Category
Vulnerabilities
- 59
- stories
- OCT 20
- latest
All Vulnerabilities · page 2
Ivanti Warns of Exploited EPMM Flaw CVE-2026-6973
The vulnerability (CVE-2026-6973) exists in Ivanti Endpoint Manager Mobile (EPMM) is being exploited by threat actors.
Lindsey O'Donnell-Welch · 2 min
New Dirty Frag Linux Bug Emerges
The vulnerability class is a potent new iteration of kernel bugs that corrupt the page cache of read-only files and is a follow-on to the recently disclosed Copy Fail Linux LPE bug.
Dennis Fisher · 3 min
Palo Alto CVE-2026-0300 Actively Exploited
PAN released an advisory about the vulnerability on Tuesday and said it will release a patch in an upcoming version of PAN-OS.
Dennis Fisher · 1 min
Serious Apache Web Server Bug Patched
The vulnerability (CVE-2026-23918) only affects version 2.4.66 and the Apache Software Foundation has released a fix for the bug in version 2.4.67.
Dennis Fisher · 1 min
A Copy Fail FAQ
The latest branded bug is a slick, portable LPE in many Linux kernels going back to 2017.
Dennis Fisher · 3 min
Researchers Warn of Critical cPanel Flaw CVE-2026-41940
cPanel published a terse advisory saying that there was an issue with “session loading and saving” and that it affects every version of the software.
Dennis Fisher · 2 min
Windows CVE-2026-32202 Exploited in the Wild
The current exploits are targeting CVE-2026-32202, a bug in the Windows Shell that allows an attacker to gain access to some sensitive data on the target network.
Dennis Fisher · 2 min
Cisco CVE-2026-20133 Targeted in Active Attacks
The three newly added bugs are CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133, the last of which had not been identified in active attacks before.
Dennis Fisher · 2 min
Myths and Mythos: An AI Vulnerability Research FAQ
It’s still very early days for all of this, and relatively little is known about Claude Mythos’s real capabilities, so we wanted to dig into what actually is known and what it all means.
Dennis Fisher · 6 min
Fortinet CVE-2026-35616 Actively Exploited
The company published an advisory on Saturday and urged all customers who are running affected versions of the software to install the hotfix as quickly as possible. The bug affects versions 7.4.5 and 7.4.6 of FortiClient EMS.
Dennis Fisher · 1 minCommand Injection Bug in OpenAI Codex Exposed GitHub OAuth Tokens
The bug is a command injection issue and lies in the way that Codex processed GitHub branch names during the execution of tasks.
Dennis Fisher · 3 min
Google: Commercial Surveillance Vendors Dominated Zero-Day Exploitation in 2025
Out of 42 unique zero days tracked by Google in 2025, 18 were attributed to CSVs, while 15 were linked to state-sponsored espionage groups.
Decipher · 3 min
Q&A: Tod Beardsley on How to Use CISA’s KEV Catalog
Without context, the KEV catalog is just a very large collection of data. Tod Beardsley is the former CISA KEV section chief, and he recently released a paper called KEVology that provides key context and evaluates the value of certain enrichment signals.
Dennis Fisher · 4 min
Cisco, NSA Warn of Attacks Targeting Catalyst SD-WAN Zero Day
Cisco released software updates on Feb. 25 to fix the vulnerability, which affects both on-premises and cloud deployments of the Catalyst SD-WAN Controller.
Dennis Fisher · 2 min
Researchers Warn of ‘Widespread’ Ivanti EPMM Exploitation
Exploitation of CVE-2026-1281 and CVE-2026-1340 is “widespread and mostly automated,” according to Unit 42 researchers.
Decipher · 2 min
Chinese Actors Exploited Dell RecoverPoint for VMs Flaw Since 2024
The hardcoded credential vulnerability (CVE-2026-22769) exists in Dell RecoverPoint for Virtual Machines and has been exploited since mid-2024.
Decipher · 2 min
Apple Patches iOS Zero Day CVE-2026-20700
That vulnerability also was patched in macOS, but the active exploitation that Apple disclosed was against iOS only.
Dennis Fisher · 1 min
Microsoft Fixes Six Exploited Bugs in February Patch Tuesday Updates
The exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.
Decipher · 3 minUS Gov Directive Cracks Down on Unsupported Edge Devices
CISA said potential exploitation of flaws in unsupported edge devices creates “a significant threat to federal property.”
Decipher · 2 min
Ivanti Discloses Exploited Critical EPMM Flaws
The vulnerabilities (CVE-2026-1281 and CVE-2026-1340) could lead to unauthenticated remote code execution if successfully exploited.
Decipher · 2 min
