CVEs that matter, exploitation status and patch guidance without the hype.
Microsoft is investigating reports that a recent security update is severing domain trust relationships, locking users out of enterprise systems even with valid credentials.
Google released its September 2026 security patches addressing 110 vulnerabilities on Pixel devices, including a zero-day in the cellular modem component that attackers are already exploiting in targeted campaigns.
Acronis has released fixes for a high-severity local privilege escalation vulnerability affecting its backup integrations for cPanel, WHM, and Plesk, warning that the flaw is being exploited in limited targeted attacks.
Threat actors are leveraging an unauthenticated vulnerability in a WordPress plugin to deploy PHP webshells and establish persistent access to compromised sites. Wordfence has blocked over 100,000 exploitation attempts.
Cisco has released a patch for a critical vulnerability in its Secure Email Gateway that attackers have been actively exploiting since September 2026. The flaw allows unauthenticated remote attackers to execute commands with root privileges.
Microsoft has issued out-of-band fixes for Remote Desktop Services failures and related issues that emerged following this month's security patches, affecting multiple Windows and Windows Server versions.
Twitch Enhanced Viewer | JeetBot, installed by over 30,000 users across Chrome and Firefox, transmits authentication credentials to a commercial streaming service operated in Russia, leaving tokens exposed in server logs.
A widespread scanning operation is targeting internet-accessible Vite development servers to extract sensitive cloud credentials and configurations, exploiting a high-severity file access bypass vulnerability.
