[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentVulnerability Management
File Notification Flaws Expose System Data Across Major Operating Systems
Major operating systems, including Linux, Android, Windows, and macOS, are vulnerable to file notification flaws that can expose sensitive system data, thanks to decades-old bugs in their file-notification subsystems. These flaws can leak timing and path information about file activity, putting users at risk.
Ubuntu Accelerates Kernel Releases Amid CVE Surge
Canonical is shaking up its Ubuntu kernel release schedule to keep pace with the rapidly evolving threat landscape, introducing overlapping two-week cycles that will allow for weekly kernel releases. This move aims to get security patches and updates to users faster, addressing the surge in Common Vulnerabilities and Exposures (CVEs).
CISA Overhauls CVE Program with Quality-Focused Framework
The CVE Program is getting a major overhaul with a quality-focused framework, marking a new era of prioritizing reliability, responsiveness, and top-notch vulnerability data. CISA is leading the charge by defining quality across four key dimensions: program governance, ecosystem participation, data infrastructure, and CVE record content.
Microsoft Releases KB5124010 Update, Bolsters Windows 11 with 46 Fixes
Microsoft just dropped the KB5124010 update, packing it with 46 fixes and tweaks that supercharge Windows 11 with exciting new features, smoother accessibility, and seamless Bluetooth and backup performance. This optional update is a sneak peek at what's to come in next month's Patch Tuesday release, giving you a taste of the improvements ahead.
Microsoft Fixes File History Backup Bug in Windows Updates
Microsoft's September 2026 security update caused a frustrating problem for some Windows users: File History, a built-in backup feature, stopped working, leaving users unable to create or restore backups. Fortunately, the tech giant has now fixed this bug.
CISA Unveils Plan to Boost CVE Program Quality
The Cybersecurity and Infrastructure Security Agency (CISA) is taking its CVE Program to the next level with a new plan to boost quality, accuracy, and consistency, ensuring organizations have a reliable catalog of software and product vulnerabilities to build on. This Quality Era marks a major milestone in CISA's 25-year commitment to leading and growing the program.
Kubernetes Flaw Exposes GCP Organizations to Privilege Escalation
Google downplays a Kubernetes flaw dubbed ConfigConfusion, which researchers say could allow privilege escalation in GCP organizations, as simply "working as designed" despite concerns from the security community. The issue arises from a handoff in authority between GitOps and Google Kubernetes Config Connector.
cPanel Flaw Lets Hosting Accounts Run Code as Root
A critical cPanel flaw gives any hosting account user unrestricted power over the server, allowing them to run code as root and take full control. This urgent vulnerability was disclosed by cPanel on September 22, along with two other significant security issues.
Next.js Flaw Exposes Servers to Code Execution via ImageResponse
A vulnerability in Next.js's ImageResponse feature, powered by the Satori library, allows attackers to inject malicious code by passing tainted values into image generation, putting servers at risk of code execution. This flaw can be exploited when attacker-controlled values are inserted into SVG content, attributes, or styles during image creation.
WordPress Patches Flaw That Enables Code Execution on Vulnerable Servers
WordPress has patched a critical vulnerability (CVE-2026-87902) that could allow hackers to execute malicious code on susceptible servers, giving attackers an easy way to take control. This flaw, rated 9.2 on the CVSS scale, can be exploited without an account or user interaction.
Bifrost AI Gateway Flaw Exposes Servers to Remote Command Execution
A critical flaw in the Bifrost AI Gateway, known as CVE-2026-90898, allows hackers to execute remote commands on servers with just one simple HTTP request, putting sensitive data at risk. This severe vulnerability has a CVSS score of 9.8, highlighting the urgent need for a fix.
SharePoint Flaw Enables Authenticated Remote Code Execution
A newly discovered flaw in SharePoint, initially downplayed by Microsoft as a minor spoofing issue, has been revealed to be a critical vulnerability that allows authenticated attackers to execute remote code, putting systems at risk. This vulnerability, tracked as CVE-2026-65660, has a much higher severity score of 8, underscoring the urgent need for patching.
Linux Flaw Exposes Host Memory to ARM64 KVM Guests
A newly discovered Linux flaw, CVE-2026-89775, puts host memory at risk by allowing ARM64 KVM guests to access and modify it, potentially enabling a guest to break free from its virtual machine and run code on the underlying machine. This vulnerability, found in the Linux kernel's KVM nested-virtualization code, has not yet been exploited, but poses a significant threat to host security.
WordPress Flaw Exposes Sites to Code Execution via Comment
A cleverly crafted comment can turn into a powerful attack tool, allowing hackers to execute code on vulnerable WordPress sites - and it's all because moderation isn't a foolproof security measure. This surprising vulnerability, dubbed Comment2Shell, highlights a gap in WordPress's defenses that can be exploited with just a simple comment.
Anthropic's AI Finds Flaws, But Attackers Shrug
Despite uncovering 225 vulnerabilities linked to Anthropic's AI, only one has been exploited in the wild, raising questions about the real threat level of these flaws. The vast majority of discovered vulnerabilities seem to be falling on deaf ears with attackers.
Meta's Muse AI app flaw enables local malware to hijack dictation traffic
A security researcher has uncovered a flaw in Meta's Muse AI app that allows local malware to hijack dictation traffic, contradicting the company's claim that users are in control of their data. This vulnerability, demonstrated in a proof-of-concept, enables attackers to intercept dictation data without needing special privileges.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Microsoft Resolves Excel Copy-Paste Issue After Security Updates
Microsoft has fixed a frustrating issue in Excel where copying and pasting data would fail silently, leaving users none the wiser - until now, that is! The problem, which emerged after September's security updates, affected various versions of Excel, including 2016, 2019, 2021, and 2024, as well as Excel Online.
Microsoft Updates Disrupt File History Backup Feature in Windows
Beware: the latest September 2026 Windows security updates may have an unexpected side effect - disrupting the File History backup feature and leaving you unable to create or update your backups. If you rely on File History, you may want to hold off on installing these updates until the issue is resolved.
SolarWinds Fixes Hard-Coded Key Flaw in Access Rights Manager
SolarWinds has patched a high-severity vulnerability in its Access Rights Manager software, known as CVE-2026-28326, which could have allowed hackers to remotely execute code without authentication due to a hard-coded static key. The flaw, scoring 8.8 out of 10 in severity, has been fixed in ARM 2026.2.1, and users are urged to update to prevent potential attacks.
Public Exploits Unveiled for Four Linux Kernel Flaws Enabling Local Root Access
Four newly published Linux kernel exploits can give local users root access, but fortunately, fixes have already been issued in recent stable kernel releases, shielding systems that are up-to-date. The public release of exploit code highlights the importance of running current kernel versions to avoid potential security risks.
WordPress Patches Click2Shell Flaw That Forces Theme Installs
A simple click on a crafted link by a logged-in administrator could allow an attacker to silently install a malicious theme and execute code on your server, thanks to a high-impact vulnerability in WordPress dubbed Click2Shell. This security flaw exploits a discrepancy in how WordPress and the WordPress.org directory interpret web links.
Flaw in AI Coding Agents Exposes Users to Plugin Swaps
A newly discovered flaw, dubbed Plugin4Shell, allows hackers to swap out a plugin installed by an AI coding agent with malicious code, putting users at risk of having their files read, credentials stolen, and accounts compromised. This vulnerability was found in all four major AI coding agents, and the affected vendors have been notified.
Microsoft Fixes Critical Azure AI Foundry Flaw Enabling Privilege Escalation
Microsoft just patched a critical flaw in Azure AI Foundry that allowed unauthorized attackers to escalate privileges over a network - a vulnerability that earned a perfect 10.0 CVSS score for its severity. Thankfully, there's no evidence it's been exploited in the wild... yet.
Microsoft Fixes Defender Bug Behind False Antivirus Alerts
Microsoft has squashed a bug in its Defender Antivirus software that was causing false alerts saying the protection was turned off, even when it was working properly. The fix is now live in update version 4.18.26080.4, which you can install to get back to worry-free browsing.