Chrome Zero-Day CVE-2026-125350 Exploited in XML Parser
Chrome zero-day CVE-2026-125350, a use-after-free in XML, is exploited in the wild. Update to 157.0.8103.50 before CISA's November 24 deadline.
Read article
Tech News
Industry updates, security alerts, and analysis from an IT professional
How to use this feed
Security news only helps if it tells you what to do next. Each post here covers one vulnerability, breach or vendor change and answers the questions an admin actually has: what is affected, whether attackers are already using it, and what to patch, disable or watch for first.
It is written for the people who keep small and mid-sized networks running: IT generalists, MSP technicians and the admin who has to decide on Monday morning what gets patched first. Background that takes longer to explain than a news post allows lives in the Learn guides, so each story stays focused and links out instead of repeating it.
New to the vocabulary? These are the guides the news posts lean on most:
- What is a zero-day vulnerability?
- Understanding CVE and CVSS scores
- What is Patch Tuesday? Microsoft's monthly security updates
- How to prioritize a record-size Patch Tuesday
- What is remote code execution (RCE)?
- Authentication bypass vulnerabilities explained
- What is ransomware-as-a-service (RaaS)?
- Firewall configuration security best practices
- Microsoft 365 security best practices
- What to do after a data breach
146 Articles
Outlook Zero-Day CVE-2026-124194 Leaks NTLM Hashes
Exploited Outlook zero-day CVE-2026-124194 leaks NTLMv2 hashes via a crafted message file. The fix ships in Office updates, not the Windows update.
Read article
FreeSWITCH CVE-2026-116779: Patch 1.11.3 Now
FreeSWITCH CVE-2026-116779 is exploited in the wild. Upgrade to 1.11.3, reduce SIP exposure, and complete compromise triage now.
Read article
Barracuda ESG CVE-2026-116606 Exploited, Added to CISA KEV
Barracuda ESG CVE-2026-116606 is exploited in a chain that reaches root. CISA set a November 13 deadline. Patch now and lock down the admin interface.
Read article
GPUStack CVE-2026-102895 Auth Bypass Added to CISA KEV
GPUStack CVE-2026-102895 gives unauthenticated attackers admin access and is exploited. Upgrade to 2.2.2 and hunt for rogue API keys and backends.
Read article
Refrigeration Controller Attacks Prompt CISA and FBI Warning
Refrigeration controller attacks hit Dutch shops and French blood stores. CISA, FBI, HHS, USDA and DOT urge cutting internet access and changing passwords.
Read article
Apple CVE-2024-27834 Added to CISA KEV After APT29 Attacks
CISA added Apple CVE-2024-27834, a 2024 Pointer Authentication bypass, to KEV after an APT29-linked campaign used it on iPhones still running iOS 16.
Read article
SonicWall CVE-2026-19868 Exploited to Bypass SAML MFA
SonicWall CVE-2026-19868 lets valid alternate credentials skip SAML and MFA on SSLVPN. It is on CISA KEV. Upgrade to 7.3.4-7013 or 8.2.3-8015.
Read article
OpenSSH Password Bypass CVE-2026-123158 Exploited on Alpine
An OpenSSH password bypass lets attackers log in to passwordless accounts on Alpine and other musl systems. Update sshd and restart it now.
Read article
Drupal Commerce CVE-2026-118539 Exploited: Audit Your Orders
Drupal Commerce CVE-2026-118539 is being exploited to place fraudulent orders. Upgrade to 3.3.13 or 8.x-2.41, then audit recent orders.
Read article
WordPress CVE-2026-119977: Upgrade Race Hits CISA KEV
WordPress CVE-2026-119977 reached CISA KEV on November 3 with a November 6 deadline. Patch to 7.1.4 or your branch fix and block wp-content/upgrade.
Read article
Siemens IoT2050 Node-RED Flaw CVE-2026-58115 Exploited
Attackers are exploiting the Siemens IoT2050 Node-RED flaw CVE-2026-58115 to run commands as root. Update to V4.3.4.1 and check your flows.
Read article
Ivanti Connect Secure CVE-2026-111357 Fix: Upgrade Again
Ivanti Connect Secure CVE-2026-111357 is patched and in CISA KEV. If you upgraded for the October fix, move to 25.1.1.3 or 22.8R2.6 now.
Read article
Fragnesia CVE-2026-46300 Hits KEV After PAN-OS Root Chain
Fragnesia CVE-2026-46300, a Linux kernel root bug, is in CISA KEV after attackers chained it with PHP2Shell on PAN-OS. Patch and reboot now.
Read article
Adobe Commerce PolyShell CVE-2026-48356 Added to CISA KEV
CISA lists Adobe Commerce PolyShell, CVE-2026-48356, as exploited. Patch to the July 2026 release and check upload folders for planted files.
Read article
Cisco ASA and FTD CVE-2026-76418: Exploited VPN Reload Bug
Cisco says CVE-2026-76418 is exploited: a crafted SSL VPN request reloads ASA and FTD firewalls using secondary authentication. CISA due date: Nov 1.
Read article
GitLab CVE-2026-97229 Added to CISA KEV: Patch by Nov 1
GitLab CVE-2026-97229, a CVSS 10.0 CI regex flaw, is now in CISA KEV with a 1 November deadline. Upgrade self-managed 19.2 to 19.4 today.
Read article
ESXi Logging Zero-Day CVE-2026-41709 Added to CISA KEV
CISA lists ESXi logging zero-day CVE-2026-41709 as exploited. Warp Panda used it to hide admin actions. Patch to the VMSA-2026-0006 builds.
Read article
Brotli CVE-2026-111497 Added to CISA KEV: Patch Every Copy
CISA added Brotli CVE-2026-111497 to KEV. Node.js, Envoy, .NET and Python each bundle the decoder, so every copy needs its own update.
Read article
University of Copenhagen Data Breach Hits 525,000 People
The University of Copenhagen data breach exposed CPR numbers for 525,000 people via a test environment, plus ID card PINs for 20,000. What to do.
Read article
Aruba AOS Vulnerabilities: Eight CVSS 10.0 Flaws Patched
HPE fixed 72 Aruba AOS vulnerabilities, eight rated CVSS 10.0, in AOS-8 and AOS-10. Not exploited yet. Fixed builds, affected trains and workarounds.
Read article
LiteLLM Supply Chain Attack: 1.107.0 Shipped a Stealer
The LiteLLM supply chain attack put a credential stealer in 1.107.0 via an unrevoked master key. Check exposure, rebuild, pin 1.106.2, rotate secrets.
Read article
PHP2Shell Under Attack: Patch PHP 8.2 Through 8.5 Now
PHP2Shell is a pair of critical PHP flaws already drawing exploit attempts. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; workarounds are partial.
Read article
VeloCloud Orchestrator Zero-Day CVE-2026-114625 Exploited
An exploited VeloCloud Orchestrator zero-day lets a read-only user become superuser. Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
Read article