CISA added two severe vulnerabilities to its KEV catalog: CVE-2026-48356 in Adobe Commerce/Magento and CVE-2026-111497 in Google Brotli. The first issue concerns the Brotli data compression tool, which is widely used in a number of applications and services worldwide.
The response to a critical PHP vulnerability became a hot topic, leading to emergency maintenance on multiple domestic web services. If you run a blog on WordPress, this must have been news that caught your attention. I was looking into…
Hello everyone! This is Hatchobori-chan. From yesterday to today, various vulnerability reports have been flying in. What should I start checking for tomorrow's work??? In CSIRT work, it's not enough to just find vulnerability information; you also need to organize…
GitLab has released emergency security patches for a flaw rated the maximum possible severity score, a bug that could let an attacker run code on a self-managed server without ever logging in. Tracked as CVE-2026-110264, the flaw carries the maximum…
CVE-2026-116687: Cross-Site Scripting in CKEditor 5 Engine via Data URI and Control Character Bypass Vulnerability ID: CVE-2026-116687 CVSS Score: 3.1 Published: 2026-10-27 CVE-2026-116687 is a Cross-Site Scripting (XSS) vulnerability in the @ckeditor/ckeditor5-engine package of CKEditor 5. When the General HTML Support (GHS) plugin is…
As part of their overall risk management efforts, many South African organisations commission a penetration test just once a year. They receive a report, close the high-severity findings and file the document for the auditors. Then, for the next 11 months,…
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root…
Tagged with vulnerability, plex, rce, exposure. #after-plex2shell-a-detection-and-recovery-checklist-for-media-servers-you-cannot-rebuild-blindly After Plex2Shell: A Detection and Recovery Checklist for Media Servers You Cannot Rebuild Blindly Patching a compromised host is not the same as cleaning it. When the exploit chain known as Plex2Shell ran against…
CVE-2026-44236 will land in a queue owned by whoever runs RabbitMQ. The broker team will confirm the cluster is current, close the ticket and be right about the broker while the exposure remains, because the flaw lives in the client…
I recently got my Windows anti-ransomware tool, WinRansomProtect, approved and published on the Microsoft Store. I assumed the review would be a standard malware scan. But the MSIX packaging model ended up forcing me to completely rework core parts of…
The flaws, the patches and the race between them.
An article joins this feed when it matches these terms. Each one is also a search of its own.