Ivanti CVE-2026-111357 and CVE-2026-118527: What to Do
CISA added two more Ivanti Connect Secure flaws to KEV on 30 October: CVE-2026-111357, a privilege escalation to root, and CVE-2026-118527, a …
Tag
Incident Response
GitLab CVE-2026-97229: Patch the Regex RCE, Then Hunt
CISA added GitLab CVE-2026-97229, an unauthenticated remote code execution bug in how GitLab compiles regular expressions from CI/CD configuration, to …
Magento CVE-2026-48356 (PolyShell): Patch and Hunt
CVE-2026-48356 is the PolyShell file-upload flaw in Adobe Commerce and Magento Open Source. CISA added it to the KEV catalog on October 27, 2026. Here …
PHP2Shell CVE-2026-109618 and -109619: Patch, Then Hunt
Two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution against PHP that serves web requests. CISA added …
PAN-OS CVE-2026-0322: Patch the Management Interface RCE
CVE-2026-0322 lets an authenticated attacker who can reach the PAN-OS management interface run code as root on PA-Series and VM-Series firewalls and …
Kubernetes Audit Policy: What to Log, at What Level
A Kubernetes audit policy decides which API requests kube-apiserver records and how much of each it keeps. The first matching rule wins, so one …
VeloCloud Orchestrator CVE-2026-114625: Patch and Hunt
CVE-2026-114625 is a SQL injection in on-premises Arista VeloCloud Orchestrator that lets any authenticated user, down to the Enterprise Read Only …
Collabora CODE CVE-2026-110447: Patch Nextcloud, Then Hunt
CVE-2026-110447 is an unauthenticated OS command injection in proxy.php of the Collabora Online Built-in CODE Server app for Nextcloud …
Atlassian CVE-2026-21589 File Read: Patch and Hunt
CVE-2026-21589 lets an unauthenticated attacker read files inside the web root of eight Atlassian Data Center products, including Jira, Confluence and …
BeyondTrust CVE-2026-102764: Patch, Then Hunt for SAWFLY
A BeyondTrust Remote Support authentication bypass was exploited as a zero-day from late August 2026. SaaS instances are patched; self-hosted …
Plex Media Server CVE-2026-96656 Chain: Patch and Hunt
Four Plex Media Server flaws fixed in 1.43.3.10861 are now in CISA's KEV catalog, and Plex says the chain is being widely exploited after a public …
What Is Token Theft and Why MFA Doesn't Always Stop It?
MFA verifies who's logging in, not who's still using the session afterward. Token theft attacks steal what MFA leaves behind: the authenticated …