CVEs that matter, exploitation status and patch guidance without the hype.
Law enforcement warns that attackers continue exploiting a massive Fortinet credentials leak to lock out legitimate administrators from FortiGate firewalls and SSL VPN gateways, with ransomware groups leveraging the compromised access.
Microsoft is expanding its attachment security controls by blocking .msix and .msixbundle files in Outlook Web and the new Windows client, part of a broader campaign to prevent attackers from exploiting installation package formats.
A critical file-access vulnerability in Jira, Confluence, Bitbucket and other Atlassian products is being weaponized in the wild within hours of public proof-of-concept release, with automated scanning tools already deployed.
SonicWall has issued hotfixes for a maximum-severity server-side request forgery vulnerability affecting SMA1000 series appliances, with over 400 exposed instances currently tracked online.
Two widely deployed WordPress plugins are being actively exploited to install hidden admin accounts and malicious backdoors that persist even after plugin removal.
Competing security researchers demonstrated vulnerabilities across seven product categories on the opening day of the annual hacking competition, with Samsung's flagship phone targeted twice and total payouts reaching $388,500.
Atlassian has released fixes for CVE-2026-21589, a critical vulnerability affecting self-hosted versions of Confluence, Jira, Bitbucket and other Data Center products that permits unauthenticated file access.
Security researchers have detected active scanning for CVE-2026-61500, a critical vulnerability in Rejetto HFS that enables session forgery and remote code execution through a weak cryptographic signing mechanism.
