Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.
Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.
Updated September 11, 2026 — all 201 published advisories are browsable here. The newest one is on the appliance that is supposed to be doing the protecting: a Cisco firewall management flaw under active attack and added to CISA's known-exploited list, on the console that controls the firewalls guarding the whole network (CVE-2026-20079). Behind it, a Chrome zero-day exploited in the wild, where simply visiting a booby-trapped site is enough to get code running on the machine (CVE-2026-87491), and a FreeIPA flaw that hands full administrator rights to anyone who connects without a password, on the directory server that decides who gets into everything else (CVE-2026-76578). The one readers keep coming back to is the Magento and Adobe Commerce zero-day being exploited against live online stores with no vendor patch available (StyleSmuggler). Every one of these sits on a device or service that faces the internet, so the clock starts the day the advisory drops — and a missed patch window is what turns a routine Tuesday into downtime, a breach-notification bill, and lost revenue. If you are not sure whether yours is patched, our 24/7 staffed security operations center handles the triage for you.
Google patched CVE-2026-87491 in Chrome 153 after confirming an exploit for the V8 out-of-bounds write already exists in the wild. It is the seventh actively exploited Chrome zero-day of 2026 and the second in five days. Update to 153.0.8010.36 or later and relaunch the browser.
Google shipped a Chrome Stable Channel update on September 3 that fixes CVE-2026-85046, a type confusion flaw in the V8 engine that attackers are already exploiting in the wild. It carries a CVSS score of 8.8 and affects every Chrome build before 152.0.7977.82, along with the wider Chromium and Electron ecosystem.
Read moreCisco confirmed active exploitation of CVE-2026-20349, a CVSS 8.6 flaw in Secure Firewall ASA and Threat Defense software that lets an unauthenticated attacker reboot a VPN gateway with a single crafted HTTP request. CISA added it to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of August 14. There are no workarounds, only patches.
Read moreMicrosoft patched CVE-2026-68820 on August 11, a use after free elevation of privilege flaw in the Windows afd.sys WinSock driver that North Korea's Lazarus Group exploited as a zero day for roughly five weeks against defense and aerospace targets. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a two week remediation deadline.
Read moreTencent's Zhuque Lab disclosed SCTPhantom, an 18 year old use after free flaw in the Linux kernel SCTP code tracked as CVE-2026-64564. A local unprivileged user can escalate to root and, in the researchers' testing, escape containers to take over the host. Patched stable kernels shipped August 3, 2026.
Read moreWordPress 7.0.3 patches CVE-2026-64638, a pre-authentication cross-site scripting flaw on the login screen that researchers chained all the way to PHP code execution on the server. The CVSS 8.9 bug comes from a parser disagreement between strip_tags and KSES, affects every maintained version before 7.0.3, and was backported to the 4.7 branch. No confirmed exploitation in the wild yet, but the full technique is public.
Read moreN-able confirmed that attackers exploited an authentication bypass in N-central to take over administrator accounts on customer RMM servers, then found its original patch was incomplete. CVE-2026-18577 widens the affected range to every build before 2026.3.1.7, which shipped on August 2. Attackers pivoted from compromised consoles into managed endpoints and planted Cloudflare tunnels that survive both reboots and revoked console access.
Read moreCisco Secure Firewall Management Center ships with static credentials for a low privilege account, and attackers exploited the flaw as a zero-day before any fix existed. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog on July 29, 2026. Hot fixes are available for every affected train and no workarounds exist.
Read moreRussian state-supported actor LAUNDRY BEAR (Void Blizzard) exploited a zero-click Zimbra Collaboration XSS flaw, CVE-2025-66376, as a zero-day for months, stealing 90 days of email, Global Address Lists, saved passwords, and 2FA recovery codes from NATO and Ukrainian targets before minting rogue application passwords for persistent MFA-bypassing access. Patched in November 2025 and now on the CISA KEV list.
Read moreA pre-authentication RCE chain in WordPress core, nicknamed wp2shell, chains CVE-2026-63030 (REST API batch route confusion) with CVE-2026-60137 (a core SQL injection) to run code on a stock install with no login and no plugins. Working exploit code is public. Patch to 6.9.5, 7.0.2, or 6.8.6 now.
Read moreA financially motivated group tracked as O-UNC-066 (Pink) is vishing Microsoft 365 users into a fake Entra passkey enrollment flow, using an operator-controlled PHP panel to relay MFA in real time and register attacker-owned passkeys for persistent account takeover before looting SharePoint and OneDrive.
Read moreA newly disclosed Linux kernel race condition, CVE-2026-46242 or "Bad Epoll," turns any unprivileged local user into root with a roughly 99 percent success rate and reaches Android devices as well. CVSS 7.8, no active exploitation yet, but proof of concept code exists and there is no workaround.
Read moreA use-after-free race condition in the Linux kernel epoll subsystem lets an unprivileged local user escalate to root with roughly 99 percent reliability. It affects kernel 6.4 and newer across servers, desktops, and Android, can be triggered from a Chrome renderer sandbox, and has no workaround. Only a patched kernel fixes it.
Read moreResearcher Nightmare Eclipse dropped a public PoC for CVE-2026-50656 (RoguePlanet), a TOCTOU race condition in the Microsoft Defender Malware Protection Engine that yields NT AUTHORITY\SYSTEM on fully patched Windows 10 and Windows 11. Microsoft has confirmed the flaw, rated it CVSS 7.8, and is still working on a patch. The PoC works whether real-time protection is enabled or not, leaving defenders with detection and containment as the only options for now.
Read morePalo Alto Networks confirmed active exploitation of CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect that lets attackers establish unauthorized VPN sessions without credentials. CVSS 7.8, added to CISA KEV, patches available across all supported branches.
Read moreSygnia disclosed Operation Highland this week, a China-nexus campaign by the Velvet Ant cluster that compromised core Linux authentication on a victim network from 2016 through 2026. Nine variants of backdoored PAM modules and patched OpenSSH binaries delivered hardcoded magic-password access plus continuous credential and command logging. A parallel commodity tool called PamDOORa now sells for $900 on a Russian forum, putting the same authentication-layer tradecraft within reach of any ransomware affiliate with root.
Read moreA path traversal flaw in Langflow's POST /api/v2/files endpoint allows unauthenticated attackers to write files anywhere the platform process can reach, opening a clean route to remote code execution on the roughly seven thousand exposed instances Censys is currently tracking. Tenable disclosed CVE-2026-5027 in late March, the maintainers shipped a fix in version 1.10.0 on June 10, and VulnCheck honeypots are catching exploitation right now. Patch immediately or pull the instance off the public internet.
Read moreGoogle confirmed active in the wild exploitation of CVE-2026-11645, an out-of-bounds read and write vulnerability in Chrome V8 with a CVSS score of 8.8. The fifth Chrome zero day patched in 2026 lets attackers run code inside the browser sandbox via a crafted HTML page. Update to Chrome 149.0.7827.102 or .103 immediately and force a relaunch across the fleet.
Read moreGitHub disabled 73 repositories across four Microsoft organizations after the Miasma worm spread through 57 npm packages, including @vapi-ai/server-sdk and ai-sdk-ollama. The TeamPCP-linked variant of Mini Shai-Hulud uses a Phantom Gyp binding.gyp injection plus AI coding assistant rule files in Claude Code, Cursor, Gemini CLI, and VS Code to harvest AWS, GCP, Azure, Vault, and GitHub Actions credentials.
Read moreCisco's June 3 advisory for CVE-2026-20230 details a critical-rated SSRF in the Unified Communications Manager WebDialer service, with a CVSS 8.6 base score and a public proof-of-concept already in circulation. An unauthenticated attacker on the network can write arbitrary files to the underlying OS and chain that into root. Cisco has released fixes in 14SU6 and an interim COP for the 15 line, with 15SU5 due in September 2026. Disabling WebDialer is the recommended interim mitigation.
Read moreOur CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.
Subscribe to our newsletter and get the latest security insights delivered to your inbox.
