Exploited bugs, new critical vulnerabilities, and what defenders should check.
ExploitedCVE-2026-97229CVSS 10.02 min read
The integer overflow bug could let an unauthenticated user run code on a GitLab server through a crafted regular expression in a CI/CD configuration. GitLab has released fixes.
ExploitedCVE-2026-20349CVSS 8.62 min read
Cisco says attackers have been exploiting an unauthenticated denial-of-service bug in the Remote Access SSL VPN service of its Secure Firewall ASA and FTD software. Fixes are out, and no workarounds exist.
ExploitedCVE-2026-109618CVSS 9.21 min read
The agency told federal agencies to patch the kernel privilege escalation bug, which researchers say was used alongside two critical PHP flaws to root servers.
ExploitedCVE-2026-76418CVSS 8.62 min read
Cisco says it found evidence the flaw was exploited in the wild. Devices with the webvpn keyword and SSL VPN enabled on an interface are affected, and admins who can't patch yet have a mitigation.
Brief2 min read
Cyberdione Labs says it reproduced the issues, collectively called Tailworm, on released Tailscale and headscale builds. Tailscale calls them serious but isn't telling everyone to turn off Tailscale SSH.
Brief2 min read
Cyberdione Labs published 11 findings against the Tailscale client and headscale before fixes shipped, drawing criticism; Tailscale says most fixes are in place and a patched client was targeted for Tuesday.
ExploitedCVE-2026-35273CVSS 9.82 min read
Researchers say the PeopleSoft bug ShinyHunters has exploited since May is a chain of three flaws, all patched under one CVE identifier in June. The root is an SSRF that reaches an internal management interface.
CVE-2026-114595CVSS 9.82 min read
The bugs affect the open source toolkit behind control systems at particle accelerators and fusion labs. One could allow code execution, though researchers only demonstrated a crash.
ExploitedCVE-2026-109618CVSS 9.22 min read
A missing variable initialization in the Linux kernel could let attackers alter page-cache-backed data, and the NVD entry says it can be chained with two PHP vulnerabilities to implant webshells and run commands as root.
Brief2 min read
The bugs can let revoked client certificates through, expose some encrypted sessions to eavesdroppers, or bypass a certificate chain length cap, but each affects only a subset of deployments.
ExploitedCVE-2026-111497CVSS 9.21 min read
The bug, nicknamed Node2Shell, Broccoli2Shell and HTTP2Shell, was added to CISA's Known Exploited Vulnerabilities catalog with a November 10 federal patch deadline.
ExploitedCVE-2026-111497CVSS 9.22 min read
An out-of-bounds write in Google's Brotli decoder affects Node.js, .NET, PowerShell and Python packages, and researchers say it can lead to code execution.
