57
60
60
60
60
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
60
60
60
60
60
60
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
60
Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited
60
60
60
60
⚡ Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More
60
60
60
Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
60
60
60
60
60
60
GitLab’s critical flaw is already drawing internet-wide probes
GitLab patches two critical flaws (CVE-2026-85706 CVSS 10.0, CVE-2026-87719) as WatchTowr observes internet-wide probing of the unauthenticated file-read bug.
GitLab released emergency patches for two high-severity flaws in Community and Enterprise Editions, urging self-managed operators to upgrade immediately while saying its hosted and Dedicated offerings are fixed or unaffected. CVE-2026-85706 (CVSS 10.0) is a path traversal in the repository commits interface that lets unauthenticated attackers read any file on the server and affects releases 18.7 through 19.1.8 plus the 19.2 and 19.3 lines before patching. CVE-2026-87719 (CVSS 9.9, Enterprise Edition only) lets a logged-in Duo Chat user hide a command in a request that triggers Advanced Search settings and password disclosure. WatchTowr Labs reported it is already watching probes that can trigger the path traversal flaw in a single HTTP request, though CISA had not added either issue to the KEV list as of Friday afternoon.
78
Cyber Security News
Microsoft's September Patch Tuesday fixes nearly 1,000 vulnerabilities; CISA warns two of the flaws are being actively exploited.
Microsoft's September 2026 Patch Tuesday release addresses close to 1,000 vulnerabilities, with CISA warning that two of the bugs are being actively exploited. The Record's homepage digest also lists briefs including a US offer of $10 million for information on an Iranian hacker accused of attacking critical infrastructure and a leak of health data on more than 9.5 million people from the Aesto record system. Additional briefs cover a Russian suspect's extradition to the US for bank account takeovers, US-British coordination on scam center takedowns, G7 guidance on quantum cyber threats, a large DDoS attack on Norwegian public services, and Slovenian casinos reopening after a cyberattack.
78
60
Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs
60
Microsoft discloses ‘the mother of all’ vulnerability loads, tripling June’s previous record
60
60
60
60
Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week
60
60
60
60
60
60
60