57
47
60
60
60
60
Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero
60
55
57
60
60
Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works
Cyble argues supply chain attacks are a primary breach vector, citing Verizon DBIR third-party figures and CISA SBOM guidance to pitch its TPRM platform.
Cyble's vendor blog frames third-party compromise as a first-order breach risk, citing Verizon's 2026 DBIR finding that third parties were involved in 48% of breaches, up 60% year over year. It recounts the Cl0p campaigns against Progress MOVEit Transfer (CVE-2023-34362), which affected over 2,700 organizations and 93 million people, and Fortra GoAnywhere (CVE-2023-0669) with roughly 130 claimed victims. It also highlights CISA and NSA's 2026 Minimum Elements for a Software Bill of Materials covering open-source, AI, and SaaS components. The piece concludes by promoting Cyble's Third-Party Risk Management platform.
25
Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability
60
60
CISA Alerts on Active Exploitation of Flaws in Fortinet, Ivanti, and Nice Products
60
60
60
57
60
60
60
60
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.
TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.
60
30
60
60
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
60
Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped
60
60
60
60
60
Microsoft Issues Patches for 90 Flaws, Including 10 Critical Zero
60
Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
60
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild
60
30
Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
60
Microsoft Patches 130 Vulnerabilities, Including Critical Flaws in SPNEGO and SQL Server
60
Microsoft Issues Patches for 51 Flaws, Including Critical MSMQ Vulnerability
60
Microsoft's March Updates Fix 61 Vulnerabilities, Including Critical Hyper
60