India's cybersecurity agency CERT-In has warned that “Multiple vulnerabilities have been reported in the Android operating system”. It has rated them “CRITICAL” in its latest vulnerability note, issued on November 4, 2026. The flaws affect Android versions 14, 15, 16, 16-qpr2 and 17. The advisory is aimed…
CISA flags WordPress RCE flaw as actively exploited in attacks Hackers use n-day exploits in zero-click attacks on iOS, Android devices Vercel rolls out new protection against stolen session cookie attacks Zyxel fixes zero-day exploited to hack nearly 1,000 network switches…
This post covers what happened after the disclosure, based on what our team observed directly. php2shell got big fast. Details of the vulnerabilities leaked online before the official release. Within two days, the vulnerability had a name, a logo and coverage…
Three medium Plex bugs handed attackers the admin access a fourth, high severity flaw needed. Live exploitation followed the exploit by a day. Exploit code went live on a Friday. By Saturday morning, attackers were already inside Plex Media Servers,…
Which of PHP2Shell, Node2Shell, Plex2Shell, the CVSS 10 GitLab bug and eMudhra’s CA keys are exploited in the wild, what’s fixed, and what’s still open. Between 16 and 23 October, five major security incidents went public in a single week: two remote code execution bugs in…
Drupal has patched two critical remote code execution flaws that affect every currently supported version of its core, and the security team is telling administrators that working exploits could appear within hours or days. The two issues are CVE-2026-108097, in…
A Fiverr buyer messaged me just after midnight. He needed "a senior developer with AI and web experience" to fix the invoice generation in an AI invoice app that another freelancer had built. The project looked normal. But one line…
A vulnerability in the APT package manager lets attackers intercept communications between Linux systems and package repositories, install malicious packages, and execute code with root privileges. This flaw, tracked as CVE-2026-109518, affects Debian, Ubuntu, and their derivative distributions under certain…
CISA added a WordPress Core flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 3, and federal civilian agencies have until November 6 to patch it. The bug, CVE-2026-119977, is a time-of-check to time-of-use (TOCTOU) race condition in the full-package core…
Ivanti lists 3 vulnerabilities, all exploited together in the wild, and says exploitation affected "a limited number of customers at the time of disclosure" when chained. Affected builds are 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. For CVE-2026-104935, Ivanti states that…
High-impact vulnerabilities, emergency patches, supply-chain incidents, and mitigations.
An article joins this feed when it matches these terms. Each one is also a search of its own.