Cybersecurity News
Stay informed about the latest cybersecurity incidents, vulnerabilities, and threat landscape changes. We cover data breaches, ransomware campaigns, critical CVEs, and regulatory updates – with context on what it means for you and how to protect yourself.
APT vulnerability allows replacing verified packages and executing code with root privileges
The critical CVE-2026-109518 vulnerability in the APT package manager allows an attacker who can intercept HTTP traffic between the client ...
CVE-2026-83844 vulnerability in Windows Paint: fix available only through Microsoft Store
Microsoft has released a fix for the CVE-2026-83844 vulnerability in Windows Paint, which allows remote execution of arbitrary code. The ...
CISA added WordPress Core vulnerability CVE-2026-119977 to the KEV catalog — what is known about exploitation
On November 3, 2026, CISA added vulnerability CVE-2026-119977 to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability affects WordPress Core ...
CVE-2026-98432: use-after-free in Linux kernel IPv4 TCP — patches, diverging severity ratings, and temporary mitigations
The CVE-2026-98432 vulnerability in the Linux kernel IPv4 TCP networking stack allows a remote unauthenticated attacker to achieve arbitrary code ...
OpenSSH and musl libc vulnerability on Alpine Linux lets you log in without a password via an overlong string
A vulnerability in the interaction between OpenSSH and the musl libc library allows an attacker to log in to an ...
SonicWall will not fix critical vulnerabilities in EOL GMS versions — what organizations should do
SonicWall has published advisory SNWLID-2026-0019, disclosing two vulnerabilities in the centralized management system Global Management System (GMS) version 9.5.2 and ...
IBM discloses four Langflow vulnerabilities — two with CVSS 9.8 allow unauthenticated code execution
Langflow OSS — a popular open-source tool for building AI agents and workflows — contains four vulnerabilities, two of which ...
VMware ESX logging vulnerability exploited as a zero-day — CISA requires patching by November 11
CVE-2026-41709, an insufficient logging vulnerability in VMware ESX, was added by CISA to the Known Exploited Vulnerabilities catalog on October ...
Critical vulnerability in Drupal Commerce Core exploited in the wild — updates and guidance
Drupal has published a security advisory about the CVE-2026-118539 vulnerability in the Commerce Core module, which provides online store functionality ...
Attack on Alpine Linux GitLab via CVE-2026-97229: why updating GitLab didn’t fix the vulnerability
The critical vulnerability CVE-2026-97229 (CVSS 10.0) in the Onigmo regular expression engine embedded in Ruby was used to attack the ...
