Topic
Practices and infrastructure for discovering, prioritizing, disseminating and remediating software vulnerabilities.
CISA added Citrix NetScaler flaw CVE-2026-88779 to its exploited-vulnerabilities catalog on 4 October, citing evidence of active exploitation. For anyone running the appliance, confirmed use by attackers puts this fix ahead of work ranked by severity score alone.
Reality
The stable AndroidX Security State libraries report patch state for the core OS, Play system modules and the Linux kernel separately, and let an app ask whether a named CVE is fixed before it turns a feature on.
Reality
Google Threat Intelligence Group counted 10,740 vulnerability disclosures in August, more than double the monthly figure at the start of 2026. Exploitation is rising more slowly, so the first call on any budget reopened this quarter is triage capacity.
Reality
Fortinet confirmed a 9.8-rated, unauthenticated file-write zero-day in FortiMail that attackers are using to drop a reboot-surviving ld.so.preload rootkit. Patching closes the hole but leaves any implant already on the appliance in place.
Reality
Five of nine FreeSWITCH CVEs from June 2026 sit in mod_verto, including an unauthenticated 9.8 heap overflow that unloading the module closes without a patch. The second critical, a 9.1 in the Event Socket Library, stays loaded and reaches any binary linked against libesl.
Reality
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Perspective Coverage
3 publishersReality
CVE-2026-65660, an exploited SharePoint Server code injection flaw rated 8.8, lets any user with a low-privilege login run code on the farm. Farms that admit vendors and contractors need to count who can sign in, alongside what faces the internet.
Reality
Microsoft's 2026 Digital Defense Report says intrusions spanning identity, cloud and supply chains become clearer when defenders join separate signals. Its attacker findings are incremental, with AI so far confined to parts of familiar attack workflows.
Perspective Coverage
5 publishersReality
F5 and Cisco say attackers are exploiting flaws in BIG-IP APM and ISE, two of the three security products in Canada's September 2026 Cyber Centre alerts. Three alerts are too few to show a trend in attacker targeting, but the two exploited products need fixed software now.
Reality
CERT-In bundled 14 ISC BIND CVEs, including cache-poisoning and zone-data modification flaws, under one HIGH rating on 21 September 2026. The batch suits one planned upgrade window, provided recursion and zone transfers are locked down until it runs.
Reality
GTT launched Defense Halo, which re-checks firewall and device configs whenever they change and ranks known vulnerabilities by the assets a customer runs. For the team rolling it out, catching a bad config sooner only pays off if someone can also ship the fix sooner.
Reality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
Detectify found 86% to 97% of open critical and high flaws on 1,293 customers' internet-facing systems had been exposed for more than 90 days. Its scanner confirmed each with a working attack request, so these are known, reachable flaws left to age.
Reality
CVE-2026-76461 lets a crafted email run SQL as root on Cisco Secure Email Gateway, with no workaround and a September 17 federal patch deadline from CISA. Because the trigger is mail parsing, every gateway in the mail path is in scope, whether or not it faces the internet.
Reality
Adobe's Connect 12.12 fixes CVE-2026-75682, a 9.9 SQL injection that reaches code execution from any low-privileged account. Connect deployments typically hand those accounts to students, contractors and partners, so the login barrier stops few attackers.
Reality
Three exploited flaws, three very different exposure classes. The self-hosted Metabase zero-day is the one with an unpatched population behind it.
Reality
Check Point says the Operation Dream Job chain now escalates through CVE-2026-68820 to install FudModule v3.1. CISA has told federal agencies to patch by August 25.
Perspective Coverage
4 publishersReality
A Federal Register RFI calls periodic scanning, static prioritization and manual remediation increasingly inadequate. Comments on redesigning the feed close October 13.
Perspective Coverage
3 publishersReality
The August 2026 Critical Security Patch Update carried 943 fixes across 23 product families, roughly 65% of Oracle's largest quarterly release. Monthly windows now need quarterly-sized capacity.
Reality
Disclosures doubled year over year while actually-exploited vulnerabilities rose 8%. The arithmetic retires patch-everything SLAs and leaves exploitability triage as the defensible option.
Perspective Coverage
3 publishersReality
Security · August 19, 2026 · 2 publishers
Security · August 20, 2026 · 4 publishers
Security · August 20, 2026 · 5 publishers
Security · August 29, 2026 · 4 publishers
Security · September 6, 2026 · 2 publishers
Security · September 10, 2026 · 2 publishers
Security · September 15, 2026 · 3 publishers
Security · September 25, 2026 · 2 publishers
Security · September 18, 2026 · 4 publishers
Build · September 25, 2026 · 1 publisher
Security · September 21, 2026 · 2 publishers
Security · September 23, 2026 · 6 publishers
Security · September 24, 2026 · 1 publisher
Security · September 24, 2026 · 1 publisher
Security · September 23, 2026 · 2 publishers
Build · September 23, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Build · September 21, 2026 · 1 publisher
Security · September 20, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Security · September 16, 2026 · 2 publishers
Invest · September 16, 2026 · 1 publisher
Security · September 15, 2026 · 1 publisher
Security · September 14, 2026 · 1 publisher
Security · September 12, 2026 · 1 publisher
Security · September 12, 2026 · 1 publisher
Leadership · September 10, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Security · September 4, 2026 · 9 publishers
Security · September 4, 2026 · 1 publisher
Security · September 4, 2026 · 1 publisher