60
60
60
AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE
60
Week in review: Microsoft patches actively exploited 0-days, Amazon and HSBC employee data leaked
60
251 Amazon-Hosted IPs Used in Exploit Scan Targeting ColdFusion, Struts, and Elasticsearch
60
Amazon's Hotpatch for Log4j Flaw Found Vulnerable to Privilege Escalation Bug
60
60
60
60
60
60
60
60
Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited
60
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
60
60
60
Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited
60
60
60
60
Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero
60
Microsoft Fixes 78 Flaws, 5 Zero-Days Exploited; CVSS 10 Bug Impacts Azure DevOps Server
60
Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability
60
URGENT: Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero
60
Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation
60
Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
60
Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
60
60
60
60
60
Microsoft patches a record 972 vulnerabilities, 112 of them critical
Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, including two zero-days in Windows components.
Microsoft's September 2026 release patched roughly 972 vulnerabilities (997 including ported Chromium fixes for Edge), a record, with 112 rated critical. Notable flaws include two zero-days: CVE-2026-81963 in the Windows update service and CVE-2026-85880 in the Windows Advanced Local Procedure, with no public information on exploitation breadth. Microsoft has fixed 2,760 vulnerabilities in 2026, more than double last year's total, which ZDI's Dustin Childs attributes to AI-assisted discovery becoming the 'new normal'.
70
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.
PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding shipped in 9.4 (2014) that lets an account with the REPLICATION attribute run arbitrary code as the database server's OS user when wal_level is logical. Versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected; exploitation requires such an account, which backup, CDC, and monitoring tooling routinely holds. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating. Cyera Research, whose write-up names the flaw PostGREShell, demonstrated escalating a replication user to superuser with persistence; no PoC or KEV entry existed as of September 4.
60
Cisco FMC static credentials exploited by attackers (CVE-2026-20316)
60
60
60
Week in review: Cisco SD-WAN 0-day exploited, Patch Tuesday forecast
60
60