Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a Linux kernel vulnerability (CVE-2026-46300) that can help them gain control of affected systems. The flaw was added to CISA’s Known Exploited Vulnerabilities catalog on October 28,...

Chinese-linked hackers exploited a VMware ESXi zero-day vulnerability to hide activity on compromised servers during espionage operations against U.S. organizations, including law firms. CrowdStrike identified the group as WARP PANDA and said it used the flaw, tracked as CVE-2026-41709,...

Cisco released security updates for actively exploited CVE-2026-76418, a flaw in Secure Firewall ASA and FTD software that lets unauthenticated remote attackers force device restarts, causing denial of service and disrupting remote access. The high-severity vulnerability carries a CVSS score...

Veeam released security fixes for a critical authorization bypass vulnerability in Veeam Backup & Replication that lets an attacker without login credentials bypass access checks on the CDP Coordinator Service. Tracked as CVE-2026-108142, the flaw carries a CVSS v4.0 score...

Researchers at Xint found an OpenAI API flaw that exposed hidden reasoning in GPT-5.6 models by routing prompts through a conversation-compaction feature. The method, called compaction smuggling, bypassed protections introduced in August 2026. According to Xint, OpenAI confirmed the bug,...

HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes namespace. Tracked as CVE-2026-110720, the flaw affects deployments using automated system access control list management. HashiCorp disclosed the...

Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a CoreGraphics zero-day vulnerability that attackers may have used in targeted attacks. Released on October 26, 2026, the updates bring security fixes to older devices, including the iPhone XS, iPhone XS...

OpenAI Codex helped researcher Xusheng Li uncover flaws in four USB protection products, including hardcoded encryption keys and hidden accounts that allowed files to be decrypted without the owner’s password. In one test, Codex identified the main weakness in seven...

Microsoft has released out-of-band security updates for .NET to fix a Brotli buffer overflow and unsafe ownership settings in Linux distribution archives. Published on October 25, 2026, the release covers .NET 8, .NET 9, .NET 10, and .NET 11 Release...

Cloudflare has announced an emergency Web Application Firewall (WAF) ruleset update linked to CVE-2026-111497, a Brotli vulnerability. The October 25, 2026 release adds two rules for Brotli-encoded request bodies and the Next.js image optimization endpoint, enabled by default in Log...