Beat
Vulnerabilities
Zero-days, patches and the bugs attackers are actually exploiting.
- 39
- stories
- OCT 20
- latest
Critical PHP Flaws Disclosed, Patches Out Now
The two flaws are CVE-2026-109618 and CVE-2026-109619 and are said to affect PHP versions 5, 6, 7, and 8.
DENNIS FISHER · OCT 20 · 3 min
All Vulnerabilities
Cisco Warns of Critical, Exploited Catalyst SD-WAN Manager Flaw
Cisco “strongly recommends” customers apply a patch for a critical API authentication bypass that’s being exploited.
Lindsey O'Donnell-Welch · 1 min
Researchers Warn of Citrix NetScaler Exploitation
On Saturday, researchers from watchTowr Labs said they had credible information that attackers were exploiting an unknown RCE vulnerability in Citrix NetScaler boxes.
Dennis Fisher · 3 min
F5 CVE-2026-94127 Targeted in Active Attacks
This vulnerability allows for unauthenticated remote code execution and shows how a missing bounds check—a classic programming error.
Dennis Fisher · 2 min
MicroTik Routers Under Attack in New Campaign
Labeled “MikroTrick” by researchers at CERT Polska who discovered and disclosed six vulnerabilities in the software, the campaign targets devices with SSH services reachable from the public internet
Dennis Fisher · 3 min
Critical Artifactory Bug Under Attack
CVE-2026-82329 is a simple authentication bypass that can allow an attacker to get admin privileges quite easily
Dennis Fisher · 1 min
Unauthenticated RCE Chain Found For Microsoft SharePoint CVE-2026-55040 and CVE-2026-63520
The chain leverages two distinct vulnerabilities—an authentication bypass and an unsafe .NET type instantiation flaw—to provide full server control without valid credentials.
Dennis Fisher · 2 min
Exploits Target N-able CVE-2026-18577 Flaw
The vulnerability, which effectively provides unauthenticated administrative access to the RMM console, stems from two related security issues
Dennis Fisher · 3 minCritical SharePoint Bug Under Attack
The flaw (CVE-2026-50522) affects SharePoint Enterprise Server 2016 and 2019 as well as SharePoint Subscription service. Microsoft released the fix for this vulnerability on July 14.
Dennis Fisher · 1 minOracle Zero-Day Linked to Latest ShinyHunters Attacks
“Because this activity predates Oracle’s June 10, 2026 advisory, the vulnerability was exploited as a zero-day,” said Mandiant researchers.
Lindsey O'Donnell-Welch · 2 min
The Past is Always Present in Vulnerability Disclosure
Microsoft’s reaction to the Nightmare-Eclipse saga is raising memories of the worst days of the disclosure debate.
Dennis Fisher · 4 minIvanti Warns of Exploited EPMM Flaw CVE-2026-6973
The vulnerability (CVE-2026-6973) exists in Ivanti Endpoint Manager Mobile (EPMM) is being exploited by threat actors.
Lindsey O'Donnell-Welch · 2 minPalo Alto CVE-2026-0300 Actively Exploited
PAN released an advisory about the vulnerability on Tuesday and said it will release a patch in an upcoming version of PAN-OS.
Dennis Fisher · 1 min
Serious Apache Web Server Bug Patched
The vulnerability (CVE-2026-23918) only affects version 2.4.66 and the Apache Software Foundation has released a fix for the bug in version 2.4.67.
Dennis Fisher · 1 minResearchers Warn of Critical cPanel Flaw CVE-2026-41940
cPanel published a terse advisory saying that there was an issue with “session loading and saving” and that it affects every version of the software.
Dennis Fisher · 2 min
Windows CVE-2026-32202 Exploited in the Wild
The current exploits are targeting CVE-2026-32202, a bug in the Windows Shell that allows an attacker to gain access to some sensitive data on the target network.
Dennis Fisher · 2 minStealthy Deep#Door Stealer Targets Windows Machines, Credentials
Deep#Door stealer is being used in intrusions targeting Windows machines, using an obfuscated deployment chain.
Dennis Fisher · 3 min
New Campaign Targets Mac Users With Novel Malware
The campaign targets high-value individuals and organizations in the cryptocurrency, digital assets, and finance sectors.
Dennis Fisher · 2 min
