A nine-year-old Linux kernel vulnerability, dubbed RefluXFS, has been discovered in the XFS filesystem, allowing local attackers to gain root privileges and wreak havoc on systems - patching is urgently recommended to prevent exploitation. Immediate action can neutralize this threat and safeguard your systems from potential attacks.
A newly discovered security flaw, CVE-2026-8933, can give local users full root control of Ubuntu Desktop installs, posing a significant threat to default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. This high-severity vulnerability highlights the importance of staying vigilant about system security.
A staggering 432 Linux kernel CVEs were published over just two days, sending shockwaves through the Linux community and leaving system administrators scrambling to keep up with the sudden workload. This unprecedented flood of vulnerability notices has sparked heated debate over prioritization and practical solutions.
In a wake-up call for infrastructure security, Eclypsium's inaugural InfraTrust Pulse report reveals a staggering 61 vulnerabilities, including six critical ones, threatening the very foundation of our digital world. The monthly report aims to help organizations focus on the most pressing threats, prioritizing vulnerabilities that pose a real-world risk.
Google is taking code security to the next level with CodeMender, a managed AI agent that helps developers find, diagnose, and fix software defects - now available inside Google Cloud. This game-changing tool has already proven its worth, producing 72 security fixes to major open-source projects in its research phase.
Microsoft is ending security updates for Exchange Server 2016 and 2019 in October 2026, with no further extensions available, even for those currently in Period 2 of the Extended Security Update program. This marks the final cutoff for support, leaving organizations without updates after that date.
A newly discovered vulnerability, CVE-2026-8933, puts users of Ubuntu Desktop 24.04, 25.10, and 26.04 at risk of full root access, allowing any local user to gain unrestricted control on default installs. This high-severity flaw can be easily exploited by a local, unprivileged user, making immediate attention crucial.
Cisco is shaking things up in the world of vulnerability detection with its new Antares family of small language models, starting with Antares-350M and Antares-1B, designed to quickly sniff out known vulnerabilities in codebases. These models are now available on Hugging Face, but only for vetted users, with Cisco working to expand access to trusted organizations.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Nearly a third of breaches occur because hackers exploit known vulnerabilities that could have been easily fixed with a patch, highlighting the urgent need for more efficient patch management. By speeding up patching, organizations could prevent around one in three incidents, making it a crucial defense against cyber threats.
Meet Gemini 3.5 Flash Cyber, a game-changing AI model that supercharges vulnerability detection with lightning-fast speed and pinpoint accuracy. This lightweight powerhouse helps you discover, validate, and patch vulnerabilities quickly and efficiently, without breaking the bank.
Zimbra has patched a critical command injection flaw and four cross-site scripting bugs in its latest update, ensuring users are protected from potential security threats. The fixes, part of version 10.1.20, address vulnerabilities that could allow malicious commands to be executed or sensitive data to be compromised.
Microsoft is investigating a newly discovered Windows zero-day flaw, dubbed LegacyHive, and is working to update impacted products to protect customers as soon as possible. A researcher disclosed the vulnerability, along with a proof-of-concept exploit, on the same day as Microsoft's July 2024 Patch Tuesday updates.
To minimize risk to customers, OVH took swift action with mass reboots to disrupt the Januscape bug, opting for decisive action over detailed communication that could have tempted some to test the publicly available exploit. This critical flaw, tracked as CVE-2026-53359, allowed attackers to escape guest VMs and wreak havoc on host systems.
The exposure window - the time between a vulnerability appearing and your team fixing it - is the critical gap that attackers exploit to cause real damage. With 48,185 CVEs disclosed in 2025 alone, and an average eCrime breakout time of just 29 minutes, the urgency to shrink this window has never been greater.
Got a Dell PC that's been shutting down unexpectedly after a recent Windows update? Microsoft's just released a fix for the issue, which was causing a range of problems including poor performance, overheating, and battery drain.
A newly discovered flaw in 7-Zip, tracked as CVE-2026-14266, leaves systems vulnerable to code execution attacks, allowing hackers to execute code in the context of the current process. Fortunately, a fix is available in 7-Zip version 26.02, which patches the heap-based buffer overflow issue.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A critical nginx vulnerability, CVE-2026-42533, allows remote attackers to trigger a heap buffer overflow with crafted HTTP requests, putting servers at risk of remote code execution - and it's not just a Denial of Service (DoS) threat, even on default systems. This flaw in nginx's script engine can be exploited with a specially designed request, making it a serious concern for server administrators.
Don't risk your files! 7-Zip's latest update, version 26.02, patches a critical vulnerability that could let hackers take control when you open a malicious archive.
WordPress has patched a critical flaw that allowed hackers to execute code remotely without authentication, releasing versions 6.9.5 and 7.0.2 to fix the vulnerability. The update addresses a REST API batch-route confusion and SQL injection issue that could be triggered by a simple HTTP request.
A newly discovered OpenSSL flaw, dubbed HollowByte, leaves unpatched servers vulnerable to memory exhaustion attacks, where a mere 11 bytes can trigger the allocation of up to 131 KB of memory for a message that never arrives. This tiny trigger can bring a server to its knees, freezing memory and blocking critical connections.
Mark your calendars: Windows Server 2022 will reach the end of its mainstream support on October 13, 2026, after which it will transition into extended support, still receiving security updates through October 14, 2031.
A security flaw in n8n's workflow automation platform allowed unauthorized users to log in to accounts due to a token exchange mishap, essentially handing out the wrong accounts at login. This vulnerability stemmed from a misimplementation of the Enterprise token exchange feature.
A surprising 16.9 percent of Windows devices still run Windows 10, leaving many enterprises vulnerable to growing security risks as they stall on migration. With the easy migrations already done, only the toughest cases remain, making it crucial to reassess and accelerate Windows 10 migration plans.
Mark your calendars: October 13, 2026, is the end of the line for Windows 11 24H2 Home and Pro editions, as well as Windows 10 Enterprise LTSB 2016, after which they'll no longer receive crucial security and non-security updates. Make sure you're prepared to avoid potential security threats!