Topic tag

vulnerability

6 articles tagged vulnerability. Browse the full archive or jump to all posts.

October 21, 2026 · 9 min read

PHP2Shell Is Coming: Your Patch Window Is 15 Minutes

PHP shipped fixes for two CVSS 9.2 RCEs on 21 October. Sansec expected mass attacks within 15 minutes. The fix is infrastructure-level. Prep list inside.

October 4, 2026 · 9 min read

FortiMail CVE-2026-104286: A 9.8 File Write on the Appliance You Never Revisit

CISA put FortiMail's unauthenticated 9.8 file write into KEV on 1 October. An exposed, forgotten mail gateway is a weekend job now.

September 27, 2026 · 11 min read

F5 BIG-IP: A 9.8 You Reach Through the Auth Header, With No Credentials

CVE-2026-94127 is a heap overflow in BIG-IP APM that you can reach unauthenticated from the data plane. F5 shipped engineering hotfixes on 22 September and CISA gave US federal agencies three days. The only question that matters for your estate is whether you run APM as an OAuth Authorization Server.

September 20, 2026 · 13 min read

Three Linux kernel bugs hit CISA's exploited list the same day four public root exploits landed

CISA added three Linux kernel flaws to its known-exploited catalog on 18 September 2026. Four public local-root exploits landed the same day.

September 20, 2026 · 11 min read

SolarWinds shipped a hard-coded key in Access Rights Manager - unauthenticated RCE is the result

SolarWinds patched a CVSS 8.8 unauthenticated RCE in Access Rights Manager on 17 September 2026, caused by a hard-coded key shipped in the product.

September 6, 2026 · 8 min read

Two SonicWall SMA 1000 zero-days are being exploited right now - the 48-hour patch playbook for ANZ branch offices

SonicWall disclosed two zero-days on 2 September 2026 affecting SMA 1000 series VPN appliances. One is CVSS 10.0. Active exploitation is confirmed. If you operate an SMA 1000 for branch offices or as an MSSP front-end, this is the patch-window briefing you need today.