Vulnerabilities
LXD, MicroCloud CVSS 10 Flaw Enables Trusted-Client Impersonation
CVE-2026-112816 lets attackers log in to LXD and MicroCloud as a trusted client using only a public certificate — no private key required. Fixed snaps are out.
Vulnerabilities
Actively exploited flaws, zero-days, patches and exploit research.
Vulnerabilities
Claude Code Extension Trojanized on Cursor Marketplace
Trojanized Claude Code extension on Cursor's marketplace pushed an SSH backdoor to 5,000 developers. Anthropic says its own systems weren't touched.
Vulnerabilities
GitLab CVSS 10 Regex RCE on CISA KEV After Alpine Attack
CISA's KEV now lists a CVSS 10 GitLab RCE hiding in Ruby's regex engine — and Alpine's near-miss shows why upgrading GitLab alone may not fix it.
Vulnerabilities
ShinyHunters' PeopleSoft Zero-Day Was Three Chained Flaws
The Oracle PeopleSoft bug ShinyHunters exploited for five months is three chained flaws under one CVE. Does a single-identifier patch tell you you're covered?
Vulnerabilities
Apple Backports Exploited CoreGraphics Fix to Older iPhones
CVE-2026-86950, an exploited CoreGraphics RCE, now has fixes for iPhone XS-class devices and older iPads — and Apple shipped 304 patches alongside.
Vulnerabilities
Brotli Decoder RCE Hits Node.js, Bun, Python and Envoy
CVE-2026-111497 is one C bug replicated across every runtime that ships Google's Brotli decoder. What's confirmed, what's claimed, and how to patch it all.
Vulnerabilities
CISA: Arista VeloCloud Orchestrator SQLi Under Active Attack
CISA confirms active exploitation of a SQL injection flaw in on-prem Arista VeloCloud Orchestrator; federal agencies must remediate by October 26.
Vulnerabilities
Two Pre-Auth PHP Flaws Put 70% of the Web on the Clock
Working exploit attempts are already circulating for two pre-auth RCE flaws in PHP's runtime. We price out patching, WAF rules and pulling the plug.
Vulnerabilities
OpenBSD Root Exploit Chains 37-Year-Old Shared-Memory Bug
Calif chained a 37-year-old SysV integer overflow with an OOB write to get root on OpenBSD 7.9 past KARL, SMAP and SMEP — and the PoC is already public.
Vulnerabilities
BeyondTrust Remote Support zero-day exploited by Chinese spies
CVE-2026-102764 let ARMORY CASTLE root self-hosted BeyondTrust appliances, dump credential vaults and survive reboots. CISA's deadline is tomorrow.