Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.
Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.
Updated October 3, 2026 — all 220 published advisories are browsable here. The four drawing the most attention right now: a FortiMail email-gateway flaw being exploited before any fix exists (CVE-2026-104286, rated 9 out of 10 for severity) — there is no patch yet, so every affected 8.0, 7.6, 7.4 and 7.2 system is relying on Fortinet’s workaround, starting with switching off the Identity Based Encryption portal if you do not use it; two Citrix NetScaler flaws exploited for weeks before the September 27 fix (CVE-2026-88771 and CVE-2026-88772) — a patched box can still be hosting a webshell (a hidden back door left behind in the software itself), so update to 14.1-73.37 or 13.1-64.23 and then go looking for what was left behind; a Roundcube webmail flaw that lets an attacker tamper with the mail database before anyone logs in (CVE-2026-48842), patched in May 2026 and still being exploited because it ships inside hosting control panels most firms forget they run; and a Microsoft SharePoint Server flaw under active attack that lets an intruder run their own code on the server holding your internal documents (CVE-2026-65660), whose CISA federal patch deadline passed on September 28, so an unpatched server is now overdue rather than pending. Two of the four are email systems, and one has no fix at all, which is why what decides the cost is how fast someone notices. If you are not sure who is reading the alerts at 2 a.m., our 24/7 staffed security operations center handles the detection and the response.
Microsoft says Storm-3168, a group linked to the AI driven JADEPUFFER ransomware crew, used two leaked Azure service principals to map a victim tenant for 16 hours and then delete more than 100 storage accounts, a Key Vault, and backup protections in about seven minutes.
Microsoft confirmed active exploitation of CVE-2026-65660, a SharePoint Server code injection flaw first labeled as spoofing, and CISA added it to KEV with a September 28 deadline. Patch SharePoint Server 2016, 2019 and Subscription Edition with the August 11 updates now.
Read moreAttackers are exploiting CVE-2026-48842, a pre-authentication SQL injection in the Roundcube virtuser_query plugin that was patched in May. Admins should upgrade to 1.6.16 or 1.7.1 and disable the plugin if it is not needed.
Read moreA suspected Chinese-speaking threat actor exploited CVE-2026-7273, a CVSS 8.8 unauthenticated buffer overflow in Zyxel GS1900 switches, to steal configurations and hashed root credentials from 996 devices in 48 countries. CISA added it to KEV with a September 24 deadline, and fixed firmware has been available since June.
Read moreGoogle fixed CVE-2026-58704, a high-severity Pixel cellular modem privilege escalation flaw that may be under limited, targeted exploitation. The bug needs no user interaction and is fixed in the 2026-09-05 security patch level, though Pixel 11 devices remain on an older patch level.
Read moreGoogle patched CVE-2026-87491 in Chrome 153 after confirming an exploit for the V8 out-of-bounds write already exists in the wild. It is the seventh actively exploited Chrome zero-day of 2026 and the second in five days. Update to 153.0.8010.36 or later and relaunch the browser.
Read moreGoogle shipped a Chrome Stable Channel update on September 3 that fixes CVE-2026-85046, a type confusion flaw in the V8 engine that attackers are already exploiting in the wild. It carries a CVSS score of 8.8 and affects every Chrome build before 152.0.7977.82, along with the wider Chromium and Electron ecosystem.
Read moreCisco confirmed active exploitation of CVE-2026-20349, a CVSS 8.6 flaw in Secure Firewall ASA and Threat Defense software that lets an unauthenticated attacker reboot a VPN gateway with a single crafted HTTP request. CISA added it to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of August 14. There are no workarounds, only patches.
Read moreMicrosoft patched CVE-2026-68820 on August 11, a use after free elevation of privilege flaw in the Windows afd.sys WinSock driver that North Korea's Lazarus Group exploited as a zero day for roughly five weeks against defense and aerospace targets. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a two week remediation deadline.
Read moreTencent's Zhuque Lab disclosed SCTPhantom, an 18 year old use after free flaw in the Linux kernel SCTP code tracked as CVE-2026-64564. A local unprivileged user can escalate to root and, in the researchers' testing, escape containers to take over the host. Patched stable kernels shipped August 3, 2026.
Read moreWordPress 7.0.3 patches CVE-2026-64638, a pre-authentication cross-site scripting flaw on the login screen that researchers chained all the way to PHP code execution on the server. The CVSS 8.9 bug comes from a parser disagreement between strip_tags and KSES, affects every maintained version before 7.0.3, and was backported to the 4.7 branch. No confirmed exploitation in the wild yet, but the full technique is public.
Read moreN-able confirmed that attackers exploited an authentication bypass in N-central to take over administrator accounts on customer RMM servers, then found its original patch was incomplete. CVE-2026-18577 widens the affected range to every build before 2026.3.1.7, which shipped on August 2. Attackers pivoted from compromised consoles into managed endpoints and planted Cloudflare tunnels that survive both reboots and revoked console access.
Read moreCisco Secure Firewall Management Center ships with static credentials for a low privilege account, and attackers exploited the flaw as a zero-day before any fix existed. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog on July 29, 2026. Hot fixes are available for every affected train and no workarounds exist.
Read moreRussian state-supported actor LAUNDRY BEAR (Void Blizzard) exploited a zero-click Zimbra Collaboration XSS flaw, CVE-2025-66376, as a zero-day for months, stealing 90 days of email, Global Address Lists, saved passwords, and 2FA recovery codes from NATO and Ukrainian targets before minting rogue application passwords for persistent MFA-bypassing access. Patched in November 2025 and now on the CISA KEV list.
Read moreA pre-authentication RCE chain in WordPress core, nicknamed wp2shell, chains CVE-2026-63030 (REST API batch route confusion) with CVE-2026-60137 (a core SQL injection) to run code on a stock install with no login and no plugins. Working exploit code is public. Patch to 6.9.5, 7.0.2, or 6.8.6 now.
Read moreA financially motivated group tracked as O-UNC-066 (Pink) is vishing Microsoft 365 users into a fake Entra passkey enrollment flow, using an operator-controlled PHP panel to relay MFA in real time and register attacker-owned passkeys for persistent account takeover before looting SharePoint and OneDrive.
Read moreA newly disclosed Linux kernel race condition, CVE-2026-46242 or "Bad Epoll," turns any unprivileged local user into root with a roughly 99 percent success rate and reaches Android devices as well. CVSS 7.8, no active exploitation yet, but proof of concept code exists and there is no workaround.
Read moreA use-after-free race condition in the Linux kernel epoll subsystem lets an unprivileged local user escalate to root with roughly 99 percent reliability. It affects kernel 6.4 and newer across servers, desktops, and Android, can be triggered from a Chrome renderer sandbox, and has no workaround. Only a patched kernel fixes it.
Read moreResearcher Nightmare Eclipse dropped a public PoC for CVE-2026-50656 (RoguePlanet), a TOCTOU race condition in the Microsoft Defender Malware Protection Engine that yields NT AUTHORITY\SYSTEM on fully patched Windows 10 and Windows 11. Microsoft has confirmed the flaw, rated it CVSS 7.8, and is still working on a patch. The PoC works whether real-time protection is enabled or not, leaving defenders with detection and containment as the only options for now.
Read morePalo Alto Networks confirmed active exploitation of CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect that lets attackers establish unauthorized VPN sessions without credentials. CVSS 7.8, added to CISA KEV, patches available across all supported branches.
Read moreOur CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.
Subscribe to our newsletter and get the latest security insights delivered to your inbox.
