60
⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More
60
Microsoft February 2021 Patch Tuesday fixes 56 bugs, including an actively exploited Windows zero
60
60
60
60
60
60
60
Week in review: Microsoft patches actively exploited 0-days, Amazon and HSBC employee data leaked
60
60
60
60
60
60
Week in review: Attackers use phishing emails to steal NTLM hashes, Patch Tuesday forecast
60
60
Week in review: Exploited Citrix Bleed vulnerability, Atlassian patches critical Confluence bug
60
Microsoft May 2020 Patch Tuesday fixes 111 flaws, 13 Critical
60
CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability
CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.
CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.
74
60
Week in review: Cisco SD-WAN 0-day exploited, Patch Tuesday forecast
60
Week in review: 300k+ Plex Media Server instances still vulnerable to attack, exploited Git RCE flaw
60
60
Week in review: Microsoft patches 5 actively exploited 0-days, recently fixed Chrome vulnerability exploited
60
Week in review: Zero-click flaw in Synology NAS devices, Google fixes exploited Android vulnerability
60
60
60
60
Week in review: KeePass vulnerability, Apple fixes exploited WebKit 0-days
60
Dozens of Vulnerable NuGet Packages Allow Attackers to Target .NET Platform
60
Patch Tuesday - September 2026
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.
88
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
Week in review: Cisco fixes critical UCCX flaws, November 2025 Patch Tuesday forecast
60
60
Week in review: Sudo local privilege escalation flaws fixed, Google patches actively exploited Chrome
60
Week in review: Veeam Backup & Replication RCE could soon be exploited, Microsoft fixes 4 0-days
60
New malicious web shell from the Tropic Trooper group is found in the Middle East
60
60
60