Security news
What just happened, and what to check.
Recent incidents and policy changes in the parts of security the outside world can see: certificates, DNS, email authentication, exposed services and domain ownership. Each post sticks to the sourced facts, then turns them into a short list of things to verify on your own domains.
eMudhra's CA Keys Were Single Bytes. About 30,000 Certificates Must Move Before Chrome Drops the Root on October 27.
Eight eMudhra intermediate CA keys turned out to be numbers below 256, crackable in milliseconds. Browsers blocked them within hours, Mozilla and Chrome are removing emSign ECC Root CA - G3, and eMudhra is leaving the TLS business. Who is affected and what to replace by October 27, 2026.
Read article →Two CVSS 10 GitLab Bugs in Ten Days, Both in the Regex Engine: Patch Self-Managed GitLab Now
GitLab fixed two CVSS 10.0 code execution flaws in October 2026, both caused by integer overflows in Ruby's Onigmo regex engine. CVE-2026-110264 needs no login, only a public project. Fixed versions, who is exposed and how to detect attempts.
Read article →BeyondTrust Remote Support Zero-Day Gave a China-Nexus Group Root on the Box That Holds Your Credentials
CVE-2026-102764, an unauthenticated flaw in BeyondTrust Remote Support, was exploited as a zero-day from August 2026 by a suspected China-nexus espionage group. CISA added it to KEV on October 16, 2026. The patch, why patching is not enough, and what to check.
Read article →Stolen FortiGate Configs, Cracked Passwords, Then Root: The FortiOS Bug Behind the PEERSTITCH Implant
CVE-2025-61624, a FortiOS CLI path traversal patched in April 2026, was used to turn stolen admin logins into root on FortiGate firewalls and plant the PEERSTITCH implant. CISA added it to KEV on October 16, 2026. Fixed versions and what to check.
Read article →PHP2Shell: Two Critical PHP Flaws Allow Remote Code Execution, and Attacks Started Before the Patch
CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) let unauthenticated attackers run code on PHP web servers. PHP fixed them in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, after details leaked and exploitation attempts began. Who is at risk, the stopgaps and what to check.
Read article →Atlassian File Read Flaw Hits Jira, Confluence and Six More Data Center Products. Attacks Started Within Hours.
CVE-2026-21589 lets unauthenticated attackers read files from the web root of Jira, Confluence, Bitbucket, Bamboo, Crowd and Fisheye/Crucible Data Center. Exploitation attempts began within two hours of public details, and CISA added it to KEV on October 15, 2026. Fixed versions and what to check.
Read article →PAN-OS Management Interface Flaw Gives Root on Palo Alto Firewalls, and It Is Already Exploited
CVE-2026-0322 lets an authenticated attacker run code as root through the PAN-OS management interface. Palo Alto Networks patched it on October 14, 2026 after seeing exploitation, and CISA added it to KEV the same day. Fixed releases and what to check.
Read article →Ivanti Connect Secure Zero-Day Hit a Fully Patched VPN, and Ivanti's Integrity Checker May Not See It
CVE-2026-104935, an unauthenticated authentication bypass and command execution flaw in Ivanti Connect Secure, was exploited as a zero-day and added to CISA's KEV catalog on October 13, 2026. Fixed builds, why the Integrity Checker may miss it, and what to check.
Read article →An 11-Year-Old ProFTPD Bug Just Joined CISA's KEV List. Chinese State-Linked Hackers Used It.
CVE-2015-3306, the 2015 ProFTPD mod_copy flaw that lets anyone copy files without logging in, was added to CISA's KEV catalog on October 8, 2026 after a joint advisory listed it among CVEs exploited by China-linked actors. What is affected and how to check.
Read article →FortiMail Zero-Day Lets Attackers Write Files to Mail Gateways Without Logging In
CVE-2026-104286, a CVSS 9.8 path traversal in Fortinet FortiMail's IBE feature, was exploited as a zero-day and added to CISA's KEV catalog on October 1, 2026. Affected and fixed versions, the workaround, and the indicators Fortinet published.
Read article →A New NetScaler Zero-Day Is Crashing Appliances Already Patched for Last Week's Bugs
CVE-2026-88779, a memory overflow in NetScaler ADC and Gateway configured for SAML, was exploited to crash appliances running the builds that fixed CVE-2026-88771. CISA added it to KEV on October 4, 2026. Fixed builds and what to check.
Read article →Two NetScaler Zero-Days Were Exploited for Weeks Before Citrix Patched Them
Citrix disclosed eight NetScaler ADC and Gateway flaws on September 27, 2026, including two unauthenticated RCE bugs (CVE-2026-88771, CVE-2026-88772, CVSS 9.5) already exploited as zero-days. CISA added both to KEV the same day. Fixed builds and what to check.
Read article →UpGuard Found 16,326 Supabase Databases Readable With the Key Their Own Websites Publish
UpGuard's September 25, 2026 study of about 300,000 sites using Supabase found 16,326 databases serving readable tables to anyone with the public key, more than half with signs of personal data. Why an exposure scan of your own hosts will not find this, and what will.
Read article →third-party.com Looked Like example.com for Years. It Was Never Reserved, and Now It Serves ClickFix.
Manifold Security found that third-party.com, a placeholder hostname in W3C specs, Chromium docs and over 1,700 GitHub repositories, has served a fake Cloudflare check that pushes a PowerShell payload since at least June 2026. Why every domain your code names is part of your attack surface.
Read article →Arista VeloCloud Orchestrator Zero-Day (CVSS 10.0) Exploited, and Two Release Trains Have No Fix Yet
CVE-2026-93952 in on-premises Arista VeloCloud Orchestrator (CVSS 3.1 10.0) is exploited and on CISA KEV since September 22, 2026. Fixes exist for 5.2.3 and 6.4.2 only. Affected versions, indicators and what to check.
Read article →F5 BIG-IP APM and Check Point VPN Gateways Hit by Pre-Auth Exploits in the Same Week
On September 22, 2026 CISA added an exploited F5 BIG-IP APM zero-day (CVE-2026-94127, CVSS 9.8) and two exploited Check Point flaws (CVE-2026-85102, CVE-2026-93616) to its KEV catalog. Affected versions, fixes and what to check.
Read article →Elsevier's Domains Pointed at a LAPSUS$ Page for Over an Hour. The Servers Were Never the Target.
On September 21, 2026 www.elsevier.com, evolve.elsevier.com and submit.elsevier.com redirected visitors to a LAPSUS$-branded extortion page for at least 78 minutes. The mechanism is unconfirmed, but it points at the DNS or CDN edge. What that means for your own domains.
Read article →Nearly 1,000 Zyxel GS1900 Switches Hacked Through a Bug Rated "LAN Only"
CVE-2026-7273, a pre-auth stack overflow in Zyxel GS1900 switches patched in June 2026, was used to compromise 996 switches in 48 countries. CISA added it to the KEV on September 21. Affected firmware, fixes and what to check.
Read article →A Leaked Cloudflare Key Turned Brevo's Embedded Scripts Into Malware on 100,000 Sites
On September 14, 2026 an attacker used a hardcoded Cloudflare API key to put a Worker in front of Brevo's forms, chat and SDK scripts, serving ClickFix malware to visitors of Brevo customers' websites for hours. What happened and what to check on your own pages.
Read article →GitLab's CVSS 10 File-Read Bug Was Exploited a Day After the Patch
CVE-2026-85706 lets an unauthenticated attacker read arbitrary files from a self-managed GitLab server. GitLab patched it on September 10, 2026; CISA listed it as exploited on September 11. Versions, fixes and what to check.
Read article →Cisco Firewall Management Center and FortiGate Firewalls Exploited: Two Old Patches Become Three-Day Deadlines
On September 9, 2026 CISA added Cisco Secure FMC CVE-2026-20079 (CVSS 10.0) and Fortinet FortiOS CVE-2025-25249 to its KEV catalog. Both were patched months ago and are now exploited. Affected and fixed versions, and what to check.
Read article →Citrix NetScaler Auth Bypass CVE-2026-19490 Is Now Exploited. CISA Gave Agencies Three Days.
CVE-2026-19490, a CVSS 9.3 authentication bypass in NetScaler ADC and Gateway, was added to CISA's KEV catalog on September 9, 2026 after exploitation attempts began. Affected builds, fixed builds and how to check your exposure.
Read article →N-able N-central Pre-Auth RCE Exploited on Fully Patched Servers. Hotfix 3 Is Not Enough.
CVE-2026-86218 is an exploited pre-authentication RCE in N-able N-central before 2026.3.1.14 (CVSS 4.0 10.0). CISA added it to the KEV on September 8, 2026. What happened, which hotfix you need, and how to check exposure.
Read article →StyleSmuggler: Unauthenticated RCE in Magento and Adobe Commerce Was Exploited Three Days Before the Patch
CVE-2026-75650 (StyleSmuggler, CVSS 10.0) gives unauthenticated remote code execution on Adobe Commerce and Magento Open Source 2.4.4 to 2.4.9. Exploited from September 4, patched September 7, added to CISA KEV September 8. Versions, hotfix and what to check.
Read article →Microsoft 365 Was Down for 67 Hours. Admins Traced It to an Expired Certificate.
From August 31 to September 3, 2026, Exchange Online, Teams and SharePoint failed worldwide. Microsoft blamed a core authentication configuration; admins saw an expired certificate thumbprint in the errors. What to check on your own domains.
Read article →CISA Adds Seven Exploited Flaws in One Day. Two Score a Perfect 10, All Sit on Internet-Facing Software.
On September 2, 2026 CISA added seven actively exploited CVEs to its KEV catalog, including a CVSS 10 SonicWall SMA 1000 flaw and a CVSS 10 Kestra bug. Under BOD 26-04, publicly exposed assets get three days. How to know what you expose.
Read article →One in Five New Domain Registrations Is Someone's Expired Domain, and Criminals Are Paying Millions for Them
Infoblox Threat Intel found about 65,000 expired domains re-registered every day in the first half of 2026, and one actor, Sable Squirrel, holding 10,000 of them for malware C2, gambling and piracy. Why your lapsed domains are an attack surface.
Read article →As of June 15, Every Public TLS Certificate Goes Into a Transparency Log. Your Hostnames Are Now Public.
Chrome Root Program Policy v1.8 requires every CA to log every TLS precertificate and certificate to Certificate Transparency from June 15, 2026. DigiCert enforced it June 1. The opt-out is gone: what that exposes, and how to use it.
Read article →Let's Encrypt Stopped Issuing for Two and a Half Hours. Did Your Renewals Notice?
On May 8, 2026 Let's Encrypt halted all issuance for about 2.5 hours after its new Generation Y cross-signed intermediates shipped without the serverAuth EKU. Renewals failed with serverInternal. What a quiet renewal failure looks like on your side.
Read article →CoW Swap Lost $1.2 Million to a Domain Hijack That Never Touched Its Servers
On April 14, 2026 attackers took over cow.fi through the .fi registration process using forged identity documents, pointed swap.cow.fi at a wallet-draining clone and stole about $1.2M. Backend untouched. What the DNS and certificate signals looked like.
Read article →Microsoft: Phishing Crews Are Spoofing Domains That Have DMARC, Through Gaps in Mail Routing
Microsoft's January 6, 2026 report shows Tycoon2FA phishing campaigns sending mail as an organization's own domain and getting through despite SPF and DMARC, because third-party routing broke enforcement. Microsoft blocked 13M such emails in one month.
Read article →