A critical flaw in Check Point's Security Management Server has been discovered, leaving all deployments vulnerable to hackers who can exploit it to execute code with root privileges, putting the entire firewall estate at risk. This severe vulnerability, tracked as CVE-2026-91843, requires immediate attention with Check Point releasing security updates to fix the issue.
CISA has launched VINCE-NT, a cutting-edge platform that's revolutionizing vulnerability reporting and coordination by streamlining collaboration between reporters, suppliers, and case managers. This upgrade marks a significant improvement over the previous system, enabling faster and more efficient disclosure processes.
Frustrated with Excel's stubborn copy-paste problem after the September 2026 security update? Thankfully, Microsoft has swooped in with a fix, resolving the silent failure that left users scratching their heads.
A newly discovered Docker flaw on macOS could allow malicious code in a virtual machine to break free from its sandbox and read or modify sensitive host files, potentially leading to code execution on the host. This vulnerability, tracked as CVE-2026-77179, leverages a weakness in the virtio-fs host server to gain unauthorized access.
A critical flaw in Check Point's Security Management and Log Servers, rated 9.8 out of 10, allows unauthenticated users to execute code as root via a simple login request with a very long username. Fortunately, there's no evidence that this vulnerability has been exploited in the wild - yet.
The Internet Systems Consortium has rolled out a crucial BIND 9 update that patches 14 security flaws, including unauthenticated crashes, to keep your DNS server safe and secure. Fortunately, no active exploits have been reported so far, but it's still essential to update to the latest releases: BIND 9.20.29, BIND 9.21.26, or BIND 9.20.29-S1 to fix the vulnerabilities.
The vulnerability gap is widening as attackers speed up exploitation, with new vulnerabilities being weaponized in just five days, while defenders take a median of 43 days to patch - and 80% coverage is no longer enough to keep you safe.
A critical flaw in the Unbound DNSSEC Validator, known as CVE-2026-81642, allows attackers to trigger a heap overflow, potentially enabling remote code execution on vulnerable systems. This vulnerability affects all Unbound DNS resolver releases before 1.26.1, putting countless systems at risk.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
Mark your calendars: Windows 11 24H2 Home and Pro editions will stop receiving crucial security and non-security updates after October 13, 2026, leaving devices vulnerable to the latest threats.
Big change alert: starting September 28, CISA is ditching its weekly vulnerability bulletin to shake up its approach to cybersecurity, shifting from severity-based listings to a modern, risk-based strategy. This move aims to help prioritize vulnerabilities based on real-world risks, not just their severity.
A newly discovered flaw in Parallels Desktop, tracked as CVE-2026-90894, leaves Macs vulnerable to root access, allowing ordinary local accounts to run code as root. This security gap, dubbed ParaShells, was uncovered by JFrog's vulnerability team and rated 7.8 out of 10 in severity.
Mark your calendars: Windows Server 2022 will reach the end of its mainstream support on October 13, 2026, and will then transition to extended support, with security updates continuing through October 14, 2031.
The AI-powered bug hunting revolution is here, and it's blowing the lid off hidden vulnerabilities - Gartner research VP Craig Lawson says we've never seen codebases audited to this level before. This unprecedented scale of audit is swiftly retiring technical debt and steering neglected code toward a cleaner state.
Apple just dropped a massive patch cycle, tackling a record-breaking 260+ vulnerabilities across its operating systems, browsers, and software products - the largest update of its kind in the company's history. This critical update includes fixes for 122 security issues in iOS 27 and 204 in macOS 27 Golden Gate.
Most organizations are playing a game of cyber defense whack-a-mole, testing security controls against individual threats in isolation - but 93% of security leaders admit their organization still suffered a major cyberattack in the past year. It's time to rethink the way we validate security and stop getting caught off guard.
Microsoft's massive September Patch Tuesday update, which bundled a record 974 CVEs, caused widespread disruptions to core services, including RDS and Hyper-V, just days after its release. The company has now issued an emergency patch to fix these issues, restoring stability to affected systems.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A critical vulnerability in LiteSpeed Web Server Enterprise could allow a low-privilege website user to gain root access on a shared-hosting server, putting all hosted sites at risk. This flaw affects versions before 6.3.7 and can bypass key security controls, including CageFS.
Struggling with Excel's copy and paste function? A recent Microsoft update has caused a frustrating issue where content appears to paste, but actually doesn't - with no error message or warning to let you know something's gone wrong.
Microsoft just dropped a massive September patch, fixing a record-breaking 972 vulnerabilities, including 112 critical ones that could put your system at risk. This huge update is part of a rapid acceleration in patch releases, fueled by AI-powered vulnerability detection that's uncovering more threats than ever.
Microsoft has rolled out emergency updates to fix Remote Desktop Services failures caused by September's security updates. The out-of-band updates, released on September 14, aim to correct RDS instability and related issues across various Windows versions.
Homebrew just got a major security boost with the release of version 7.0.0, which now includes a built-in vulnerability scanner to help keep your packages safe and up-to-date. This move is especially important, given Homebrew's massive popularity on GitHub with 49k stars and 11k forks, making it a prime target for threat actors.
Imagine a stealthy attack that silently corrupts encrypted data, allowing hackers to manipulate sensitive information without detection - and it's all thanks to a flaw in modern encryption hardware. This sneaky exploit, dubbed DDRop, can make protected virtual machines operate on outdated, tampered-with data that still decrypts perfectly.
WordPress has just supercharged its plugin security with an automated review system that scans every plugin release before it's distributed, catching potential threats like a backdoor in a plugin with 20,000 active installations. This new layer of protection ensures that compromised updates never reach users, giving you peace of mind.
Automation isn't just about speeding up patch deployment - it's also about building in checks to prevent errors and ensure reliability, or you risk accelerating your way to failure. By neglecting to balance speed with safety measures, you can turn automation into a high-speed train wreck.