[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongVulnerability Management
Cisco Discloses Critical Flaws in Nexus Switches
Cisco has uncovered five critical vulnerabilities in its Nexus switches that could let hackers run malicious code with root access or bring down entire networks, causing major disruptions. This security threat affects Nexus 3000 and 9000 Series switches, putting your network at risk of remote code execution and denial-of-service attacks.
SonicWall Fixes CVSS 10.0 Flaw in SMA1000 Appliances
SonicWall has patched a critical security flaw in its SMA1000 appliances that could let attackers infiltrate internal systems and run unauthorized operations. The bug, rated 10.0 on the CVSS scale, can be exploited before login, making it a high-risk vulnerability.
Microsoft Outlook to Block MSIX Attachments in Security Push
Microsoft is bolstering security in Outlook on the web and Windows by blocking MSIX attachments, including .msix and .msixbundle file types, to protect users from potential threats. This update will be applied to the default list of blocked file types, enhancing overall security in the platform.
Agentic Pentesting Targets Validation Gap in Cyber Defenses
The threat landscape is evolving at an alarming rate: a 49.5% surge in CVEs reported in the first half of 2026, with exploits now emerging in as little as eight hours. This means traditional cyber defense validation methods are being outpaced by the speed and volume of attacks.
SonicWall Disrupts SSRF Flaw in SMA1000 Gateways
Don't let your SonicWall SMA1000 gateways become an open door for hackers - a critical SSRF flaw, CVE-2026-102255, has been discovered, allowing attackers to make internal requests without authorization, and hotfixes are available to patch this vulnerability. Over 400 Internet-exposed appliances are currently at risk, making immediate action crucial.
Anthropic Expands AI Access for Cyber Teams After Finding 129,000 Flaws
Anthropic is supercharging cyber teams with expanded access to its AI models, following a staggering discovery of 129,000 flaws - with over 33,000 rated critical or high-severity. The company's Cyber Verification Program now offers tiered access to advanced models like Claude Opus 5.5, empowering teams to tackle vulnerabilities head-on.
Australia Grapples with Legacy IT Security Risks as AI Threats Escalate
Australia's ageing IT systems are a ticking time bomb, and AI-powered threats are making it easier for cyber attackers to exploit weaknesses, putting the entire nation at risk. The Department of Home Affairs has stepped in, ordering a national stocktake of legacy technology to identify and mitigate these vulnerabilities.
Anthropic Overhauls Cyber Verification Program
Anthropic is shaking up its approach to cybersecurity with a major overhaul of its Cyber Verification Program, combining it with Project Glasswing to supercharge security efforts. The move follows a successful six-month trial that helped partners uncover over 129,000 verified software vulnerabilities.
Atlassian Warns of File-Access Flaw in Jira, Confluence Products
A critical file-access flaw has been discovered in various Atlassian products, including Jira and Confluence, allowing unauthenticated attackers to access sensitive files. To stay safe, ensure you're running the latest versions: Bitbucket Data Center 9.4.26 or later, Confluence Data Center 9.2.26 or later, and more.
Microsoft expands Outlook restrictions to block two more file types
Microsoft is taking a firmer stance on email attachments, adding two new file types to Outlook's restricted list in a bid to boost security and keep users safe. This move is the latest effort to crack down on potentially hazardous files.
Red Hat's Lightwell Project Tackles 400 Open-Source Flaws
Red Hat's Lightwell project has made a significant impact, remediating over 400 novel vulnerabilities in key Java libraries since its launch in June. This crucial initiative helps protect against the rapidly evolving threat landscape, where AI-powered tools can quickly exploit old code.
LibreOffice, OpenOffice Flaws Expose Users to Code Execution Risk
A newly discovered flaw in LibreOffice and OpenOffice could put users at risk of code execution, allowing attackers to run malicious Java code simply by opening a specially crafted spreadsheet. Fortunately, LibreOffice has already patched the vulnerability, tracked as CVE-2026-63277, in updates released on October 5.
Google Halts Open-Source Bug Bounty Payouts Amid Automated Report Surge
Google is hitting the pause button on its open-source bug bounty program due to a surge in automated submissions, most of which are invalid. The temporary suspension will be revisited in 2027 with a revamped program.
Security Researcher Exposes KVM Guest-Host Escape Flaw
A security researcher has uncovered a potential vulnerability in KVM, a widely-used virtualization technology, that could allow attackers to break free from virtual machines and wreak havoc on host systems. This claimed guest-host escape flaw has sent shockwaves through the cybersecurity community.
Atlassian Flaw Exposes File Data Across Multiple Products
A critical security flaw, rated 9.3 out of 10, has been discovered in multiple Atlassian products, allowing unauthenticated attackers to access sensitive files. This vulnerability, known as CVE-2026-21589, poses a significant risk to self-hosted Data Center products if exploited.
Atlassian Warns of File Access Flaw in Datacenter Products
Atlassian has sounded the alarm on a critical file access flaw in its datacenter products, putting customers at risk - but what does this mean for your business? A critical vulnerability has been discovered, and it's essential to take action to protect your data.
[SPONSOREDNUBIVANCE]
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
Security Researcher Uncovers KVM Guest-Host Escape Flaw
A security researcher has uncovered a critical vulnerability that allows hackers to break free from virtual confines, exploiting a flaw in KVM that enables a malicious guest to escape and compromise the host system. This alarming guest-host escape flaw has significant implications for virtualized environments.
Microsoft Exchange Flaw Exposes Mailboxes to Authenticated Attackers
A newly discovered flaw in Microsoft Exchange Server could put your mailboxes at risk, allowing authenticated attackers to elevate their privileges and gain unauthorized access across your network. Microsoft has urgently released a security update to patch this high-severity vulnerability, rated 8.8 on the CVSS scale.
Debian kernel update patches 1,313 vulnerabilities
Debian just dropped a massive kernel security update that tackles a staggering 1,313 vulnerabilities - that's a huge patch to keep your system safe and secure! Get the details on the update and why it matters.
Dell Flaw Exposes Root Privileges to Hackers
Dell's System Update tool has a critical flaw that could let hackers gain total control of your system - and all it takes is remote access to get started. This vulnerability, tracked as CVE-2026-86360, is a serious threat that could allow attackers to execute code with root privileges.
Google Halts Open-Source Bug Bounty Over AI Flaw Reports
Google is hitting the pause button on its Open Source Vulnerability Rewards Program due to a surge in automated, invalid submissions, and won't resume until 2027. The program, launched in 2022, aimed to reward researchers for identifying vulnerabilities in Google's open-source software projects.
Exploits Target Rejetto HFS Flaw for Admin Access
A critical flaw in Rejetto HFS, tracked as CVE-2026-61500, allows hackers to gain admin access by exploiting a weak pseudo-random number generator that generates session-cookie signing keys. This vulnerability, with a CVSS score of 9.3, puts users at risk of session forgery attacks.
Microsoft Update Disrupts Games, Apps With Dolby Digital Audio
If you're experiencing frustrating crashes with your favorite games and apps that use Dolby Digital Audio, you're not alone - a recent Windows 11 update (KB5124010) is causing issues with programs that rely on AC-3 audio decoding. This update can cause apps to fail to launch, shut down unexpectedly, or work fine until certain audio features are used.
Google Suspends Open-Source Bug Bounty Program Amid AI-Generated Spam Surge
Google is hitting the pause button on its Open Source Software Vulnerability Rewards Program, temporarily stopping new product vulnerability submissions due to a surge in AI-generated spam. This change doesn't affect existing reports or supply chain submissions.