Cybersecurity News
Stay informed about the latest cybersecurity incidents, vulnerabilities, and threat landscape changes. We cover data breaches, ransomware campaigns, critical CVEs, and regulatory updates – with context on what it means for you and how to protect yourself.
CVE-2026-86950 in CoreGraphics: Apple extends the fix to the iPhone XS and XR lineup
On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11 — a security update for legacy iPhone and iPad ...
Critical vulnerability CVE-2026-101767 in Oracle E-Business Suite — chain from SQL injection to OS command execution
Oracle has fixed the critical vulnerability CVE-2026-101767 (CVSS 9.8) in the Oracle Application Object Library component of Oracle E-Business Suite ...
Token Spraying campaign compromised dozens of organizations via replay of stolen Microsoft 365 sessions
Researchers at Huntress uncovered a large-scale campaign to compromise Microsoft 365 accounts in which attackers replayed stolen authentication tokens instead ...
Google privacy policy update: how Personal Intelligence links personal data to targeted advertising
As of 16 October 2026, an updated Google privacy policy comes into force which, according to The Hacker News and ...
Two critical remote code execution vulnerabilities in the Linux kernel SMB server disclosed before patches
The KSMBD module — the built-in SMB server in the Linux kernel — is affected by two remote code execution ...
Third zero-day in three months in VeloCloud Orchestrator — SQL injection with CVSS 9.9
Arista Networks published a security advisory on October 22 warning of active exploitation of the critical vulnerability CVE-2026-114625 in VeloCloud ...
Two critical vulnerabilities in Collabora Online and Arista VeloCloud are being actively exploited
On October 23, 2026, CISA added two critical issues to the Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-110447 in Collabora Online ...
CVE-2026-111497: vulnerability in the Brotli decoder affects Node.js, Bun, Python, and Envoy
The CVE-2026-111497 vulnerability in Google’s Brotli compression decoder allows a buffer overflow write when processing specially crafted compressed data. Since ...
Fortinet investigates impact of critical PHP RCE vulnerability CVE-2026-109618 on 12 products
Fortinet has published security advisory FG-IR-26-186, announcing an investigation into the impact of a critical vulnerability in the PHP core ...
Six vulnerabilities in Plex Media Server, Siemens and SiteGuard added to the CISA KEV catalog with strict patching deadlines
On 20 October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added new entries to the Known Exploited Vulnerabilities ...
