Microsoft just dropped a major security update, KB5122878, for Windows 10, packing fixes for a whopping 966 vulnerabilities across its products - a must-install for anyone on long-term servicing and paid support tracks! If you're running Windows 10 Enterprise LTSC or part of the ESU program, you can easily grab the update through Windows Update.
Microsoft just dropped a massive Patch Tuesday update, fixing a record-shattering 966 vulnerabilities, including two zero-day exploits that hackers are actively using to cause trouble. This September 2026 update is a big deal, with the most flaws patched in a single update ever.
Microsoft just dropped urgent updates for Windows 11, releasing KB5124008 and KB5122880 to squash security flaws, fix bugs, and add some exciting new features. These cumulative updates are specifically designed for Windows 11 versions 25H2/24H2 and 23H2.
If you've installed the August 2026 Windows security update on your Windows Server 2016 system, you might be experiencing recurring application errors due to a compatibility issue with the CompatTelRunner.exe process. This error can occur when the Compatibility Appraiser diagnostic service is enabled, causing frustrating Application Error events with Event ID 1000.
Over 10,000 SAP systems are exposed to the public internet, making them vulnerable to a newly disclosed maximum-severity kernel flaw, CVE-2026-44756, that allows attackers to gain admin privileges and take control. This critical vulnerability, dubbed OVERPASS, is a buffer overflow flaw that can be exploited to run arbitrary commands on vulnerable systems.
Beware: a recent change in Windows Server 2025's memory management can cause apps to crash, resulting in access violations, memory corruption, or sudden termination. Microsoft is working on a fix, but for now, some applications may be at risk.
A critical vulnerability in FreeIPA, tracked as CVE-2026-76578, allows an unauthenticated client to create admin credentials by exploiting a chain of defects that lets them create a Kerberos identity and join the administrators group. This flaw, with a preliminary CVSS score of 9.8, was fixed in FreeIPA version 4.13.4.
A newly discovered flaw in Telerik UI for ASP.NET AJAX can be exploited to achieve unauthenticated remote code execution, thanks to a publicly released proof-of-concept that combines an AES-CBC padding oracle with a type-resolution bug in the RadAsyncUpload control. When certain preconditions are met, this vulnerability can be easily leveraged for devastating effect.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
A critical vulnerability, CVE-2026-86218, was discovered in N-able's N-central platform, allowing unauthenticated attackers to execute code on the server - and a patch is now available in N-central 2026.3 Hotfix 4. Update now to prevent potential remote code execution attacks!
N-able has urgently released a fourth hotfix in just five weeks to tackle a critical, unauthenticated remote code execution flaw in its N-central software, affecting all on-premises builds prior to version 2026.3.1.14. All users of these outdated versions must apply the latest fix to safeguard against this maximum-severity vulnerability.
ConnectWise has uncovered a new vulnerability in its ScreenConnect platform that affects file transfer behavior in Remote Access Support and Access sessions, and is providing temporary mitigations until a patch is released later this week. To protect your systems, apply these manual workarounds now.
Broadcom has patched a critical VMware flaw that lets attackers with local admin access on a virtual machine execute code on the host, thanks to an integer-overflow vulnerability in the VMXNET3 virtual network adapter. This bug, tracked as CVE-2026-59346, earned a near-perfect CVSS score of 9.3, highlighting the severity of the threat.
A 12-year-old flaw in PostgreSQL, just patched, allowed replication users to execute arbitrary code on the database server, posing a significant security risk. The vulnerability, tracked as CVE-2026-6471, was exploitable by accounts with the REPLICATION attribute and has been fixed in releases 18.6, 17.11, 16.15, 15.19, and 14.24.
OpenAI is stepping up to shield essential services from cyber threats with a game-changing $1 billion subsidy, empowering frontline defenders to safeguard complex systems and protect against faster-moving threats. This initiative, Daybreak for Frontline Defenders, will help teams review legacy code, detect vulnerabilities, and develop fixes.
The clock is ticking: with quantum computing on the rise, experts warn that it's high time to upgrade your cybersecurity to quantum-safe measures - before it's too late! The G7 is sounding the alarm, urging governments and organizations to take immediate action to protect themselves from this emerging threat.
Plex has just released a critical security update to patch multiple undisclosed flaws, urging users to upgrade to Plex Media Server 1.43.3 and Plex Desktop 1.115.0 ASAP to safeguard their devices. With over 360,000 devices exposed to the internet, swift action is crucial.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Cisco is urging immediate action to protect against two critical vulnerabilities in its IOS XR operating system, with CVSS scores of 9.8 that could allow hackers to wreak havoc on your network. Update your software now to prevent potential security breaches!
The G7 cybersecurity working group is sounding the alarm: many organizations are neglecting to prepare for the quantum threat, and it's time to prioritize post-quantum encryption defenses to safeguard critical systems and data. Don't wait - the transition to post-quantum cryptography is a business risk that requires immediate attention and coordinated action.
HPE has patched a critical flaw in ArubaOS-CX that could let hackers run malicious code with elevated privileges - and all they need to do is send specially crafted packets to an affected device. This remote code execution vulnerability, tracked as CVE-2026-73749, is a serious threat that demands immediate attention.
Cisco has uncovered a critical flaw in its Nexus 9000 switches, known as CVE-2026-20212, which could allow an unauthenticated attacker to remotely execute code as root. This vulnerability affects 10 specific models and has already been patched by the company.
The sheer volume of vulnerabilities is overwhelming - just look at Microsoft's recent patch release with over 500 fixes, making it impossible to vet, prioritize, and deploy them safely. This strain on vulnerability management is only intensifying, with the National Vulnerability Database now backlogged and struggling to keep up with the soaring number of Common Vulnerabilities and Exposures.
If you've updated your Windows system with the August 27, 2026 update (KB5120998) or later, you might be experiencing a frustrating issue - your desktop settings aren't loading, leaving you with a dull black background instead of your favorite wallpaper. Don't worry, you're not alone, and Microsoft is on it!
Plex is urging users to update their media servers and desktop clients ASAP due to multiple security vulnerabilities that could put their data at risk. To stay safe, simply update to Plex Media Server 1.43.3 and Plex Desktop 1.115.0.
A security researcher, known as Chaotic Eclipse, has uncovered a zero-day privilege escalation flaw in CrowdStrike Falcon, dubbed FalconFlank, which exploits the office malicious macros remediation feature. This vulnerability allows for a potentially devastating escalation of privileges, and a public proof-of-concept has been released.