SonicWall CVE-2026-19868 Exploited to Bypass SAML MFA
SonicWall CVE-2026-19868 lets valid alternate credentials skip SAML and MFA on SSLVPN. It is on CISA KEV. Upgrade to 7.3.4-7013 or 8.2.3-8015.
Read article
Tech News
Industry updates, security alerts, and analysis from an IT professional
How to use this feed
Security news only helps if it tells you what to do next. Each post here covers one vulnerability, breach or vendor change and answers the questions an admin actually has: what is affected, whether attackers are already using it, and what to patch, disable or watch for first.
It is written for the people who keep small and mid-sized networks running: IT generalists, MSP technicians and the admin who has to decide on Monday morning what gets patched first. Background that takes longer to explain than a news post allows lives in the Learn guides, so each story stays focused and links out instead of repeating it.
New to the vocabulary? These are the guides the news posts lean on most:
- What is a zero-day vulnerability?
- Understanding CVE and CVSS scores
- What is Patch Tuesday? Microsoft's monthly security updates
- How to prioritize a record-size Patch Tuesday
- What is remote code execution (RCE)?
- Authentication bypass vulnerabilities explained
- What is ransomware-as-a-service (RaaS)?
- Firewall configuration security best practices
- Microsoft 365 security best practices
- What to do after a data breach
139 Articles
OpenSSH Password Bypass CVE-2026-123158 Exploited on Alpine
An OpenSSH password bypass lets attackers log in to passwordless accounts on Alpine and other musl systems. Update sshd and restart it now.
Read article
Drupal Commerce CVE-2026-118539 Exploited: Audit Your Orders
Drupal Commerce CVE-2026-118539 is being exploited to place fraudulent orders. Upgrade to 3.3.13 or 8.x-2.41, then audit recent orders.
Read article
WordPress CVE-2026-119977: Upgrade Race Hits CISA KEV
WordPress CVE-2026-119977 reached CISA KEV on November 3 with a November 6 deadline. Patch to 7.1.4 or your branch fix and block wp-content/upgrade.
Read article
Siemens IoT2050 Node-RED Flaw CVE-2026-58115 Exploited
Attackers are exploiting the Siemens IoT2050 Node-RED flaw CVE-2026-58115 to run commands as root. Update to V4.3.4.1 and check your flows.
Read article
Ivanti Connect Secure CVE-2026-111357 Fix: Upgrade Again
Ivanti Connect Secure CVE-2026-111357 is patched and in CISA KEV. If you upgraded for the October fix, move to 25.1.1.3 or 22.8R2.6 now.
Read article
Fragnesia CVE-2026-46300 Hits KEV After PAN-OS Root Chain
Fragnesia CVE-2026-46300, a Linux kernel root bug, is in CISA KEV after attackers chained it with PHP2Shell on PAN-OS. Patch and reboot now.
Read article
Adobe Commerce PolyShell CVE-2026-48356 Added to CISA KEV
CISA lists Adobe Commerce PolyShell, CVE-2026-48356, as exploited. Patch to the July 2026 release and check upload folders for planted files.
Read article
Cisco ASA and FTD CVE-2026-76418: Exploited VPN Reload Bug
Cisco says CVE-2026-76418 is exploited: a crafted SSL VPN request reloads ASA and FTD firewalls using secondary authentication. CISA due date: Nov 1.
Read article
GitLab CVE-2026-97229 Added to CISA KEV: Patch by Nov 1
GitLab CVE-2026-97229, a CVSS 10.0 CI regex flaw, is now in CISA KEV with a 1 November deadline. Upgrade self-managed 19.2 to 19.4 today.
Read article
ESXi Logging Zero-Day CVE-2026-41709 Added to CISA KEV
CISA lists ESXi logging zero-day CVE-2026-41709 as exploited. Warp Panda used it to hide admin actions. Patch to the VMSA-2026-0006 builds.
Read article
Brotli CVE-2026-111497 Added to CISA KEV: Patch Every Copy
CISA added Brotli CVE-2026-111497 to KEV. Node.js, Envoy, .NET and Python each bundle the decoder, so every copy needs its own update.
Read article
University of Copenhagen Data Breach Hits 525,000 People
The University of Copenhagen data breach exposed CPR numbers for 525,000 people via a test environment, plus ID card PINs for 20,000. What to do.
Read article
Aruba AOS Vulnerabilities: Eight CVSS 10.0 Flaws Patched
HPE fixed 72 Aruba AOS vulnerabilities, eight rated CVSS 10.0, in AOS-8 and AOS-10. Not exploited yet. Fixed builds, affected trains and workarounds.
Read article
LiteLLM Supply Chain Attack: 1.107.0 Shipped a Stealer
The LiteLLM supply chain attack put a credential stealer in 1.107.0 via an unrevoked master key. Check exposure, rebuild, pin 1.106.2, rotate secrets.
Read article
PHP2Shell Under Attack: Patch PHP 8.2 Through 8.5 Now
PHP2Shell is a pair of critical PHP flaws already drawing exploit attempts. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; workarounds are partial.
Read article
VeloCloud Orchestrator Zero-Day CVE-2026-114625 Exploited
An exploited VeloCloud Orchestrator zero-day lets a read-only user become superuser. Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
Read article
SiteGuard CVE-2026-106931: Exploited WAF Flaw Gives Root
SiteGuard CVE-2026-106931 lets attackers run commands as root or SYSTEM via the WAF's statistics feature. Save diagnostics, then patch.
Read article
Plex2Shell Exploited: Plex Media Server Chain Hits KEV
Plex2Shell chains four Plex Media Server flaws into remote code execution. Attackers are planting miners and proxies, so update to 1.43.3.10861 and check.
Read article
Collabora CVE-2026-110447 Lets Attackers Backdoor Nextcloud
Collabora CVE-2026-110447 let attackers drop web shells on Nextcloud from Sept 10. Upgrade to 26.4.303 or remove the app, then hunt for shells.
Read article
Rank Math PRO 3.0.123 Malware: Updating Is Not Enough
Rank Math PRO malware hit sites that pulled 3.0.123 on Oct 15-16, 2026. Version 3.0.124 is clean, but backdoors stay. Indicators and cleanup steps.
Read article
FortiOS CVE-2025-61624 Exploited to Plant PEERSTITCH Implant
FortiOS CVE-2025-61624 is now in CISA KEV after Unit 42 tied it to PEERSTITCH, a memory-only implant hidden in FortiGate logging and VPN daemons.
Read article
BeyondTrust Remote Support CVE-2026-102764 Exploited
BeyondTrust Remote Support flaw CVE-2026-102764 was exploited as a zero-day since August. Apply BT26-05-RS, hunt off-appliance logs, then rotate credentials.
Read article
Windows Shell CVE-2026-96951 Zero-Day Skips Mark of the Web
Windows Shell CVE-2026-96951 lets crafted files skip Mark of the Web warnings. It is exploited, on CISA KEV, and fixed in October 2026 updates.
Read article