Tag
Vulnerability
41 stories since Oct 2025.
- 41
- stories
- OCT 20
- latest
All Vulnerability · page 2
Researchers Warn of Critical cPanel Flaw CVE-2026-41940
cPanel published a terse advisory saying that there was an issue with “session loading and saving” and that it affects every version of the software.
Dennis Fisher · 2 min
Windows CVE-2026-32202 Exploited in the Wild
The current exploits are targeting CVE-2026-32202, a bug in the Windows Shell that allows an attacker to gain access to some sensitive data on the target network.
Dennis Fisher · 2 min
Cisco CVE-2026-20133 Targeted in Active Attacks
The three newly added bugs are CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133, the last of which had not been identified in active attacks before.
Dennis Fisher · 2 min
Myths and Mythos: An AI Vulnerability Research FAQ
It’s still very early days for all of this, and relatively little is known about Claude Mythos’s real capabilities, so we wanted to dig into what actually is known and what it all means.
Dennis Fisher · 6 min
Fortinet CVE-2026-35616 Actively Exploited
The company published an advisory on Saturday and urged all customers who are running affected versions of the software to install the hotfix as quickly as possible. The bug affects versions 7.4.5 and 7.4.6 of FortiClient EMS.
Dennis Fisher · 1 min
Command Injection Bug in OpenAI Codex Exposed GitHub OAuth Tokens
The bug is a command injection issue and lies in the way that Codex processed GitHub branch names during the execution of tasks.
Dennis Fisher · 3 min
Google: Commercial Surveillance Vendors Dominated Zero-Day Exploitation in 2025
Out of 42 unique zero days tracked by Google in 2025, 18 were attributed to CSVs, while 15 were linked to state-sponsored espionage groups.
Decipher · 3 min
Q&A: Tod Beardsley on How to Use CISA’s KEV Catalog
Without context, the KEV catalog is just a very large collection of data. Tod Beardsley is the former CISA KEV section chief, and he recently released a paper called KEVology that provides key context and evaluates the value of certain enrichment signals.
Dennis Fisher · 4 min
Cisco, NSA Warn of Attacks Targeting Catalyst SD-WAN Zero Day
Cisco released software updates on Feb. 25 to fix the vulnerability, which affects both on-premises and cloud deployments of the Catalyst SD-WAN Controller.
Dennis Fisher · 2 min
Apple Patches iOS Zero Day CVE-2026-20700
That vulnerability also was patched in macOS, but the active exploitation that Apple disclosed was against iOS only.
Dennis Fisher · 1 min
Cybercrime and APT Groups Exploiting WinRAR Bug
Exploitation of CVE-2025-8088 in the wild began before disclosure, with attacks confirmed as early as July 18, 2025.
Dennis Fisher · 4 min
Microsoft Releases Emergency Patch for CVE-2026-21509
The vulnerability (CVE-2026-21509) requires user interaction for an attack to succeed, with the most likely vector being an attacker sending a malicious Office file to a victim, who then opens it.
Dennis Fisher · 1 minCisco Fixes Unified Communications RCE Flaw Under Attack
Threat actors are attempting to exploit the Cisco remote code execution flaw (CVE-2026-20045) in the wild, according to a new security advisory.
Decipher · 2 minFortinet FortiGate Devices Targeted in New Campaign
This activity shares some similarities with a campaign that researchers at Arctic Wolf identified in December. That campaign started soon after Fortinet disclosed two authentication bypass flaws (CVE-2025-59718 and CVE-2025-59719).
Dennis Fisher · 3 minHigh-Risk Authentication Bypass Flaw Found in Telnetd
The flaw is in the way that the telnetd server handles some specific user-supplied data. An attacker who exploits this vulnerability would be able to bypass the authentication path and gain root privileges.
Dennis Fisher · 1 min
‘We Fail a Lot’: How Two Security Pioneers Keep Innovating
From their roles as the driving forces behind pioneering web appsec firm WhiteHat Security to building out enterprise security programs to breaking large portions of the web, Jeremiah Grossman and Robert Hansen have unique viewpoints on what works and what doesn’t.
Dennis Fisher · 1 min
React2Shell Attacks Continue to Build
After a peak of more than 430,000 attack sessions in late December, daily volumes targeting React2Shell have stabilized in the 300,000 to 400,000 range.
Dennis Fisher · 1 min
Serious MongoDB Flaw CVE-2025-14847 Under Exploitation
MongoDB disclosed the vulnerability (CVE-2025-14847) on Dec. 19 and a few days later, a public exploit for it appeared online.
Dennis Fisher · 1 min
Broad Exploit Activity Targets React2Shell Flaw
The vulnerability was disclosed publicly on Dec. 3 and researchers and threat intelligence teams immediately began seeing opportunistic and targeted exploitation attempts.
Dennis Fisher · 3 min
Critical Flaw CVE-2025-55182 Affects React Server Components
All developers using React Server Components are urged to upgrade immediately, and some apps that don’t include React Server Function endpoints could be vulnerable, as well.
Dennis Fisher · 2 min