Search: “update”

1,216 items in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Advisory 209 Exploit / PoC 189 Vulnerability 175 AI industry 84 AI research 73 Industry 69 Malware 67 AI safety & security 64 Threat actor 60 Tools 51 Data breach 36 Research 33 Policy & legal 27 Phishing & fraud 27

SeverityAll critical 81 high 370 medium 265 low 75 info 425

Windows 11 cumulative updates KB5124008 & KB5122880 released

Microsoft shipped mandatory September 2026 Patch Tuesday cumulative updates KB5124008 and KB5122880 for Windows 11, fixing vulnerabilities and adding features.

Microsoft released Windows 11 KB5124008 (versions 25H2/24H2) and KB5122880 (23H2) cumulative updates containing the September 2026 Patch Tuesday security patches, described as covering 1,000 vulnerabilities discovered in previous months. The updates are mandatory and add features including movable and resizable taskbars, Start menu customization, a Windows Search option to hide Bing and Store web suggestions, and Administrator Protection, a just-in-time admin privilege feature that is off by default and configurable via Intune OMA-URI or Group Policy.

BleepingComputerSep 8, 17:57 UTC · 8d agoAdvisory1

Microsoft releases emergency Windows updates to fix RDS failures

Microsoft released emergency out-of-band Windows updates fixing Remote Desktop Services failures and Hyper-V issues caused by September 2026 security patches.

Microsoft issued out-of-band updates on September 14, 2026 to fix Remote Desktop Services instability introduced by the September security updates, which caused RDP connection and sign-in failures and unresponsive servers. Updates include KB5129194 (Windows 11 26H1), KB5129195 (Windows 11 24H2/25H2), KB5129236 (Windows 10), KB5129235 (Windows Server 2025), and KB5129237 (Windows Server 2022). The Windows 11 updates also fix a Hyper-V Plan9 shared folder issue and some USB Audio Class 1.0 multichannel problems, though remaining USB audio issues await a fix. Admins had previously used Group Policy mitigations or uninstalled the security updates, which removed security protections.

BleepingComputerupdated Sep 15, 08:40 UTC · 2d agofirst Sep 14, 20:52 UTC · 2d agoAdvisory 3 sources2

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security NewsSep 16, 07:45 UTC · 1d agoVulnerability in the wildCVE-2026-627211

Microsoft releases Windows 10 KB5122878 extended security update

Microsoft shipped Windows 10 ESU update KB5122878, delivering the record September 2026 Patch Tuesday fixes, including patches for two actively exploited zero-days.

Microsoft released KB5122878 for Windows 10 Enterprise LTSC and ESU customers, moving builds 19045/19044 to .7725 with security and bug fixes. The update carries this month's record September 2026 Patch Tuesday set, which fixed 966 Microsoft vulnerabilities including two actively exploited zero-day flaws. It also fixes BitLocker recovery-key prompts and Remote Desktop audio redirection, and updates Secure Boot certificate rollout and Morocco time zone data. Microsoft reports no known issues with the update.

BleepingComputerSep 8, 18:49 UTC · 8d agoAdvisory in the wild1

Oracle Critical Security Patch Update, September 2026 Review

Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.

Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.

Qualys ThreatPROTECTSep 16, 14:15 UTC · 19h agoAdvisory CVE-2026-83154 CVE-2026-83196 CVE-2026-83197+10 CVEs

Critical N-able N-central Vulnerability and Active Exploitation

N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.

N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.

HuntressSep 6, 11:00 UTC · 10d agoExploit / PoC in the wildCVE-2026-86218 CVE-2026-86206 CVE-2026-86207+2 CVEs

wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)

Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.

wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sources CVE-2026-63030 CVE-2026-601371

Oracle September 2026 Critical Security Patch Update addresses 672 CVEs

Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).

Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.

Tenable BlogSep 15, 21:00 UTC · 1d agoVulnerability

Microsoft Excel KB5002914 update breaks copy and paste for some users

Microsoft's September Patch Tuesday update KB5002914 breaks copy-and-paste and formula dragging in Excel 2016 through 2024; uninstalling the update restores functionality.

Users on Reddit and Microsoft Q&A report that the KB5002914 security update shipped in the September 2026 Patch Tuesday breaks copy-and-paste, autofill, and formula dragging in Excel. The problem spans Office 2016 through 2024 across MSI and Click-to-Run installations, including Office LTSC Standard 2021, with some teams blocked after widespread patching. Uninstalling KB5002914 or downgrading the Office build restores functionality, though replacing the excel.exe binary is not recommended. BleepingComputer could not reproduce the issue on Excel 2019 Version 2508 Build 19127.20302 and contacted Microsoft for comment.

BleepingComputerupdated Sep 15, 09:25 UTC · 2d agofirst Sep 10, 19:07 UTC · 6d agoVulnerability 3 sources

macOS 27 Golden Gate – Review

Ars Technica reviews macOS 27 Golden Gate, highlighting an unavoidable Apple Intelligence upgrade, new AFM 3 Core models, and dropped Intel Mac support.

macOS 27 Golden Gate delivers the first significant Apple Intelligence upgrade two years after launch, and the toggle to disable the AI features or delete downloaded models is gone. Apple Intelligence runs on a new AFM 3 Core model built in collaboration with Google, while the more capable AFM 3 Core Advanced requires an M3 chip and at least 12GB of RAM. The release drops all Intel Mac support, requiring Apple Silicon, with Sequoia security updates expected to end in fall 2027 and Tahoe's in 2028.

Hacker News · AISep 16, 19:53 UTC · 14h agoAI industry 2 sources HN 45↑ · 28 comments

WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.

Since June 5, 2026, every WordPress.org plugin and theme release passes a mandatory six-hour cooldown while multiple AI models and Jetpack Scan analyze code changes and produce a consolidated security score; releases above the risk threshold are blocked automatically. The change followed a July 28, 2026 incident where a backdoor was pushed into a plugin with roughly 20,000 active installs, which Wordfence flagged and the Plugins Team pulled 26 minutes later before distribution. Authors are notified of blocking findings and can republish corrected releases or appeal false positives to the Plugins Team.

Cyber Security Newsupdated Sep 11, 05:49 UTC · 6d agofirst Sep 10, 14:08 UTC · 6d agoTools 3 sources1

Update Chrome now to protect against an actively exploited vulnerability

Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.

Chrome stable channel updated to 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, including 230 security fixes. CVE-2026-87491 is an out-of-bounds write in Chrome's V8 JavaScript engine that a crafted HTML page can exploit to execute arbitrary code inside the browser sandbox; Google rates it medium severity, but it is confirmed as actively exploited. The update also fixes five Critical vulnerabilities, four of which were found in WebGL. Users should update via Settings > About Chrome and restart the browser.

Malwarebytes Labsupdated Sep 15, 10:17 UTC · 1d agofirst Sep 10, 10:52 UTC · 6d agoExploit / PoC in the wild 9 sources CVE-2026-874911

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.

CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.

CERT/CC Vulnerability NotesSep 8, 15:05 UTC · 8d agoVulnerability CVE-2026-20293 CVE-2026-33197 CVE-2026-6485

Oracle Critical Patch Update, August 2026 Security Update Review

Oracle's August 2026 Critical Patch Update fixes 943 vulnerabilities; Oracle Fusion Middleware and Hyperion received the most patches at 262.

Oracle released its August 2026 Critical Patch Update, addressing 943 security vulnerabilities across multiple product families, including third-party components bundled in Oracle products. Oracle Fusion Middleware and Oracle Hyperion received the highest number of fixes with 262 patches. Several of the addressed vulnerabilities impact more than one product.

Qualys ThreatPROTECTAug 19, 13:49 UTC · 28d agoAdvisory2

Why Patch Automation Needs Brakes, Not Just an Accelerator

Action1's field CTO argues patch automation needs staged deployments and stop conditions, not just speed.

Gene Moody, Field CTO at Action1, writes on BleepingComputer that patch automation must pair acceleration with safeguards. He recommends staged deployment rings with predefined go/no-go criteria, keeping human judgment for domain controllers, databases, and ERP systems. The piece warns that automation without brakes can push a bad update to 10,000 endpoints as fast as a good one.

BleepingComputerSep 14, 14:01 UTC · 2d agoIndustry

Android’s September 2026 Updates Patch 180 Vulnerabilities

Google's September 2026 Android security updates patch 180 vulnerabilities including critical Wi-Fi memory corruption flaw CVE-2026-28662.

Google released September 2026 Android security updates addressing 180 vulnerabilities across two patch levels. The 2026-09-01 level fixes 95 bugs including 23 critical System component flaws enabling RCE, EoP, and DoS. The 2026-09-05 level addresses 85 additional defects in kernel and vendor components including a Wi-Fi memory corruption flaw (CVE-2026-28662) enabling remote code execution without privileges or user interaction.

SecurityWeekSep 9, 16:30 UTC · 7d agoAdvisory CVE-2026-28662

Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilities

Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.

Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.

GBHackersSep 16, 05:36 UTC · 1d agoAdvisory

Windows 11 Security Update KB5124008 Breaks Always-On VPN Connections

Microsoft's September 2026 Windows 11 update KB5124008 breaks certificate-based Always On VPN on some enterprise clients, forcing admins to pause rollout.

Microsoft's September 8, 2026 cumulative update KB5124008 for Windows 11 24H2 (build 26100.9445) and 25H2 (build 26200.9445) breaks certificate-based Always On VPN tunnels on some enterprise clients, with connectivity restored after uninstalling the update and rebooting. The issue was first detailed on Microsoft Q&A on September 9 by an administrator using Intune-deployed VPN profiles with RRAS and NPS on Windows Server 2019. The same mandatory Patch Tuesday package fixes two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call, so many teams are pausing only VPN cohorts rather than blocking the full rollout.

Cyber Security Newsupdated Sep 15, 10:17 UTC · 1d agofirst Sep 11, 13:11 UTC · 5d agoVulnerability in the wild 9 sources CVE-2026-81963 CVE-2026-858802

Remote Desktop Services Failures on Windows Servers Following September Update

September 2026 Patch Tuesday updates cause Windows Server 2019/2022/2025 RDS sessions to freeze, forcing administrators to roll back.

Cumulative updates KB5122876 (Windows Server 2019), KB5122882 (2022), and KB5122871 (2025) trigger Remote Desktop Services freezes hours after boot, with RDP connections hanging at 'Connecting…' and Event ID 20498 logged. Administrators trace the fault to an apparent deadlock in RDPSERVERBASE!WDLIB_Close during session teardown; only hard resets restore service and the issue recurs. The same September release patched roughly 973 vulnerabilities, including two actively exploited zero-days (CVE-2026-81963, CVE-2026-85880, both in CISA's KEV) and a critical RDS RCE, CVE-2026-69525 (CVSS 9.8). Workarounds include DISM-based removal of the update or an unofficial FeatureManagement registry key disabling the suspected audio-redirection code path; Microsoft has not yet confirmed the bug.

Cyber Security NewsSep 11, 04:46 UTC · 6d agoVulnerability in the wild 2 sources CVE-2026-81963 CVE-2026-85880 CVE-2026-69525+1 CVEs1

September Windows Server updates break Remote Desktop Services

September 2026 Windows Server cumulative updates cause Remote Desktop Services failures on Server 2019, 2022 and 2025, forcing some admins to roll back.

Admins report Remote Desktop Services failures after installing September 2026 Patch Tuesday updates KB5122876 (Server 2019), KB5122882 (Server 2022), and KB5122871 (Server 2025), with connections hanging, sessions failing after logout, and some systems requiring hard resets. One administrator debugging Server 2022 observed an apparent deadlock between RDP and the Local Session Manager, though Microsoft has not confirmed a root cause. Rolling back the updates restores RDS functionality but removes this month's security fixes. Microsoft had not responded to inquiries at publication time.

BleepingComputerupdated Sep 11, 04:46 UTC · 6d agofirst Sep 10, 20:34 UTC · 6d agoVulnerability 2 sources1

Microsoft Confirms Remote Desktop Services Might Stop Working Following Sept. 2026 Security Update

Microsoft's September 2026 Patch Tuesday updates (KB5124008) can break Remote Desktop Services, causing RDP failures and freezes across Windows clients and servers.

Microsoft confirmed its September 2026 security updates, including KB5124008 for Windows 11 24H2/25H2, introduced a reliability regression where RDP connections fail after several minutes and servers hang at the 'Please wait for the Remote Desktop Configuration' screen. MMC, RDS Licensing Diagnoser, File Explorer, and the Windows Update settings page may also stop responding. The issue affects Windows 10/11 clients and Windows Server 2012 through 2025; Microsoft marked it Mitigated on September 11 and is developing a permanent fix, with VM restart offered as a temporary workaround.

Cyber Security NewsSep 14, 10:43 UTC · 2d agoAdvisory1

Two critical Chrome flaws put users at risk on malicious websites

Google patched 26 Chrome flaws, including two critical use-after-frees and an actively exploited V8 sandbox escape (CVE-2026-85046); update to 152.0.7977.82/.83.

Chrome's desktop update fixes 26 security issues, including critical use-after-free flaws CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL, both allowing code execution outside the browser sandbox via crafted HTML pages. Google subsequently patched CVE-2026-85046, a high-severity V8 JavaScript engine flaw with exploits already in the wild that enables arbitrary code execution inside the Chrome sandbox; HKCERT rates the overall risk as extremely high. Fixed versions are 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux.

Malwarebytes LabsSep 2, 11:15 UTC · 14d agoExploit / PoC in the wildCVE-2026-84352 CVE-2026-84353 CVE-2026-850461

Windows 11 KB5124008 Update Breaks Active Directory Domain Trust and Blocks User Logins

Microsoft's September Windows 11 cumulative update KB5124008 breaks Active Directory domain trust on domain-joined machines, blocking logins despite valid credentials.

Microsoft is investigating community reports that KB5124008, the September 8, 2026 cumulative update for Windows 11 24H2/25H2 (builds 26100.9445/26200.9445), breaks the AD secure channel, causing 'The user name or password is incorrect' errors on interactive logon. Admins reproduced the failure consistently and observed nltest error 1786 (ERROR_NO_TRUST_LSA_SECRET) plus domain controller Event 4625 with status 0xC000006D over NTLM. The problem is suspected in Machine Identity Isolation, a Credential Guard capability that moves machine-account secrets into virtualization-based security, and disabling it via registry value, Group Policy, or Intune baseline restored trust. The September 14 out-of-band update KB5129195 does not address the domain trust issue, and Microsoft's release notes do not list it as a known problem.

Cyber Security News00:29 UTC · 9h agoVulnerability 2 sources

Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.

Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.

Cyber Security NewsSep 16, 03:01 UTC · 1d agoVulnerability CVE-2026-91721 CVE-2026-91749 CVE-2026-91726+27 CVEs1

Microsoft Confirms KB5002914 Update Breaks Copy and Paste on Excel

Microsoft confirms KB5002914 Excel security update silently breaks copy-paste in Excel 2016-2024, forcing admins to choose between usability and security fixes.

Microsoft added a known issue to KB5002914, the September 8, 2026 Excel security update, where paste, autofill, and formula dragging fail silently with no error in Excel 2016, 2019, 2021, and 2024. The update addresses remote code execution and information disclosure flaws including CVE-2026-81399, CVE-2026-81390, and CVE-2026-81954. No hotfix date has been published as of September 15, 2026; the only widely confirmed recovery is uninstalling or rolling back KB5002914, which drops the month's Excel security fixes.

Cyber Security NewsSep 15, 09:25 UTC · 2d agoAdvisory 3 sources CVE-2026-81399 CVE-2026-81390 CVE-2026-819542

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business NewsSep 2, 02:55 UTC · 15d agoData breach in the wild1

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42Aug 19, 12:03 UTC · 28d agoExploit / PoC in the wildCVE-2023-335381

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.

CVE-2026-5430 (CVSS 9.8-10.0), an improper cryptographic signature verification flaw in WSO2 API Manager, lets JWT authentication be bypassed with unsupported algorithms, enabling administrative account takeover. watchTowr honeypots captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, which could expose API credentials, consumer keys, and secrets for every registered application. Affected products include WSO2 API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Fixes are available via GitHub pull requests and subscription update levels, and users are urged to patch immediately.

The Hacker Newsupdated Sep 16, 15:05 UTC · 18h agofirst Sep 16, 05:18 UTC · 1d agoExploit / PoC in the wild 3 sources CVE-2026-54301

WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review

WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.

WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.

GBHackersSep 11, 05:49 UTC · 6d agoTools 3 sources1

Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...

JetBrains fixed critical unauthenticated RCE CVE-2026-63077 in TeamCity On-Premises; update to 2025.11.7 or 2026.1.3.

JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all TeamCity On-Premises versions. An attacker with HTTP(S) access can bypass authentication checks via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the server process. Fixes are available in versions 2025.11.7 and 2026.1.3, plus a security patch plugin for TeamCity 2017.1+. JetBrains states there is no evidence of active exploitation at disclosure time, and TeamCity Cloud is already mitigated.

Web discovery (articles for new exploits & KEV entries)Sep 8, 21:42 UTC · 8d agoVulnerability CVE-2026-63077

The hidden work of modernizing Malwarebytes

Malwarebytes details its migration of Windows product managed components to .NET 10, citing security, supportability, diagnostics, and performance benefits.

Malwarebytes says it migrated the managed portions of Malwarebytes for Windows to .NET 10 while leaving native drivers and the detection engine untouched. The vendor cites a supported runtime, safer defaults, stronger cryptography, better diagnostics, and JIT/GC performance improvements as benefits. The migration also deprecated Windows 7 support, and the company applies staged rollouts and automated validation because its code runs with elevated privileges on millions of endpoints. No vulnerabilities or incidents are described.

Malwarebytes LabsSep 4, 17:15 UTC · 12d agoIndustry2

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?

August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.

July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.

Help Net SecurityAug 25, 06:52 UTC · 23d agoIndustry in the wildCVE-2026-505221

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputerupdated 00:29 UTC · 9h agofirst Sep 16, 20:39 UTC · 13h agoVulnerability 2 sources

Microsoft confirms KB5002914 Excel update breaks copy and paste

Microsoft confirms KB5002914 Office security update silently breaks copy-paste, autofill, and formula dragging in Excel 2016 through 2024.

Microsoft confirmed the September 2026 KB5002914 security update breaks copy-and-paste, autofill, and formula dragging in Excel 2024, 2021, 2019, and 2016. Failures occur silently with no beep or error message, leaving the destination unmodified. Uninstalling KB5002914 via OfficeC2RClient or Oarpmany restores functionality while Microsoft investigates.

BleepingComputerupdated Sep 15, 09:25 UTC · 2d agofirst Sep 15, 08:40 UTC · 2d agoAdvisory 3 sources2

WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress will automatically scan every plugin release and block high-risk updates from distribution using AI analysis plus Jetpack Scan.

WordPress announced automated security reviews for every plugin release during its cooldown period before distribution through the WordPress.org update API, combining AI models with Jetpack Scan into a security score. The system already caught a backdoor committed to a plugin with about 20,000 active installations on July 28, 2026, blocking it within 26 minutes of a Wordfence alert. Flagged patterns include missing capability checks, unsafe $wpdb queries, unserialize() on request data, and obfuscated code.

The Hacker NewsSep 14, 16:00 UTC · 2d agoTools

Microsoft: September updates cause RDS failures on Windows Server

Microsoft confirms September 2026 Patch Tuesday updates break Remote Desktop Services on Windows Server 2012+; Group Policy mitigations and rollback workarounds available.

Microsoft confirmed that September 2026 Patch Tuesday security updates cause Remote Desktop Services failures on Windows Server 2012 and later, plus Windows 10 and Windows 11. Symptoms include unstable RDS, RDP connection failures after several minutes, sign-in issues, servers hanging at 'Please wait for the Remote Desktop Configuration,' and unresponsive MMC, RDS Licensing Diagnoser, and File Explorer. Microsoft published per-version Group Policy mitigations (covering KBs such as KB5124008, KB5122880, KB5122878, KB5122871, KB5122882, KB5122876, KB5123099, KB5123065, KB5123066) and suggests restarting affected VMs. Rolling back the updates restores RDS functionality but removes this month's security fixes.

BleepingComputerupdated Sep 15, 08:40 UTC · 2d agofirst Sep 14, 09:50 UTC · 3d agoAdvisory 3 sources1

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages

Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.

Debian shipped version 13.7 of 'trixie', folding in 92 previously published security advisories and corrections to 106 source packages, including six Linux kernel advisories (DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466, DSA-6477). glibc fixes a buffer overflow (CVE-2026-5928) and buffer underflow (CVE-2026-5450), with 17 packages rebuilt against the updated library; qemu carries 25 CVEs including a secure boot bypass (CVE-2026-16288), imagemagick 24, wolfssl 15 and perl 13. Boot-chain fixes include a u-boot FIT image verification bypass (CVE-2026-46728), a BOOTP/DHCP buffer overread (CVE-2024-42040), and corrected intermediate certificate verification in sbsigntool. The installer was rebuilt with kernel ABI 6.12.107+deb13, and existing systems receive the fixes through normal package mirror updates.

Help Net SecuritySep 14, 07:40 UTC · 3d agoAdvisory CVE-2026-5928 CVE-2026-5450 CVE-2026-34873+17 CVEs

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.

CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-38059 CVE-2026-38057 CVE-2026-38056+1 CVEs

Cisco security advisory (AV26-197) – Update 3

CISA added Cisco CVE-2026-20079 to its KEV catalog; the Canadian Cyber Centre urges updates across Secure Firewall ASA, FTD, FMC, and SCC products.

The Canadian Centre for Cyber Security updated advisory AV26-197 covering March 2026 Cisco advisories for Security Cloud Control, Secure Firewall Management Center, ASA, and FTD. Cisco confirmed CVE-2026-20131 was actively exploited on March 18, 2026, and CISA added it to KEV on March 19. In Update 3, dated September 9, 2026, CISA added CVE-2026-20079 to the KEV catalog. The underlying flaws include FMC authentication bypass and remote code execution, ASA TCP-flood denial of service, and ASA/FTD IPsec denial of service.

Canadian Centre for Cyber SecuritySep 9, 20:04 UTC · 7d agoExploit / PoC in the wildCVE-2026-20131 CVE-2026-20079

Microsoft Patch Tuesday, September 2026 Security Update Review

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

Qualys ThreatPROTECTSep 9, 12:23 UTC · 7d agoVulnerability in the wildCVE-2026-81963 CVE-2026-85880 CVE-2026-58599+27 CVEs