60
Week in review: Microsoft patches zero-day, Apple security updates, HashiCorp Vault vulnerability
60
60
Week in review: Microsoft, Apple patch exploited zero-days, tips for getting hired in cybersecurity
60
Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited
60
60
Week in review: Windows zero-day exploited, Patch Tuesday forecast, selecting a compliance solution
60
60
60
60
60
Week in review: Exploited Ivanti Connect Secure zero-day, Patch Tuesday forecast
60
60
Week in review: Palo Alto Networks firewalls under attack, Microsoft patches two exploited zero-days
60
60
Week in review: Microsoft fixes exploited Office zero-day, Fortinet patches FortiCloud SSO flaw
60
60
Adobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public Disclosure
Attackers began exploiting critical Adobe Commerce flaw CVE-2026-71362 (CVSS 9.1) for unauthenticated customer account takeover shortly after patch release.
Sansec blocked the first exploitation attempts of CVE-2026-71362 immediately after Adobe published its advisory. The flaw lets unauthenticated attackers switch a customer session to another customer account, hijacking accounts and accessing private data without credentials, admin privileges or user interaction. It affects Adobe Commerce, Commerce B2B and Magento Open Source versions through the July 2026 patches, and Adobe issued isolated patch files APSB26-92 fixing seven vulnerabilities, including stored cross-site scripting and authorization issues.
74
Microsoft breaks Patch Tuesday record with 974-CVE deluge
Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.
90
60
60
60
83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure
60
60
60
60
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow SSRF CVE-2026-64849 (CVSS 9.3) to steal cloud credentials; CISA added it to KEV; FUXA flaw CVE-2026-25895 is being scanned.
watchTowr observed exploitation of MLflow CVE-2026-64849, an unauthenticated SSRF (CVSS 9.3) affecting versions below 3.15.0, within hours of CVE assignment on August 17, 2026, with attackers abusing model-registry webhooks to reach cloud metadata endpoints and exfiltrate credentials and secrets. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 19, 2026, with a September 2 patch deadline for federal civilian agencies. VulnCheck reported scanning of FUXA CVE-2026-25895 (missing authentication plus path traversal, CVSS 9.5, versions through 1.2.9) beginning August 18; about 60 FUXA instances are exposed and no RCE payloads have been dropped yet.
74
60
60
wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)
Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.
wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.
90
CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.
CISA added CVE-2026-85706, a CVSS 10.0 path traversal vulnerability in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog on September 11, 2026. The flaw affects GitLab CE/EE versions 18.7-19.1.7, 19.2-19.2.5, and 19.3-19.3.1, allowing unauthenticated attackers to read arbitrary files from affected servers without user interaction. Fixes are available in GitLab 19.1.8, 19.2.6, and 19.3.2, and federal civilian agencies must remediate by September 14, 2026 under Binding Operational Directive 26-04. GitLab credited researcher s3ntago via HackerOne; arbitrary file disclosure could expose credentials, tokens, and CI/CD secrets useful for follow-on intrusions.
88
60
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open
60
60
Exchange Servers targeted via zero-day exploits, have yours been hit?
60
60
60
60
60
60