If you self-host GitLab — Community or Enterprise Edition — this is a stop-and-patch alert. CISA confirmed on October 29 that a maximum-severity flaw in GitLab's CI/CD regular-expression compiler is being actively exploited in the…
If you self-host Nextcloud and installed the optional Collabora Online – Built-in CODE Server app, stop reading and check your server right now. Attackers have been breaking into Nextcloud instances through that app since mid-September,…
If you run PHP on any server that touches the internet, this is a stop-and-patch alert. On October 21, PHP shipped emergency releases to fix two critical, memory-safety flaws - CVE-2026-109618 and CVE-2026-109619, together nicknamed…
If you run AhsayCBS - the management console used by managed service providers and system integrators to run Ahsay's backup software - this is a stop-and-check-your-version alert. Two chained flaws are being exploited in the…
If your organization runs a self-hosted BeyondTrust Remote Support appliance (formerly Bomgar), treat it as compromised until you prove otherwise. A China-nexus espionage group has been exploiting a critical zero-day in the platform since late…
Attackers are stripping the one warning Windows gives you when you open a dangerous file. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13 after Microsoft confirmed the flaw is already being…
If your organization runs Cisco Secure Email Gateway as its email security layer, stop what you're doing and check your Content Scanner Tools version. On October 14, CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities…
If your organization uses an Ivanti Connect Secure VPN appliance to let remote workers into your network, stop scrolling and check your version right now. On October 13 CISA added CVE-2026-104935 to its Known Exploited…
Your MikroTik router may already belong to someone else. Attackers are chaining two now-patched RouterOS vulnerabilities to seize full administrative control of internet-facing devices — with no credentials at all. CERT Polska gave the chain…
If your phone is an iPhone 11 or newer, or you run a Mac, this one lands on you directly. Apple pushed emergency updates on September 28 to fix a CoreGraphics zero-day — CVE-2026-86950 —…