Security briefing · Archive
Vulnerabilities & fixes · Archive
Browse collected headlines by topic and follow links to the original publishers.
Vulnerabilities & fixes
Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.
Ransomware groups expand targeting of Palo Alto Networks vulnerability ↗ (opens in a new tab)
Hackers are using patches to create vulnerability ‘maps’ ↗ (opens in a new tab)
Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk ↗ (opens in a new tab)
API Penetration Testing for Enterprise APIs: Methodology, Scope, and What’s Covered ↗ (opens in a new tab)
Atlassian Arbitrary File Access Vulnerability ↗ (opens in a new tab)
Phishing Sites Impersonating Microsoft Login: Analyzing Domains Suspected of Kimsuky Links ↗ (opens in a new tab)
PSA: Patch your Plex media server before someone hacks it ↗ (opens in a new tab)
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs ↗ (opens in a new tab)
From merchant to issuer: Closing visibility gaps and catching fraud sooner in payment flows ↗ (opens in a new tab)
Signal Messenger Security: A Research Case Study ↗ (opens in a new tab)
Vulnerability in NordVPN software ↗ (opens in a new tab)
Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool ↗ (opens in a new tab)
The First Four-Digit Patch Tuesday. Only One Flaw is Under Attack. ↗ (opens in a new tab)
CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Severity: HIGH) ↗ (opens in a new tab)
AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs ↗ (opens in a new tab)
Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings ↗ (opens in a new tab)
2026-017: Critical Vulnerability in Cisco Secure Email Gateway ↗ (opens in a new tab)
Microsoft Patch Tuesday Fixes 1,413 Flaws: Windows Zero-Day Already Under Attack ↗ (opens in a new tab)
VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic ↗ (opens in a new tab)
Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution ↗ (opens in a new tab)
ALERTĂ: Incident de securitate ce vizează vulnerabilități ale unor instalații frigorifice ↗ (opens in a new tab)
FreeBSD-EN-26:26.hastd ↗ (opens in a new tab)
How to Apply Your Own Vulnerability Scoring in Orca with Custom Agents ↗ (opens in a new tab)
Micropatches released for Windows DNS Server Remote Code Execution Vulnerability (CVE-2026-62878) ↗ (opens in a new tab)
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities ↗ (opens in a new tab)
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951) ↗ (opens in a new tab)
Zero-day kwetsbaarheid in Ivanti Connect Secure: update direct ↗ (opens in a new tab)
What’s old is new: Lightwell discovers novel zero-day vulnerability in core Java framework ↗ (opens in a new tab)
JCTables for Joomla: When "Already Escaped" Means Injectable ↗ (opens in a new tab)
CRA Vulnerability Management: 6 Things You Should Be Doing Now ↗ (opens in a new tab)