breach the Dutch disclosure outfit DIVD.
CISA added CVE-2026-86950 — an out-of-bounds write in Apple's CoreGraphics that reaches code execution from a malicious file — to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 2 to patch.
Ivanti disclosed an actively-exploited authentication bypass in Connect Secure that attackers are stringing together with two more flaws to reach unauthenticated root.
A Windows Shell flaw that strips the Mark-of-the-Web warning off downloaded files was being exploited before Microsoft's October patch landed, and CISA has now flagged it.
CISA set today as the cutoff for federal agencies to patch or drop five products Flax Typhoon is actively exploiting — and every one of the bugs has had a fix out for years.
Dell is urging an update to System Update after disclosing CVE-2026-86360, a 9.6-severity path traversal that lets an unauthenticated attacker run code as root.
A path-traversal flaw in FortiMail (CVE-2026-104286, CVSS 9.8) lets an unauthenticated attacker write arbitrary files over a crafted HTTP request, it's already being exploited, and Fortinet still hasn't shipped a fixed build.
CVE-2026-76504 (CVSS 9.8) lets an unauthenticated attacker reach Cisco Catalyst SD-WAN Manager's API as admin through a URL-encoding trick, it's under active attack, and CISA's remediation deadline fell on October 3.
CISA added Cisco's actively exploited Catalyst SD-WAN Manager authentication bypass to its KEV catalog and gave federal agencies until October 3 to patch or disconnect.
An autonomous agent chained two now-exploited Zammad flaws — session fixation to code execution, then a jump to root — to breach the Dutch disclosure outfit DIVD.
CISA has given federal agencies until September 14 to fix CVE-2026-85706, a maximum-severity path-traversal flaw that lets a single unauthenticated request read any file on a self-hosted GitLab server.
CISA added seven actively exploited bugs to its KEV catalog with a September 5 patch deadline — the standouts are a perfect-10 SonicWall SMA1000 chain and an unauthenticated Sangoma Switchvox flaw already hit in the wild.
A memory-overflow bug Citrix shipped as a denial-of-service fix back in June turns out to allow unauthenticated remote code execution, and attackers are already dropping web shells on exposed NetScaler gateways.
CISA added two actively exploited TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog, setting federal remediation deadlines of August 23 for the first and September 2 for the second.
CISA added a critical Langflow RCE, a Tomcat cluster flaw, and another N-central bypass to its exploited-vulnerabilities catalog, with a federal deadline of August 7.
CISA added CVE-2026-45659 — a CVSS 8.8 SharePoint Server deserialization RCE exploitable by any authenticated Site Member — to the KEV catalog on July 1, with FCEB agencies required to patch by July 4.
FCEB agencies hit their June 26 patch deadline today for CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 — path traversal and command injection bugs in Ubiquiti UniFi OS that CISA added to KEV on June 23.
Federal agencies hit their June 21 remediation deadline for CVE-2026-20253, a missing-authentication flaw in Splunk Enterprise that lets unauthenticated attackers create or truncate files via a PostgreSQL sidecar endpoint.
CISA confirmed active exploitation of CVE-2026-20253 in the Widget Factory Joomla Content Editor, adding it to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of June 21.
CISA added a critical Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog on June 12, enabling unauthenticated remote attackers to execute commands as root.
CVE-2026-50751, an IKEv1 VPN vulnerability confirmed as actively exploited by Check Point, drew a Dutch NCSC warning about imminent large-scale attacks and a CISA KEV deadline.
CISA formally listed CVE-2026-20245 in its Known Exploited Vulnerabilities catalog on June 9, giving federal agencies until June 23 to remediate — even though Cisco has yet to ship a fix.
CISA added CVE-2026-7473, an incomplete comparison flaw in Arista Extensible Operating System, to the Known Exploited Vulnerabilities catalog on June 9 with a remediation deadline of June 23, 2026.
CVE-2026-41091 lets a local attacker escalate to SYSTEM through Defender's Malware Protection Engine, while CVE-2026-45498 kills definition updates — patched together, federal deadline June 3.
CISA flagged CVE-2025-34291 (Langflow origin validation error) and CVE-2026-34926 (Trend Micro Apex One directory traversal) as actively exploited, requiring federal agencies to patch under BOD 22-01.
Seven vulnerabilities joined the KEV catalog on May 20, mixing two fresh Microsoft Defender CVEs with five bugs from 2008-2010 that are, apparently, still being weaponized.
A CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN is being actively exploited in the wild, with CISA mandating federal agency remediation by May 17, 2026 and no complete workaround available short of upgrading.
CISA's May 10 remediation deadline for an Ivanti Endpoint Manager Mobile improper-input-validation bug enabling authenticated-admin RCE has now lapsed, increasing exposure for federal and enterprise deployments.
Ivanti Endpoint Manager Mobile carries a CVSS 7.2 RCE flaw under active exploitation, and CISA ordered Federal Civilian Executive Branch agencies to apply patches by May 10, 2026.
The CISA May 9 remediation deadline for the actively exploited Palo Alto PAN-OS root-level RCE (CVE-2026-0300) has arrived with official patches still not available, requiring agencies to apply interim mitigations immediately.
Anthropic launched a long-term cyber-defense push pairing a free, model-driven vulnerability scanner for open-source projects with an on-site program for critical-infrastructure operators.
A maintainer re-enabled two compromised actions-cool GitHub Actions without cleaning their tags, so the Mini Shai-Hulud payload kept executing for a week before GitHub pulled them again.
As of early August, npm granular access tokens set to skip 2FA can no longer manage other tokens, maintainers, or account settings — and direct publishing is next to go, in early 2027.
Acting on credible threat intelligence from federal authorities, Kiteworks asked self-managed customers to shut their file-transfer systems down for a nine-hour weekend window as a precaution — no confirmed breach, but an imminent-threat warning is unusual enough to take seriously.
Clop moved its extortion site to a new Tor address after ShinyHunters walked in through a path-traversal flaw Grav had patched everywhere except the 1.7 branch.
CISA will send its last weekly vulnerability summary on September 28, retiring the long-running Monday email as it shifts from CVSS-severity triage toward a risk-based model — and pointing people to the KEV catalog and advisories instead.
GitHub resumes enforcement of minimum runner version requirements starting June 29, with brownouts from 11 AM–3 PM ET on github.com and full enforcement across GitHub Enterprise Cloud by July 31.
CISA's May 12 patching deadline for CVE-2026-32202 — an APT28-exploited Windows Shell spoofing flaw enabling zero-click NTLMv2 hash theft — arrives today, requiring the April 2026 cumulative update KB5083769.