On October 19, 2026, Siemens confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center: attackers distribute a genuine, signed copy of the program alongside a malicious DLL, outside official channels. Update to version 4.0.9.8 and hunt the published indicators, because a code signature is no longer proof of trust.

On October 14, 2026, CVE-2026-110447 documented an unauthenticated command injection in proxy.php of Nextcloud’s Collabora Online Built-in CODE Server app, exploited since September to drop PHP web shells. Update to 26.4.303 and hunt for shx*.php files, because the patch does not remove shells that are already in place.

On October 21, 2026, Node.js shipped security updates for its three supported lines (22.x, 24.x, 26.x) fixing ten flaws, including an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497) that can lead to remote code execution. With no workaround offered, upgrading to 22.23.4, 24.22.1 or 26.12.1 is the only defense.

On October 20, 2026, the NVD published five critical CVEs — scored 9.8 to 9.9 — against the AI agent frameworks Letta, Langchain-Chatchat, DB-GPT, and Piflow: tool-execution endpoints with no authentication and databases shipped with default credentials. If you run one of these frameworks, take it off the public internet until you have checked the version and port exposure.

On October 20, 2026, Unit 42 confirmed that the Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) ransomware groups are still exploiting CVE-2026-0257, the GlobalProtect authentication bypass that has been patched since May. If you run an exposed PAN-OS gateway, check your version and disable authentication override now.

On October 14, 2026, Palo Alto Networks patched CVE-2026-0322, a code-injection flaw in the PAN-OS management interface that hands root to an authenticated attacker, and confirmed exploitation has already been observed. Patch before October 17 and verify that your management interface is not exposed to the internet.

On October 13, 2026, Ivanti patched CVE-2026-104935, an authentication bypass exploited as a zero-day on its Connect Secure VPN gateways, which Volexity ties to a three-flaw chain ending in root. The compromise leaves nothing the vendor’s integrity tool can see: patch on an emergency basis and verify every appliance forensically.

In late September 2026, the Kubernetes Security Response Committee fixed two medium flaws: CVE-2026-19444, a kubectl cp path traversal on Windows, and CVE-2026-2270, a confused deputy in the StatefulSet controller. The lesson for everyone: updating the control plane protects neither your admin workstation nor the isolation between namespaces.

On October 12, 2026, GitLab shipped a critical patch closing 24 flaws, including CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regular-expression compiler that is exploitable without authentication. Every operator of a self-managed instance should move to 19.4.2, 19.3.5 or 19.2.8 immediately, because this one no longer even asks for an account.

Advisory DSA-6528-1, published September 29, 2026, fixes 1,313 CVE identifiers in Linux 6.12.111-1 for Debian 13 Trixie, a volume directly tied to AI-assisted vulnerability discovery in the kernel. A CVE identifier says nothing about severity or exploitability: the job is to update cleanly, not to panic at the number.

CVE-2026-84411, scored CVSS 9.8, is an integer underflow in RouterOS’s web management service, reachable before authentication with a single crafted request that yields root code execution. Any MikroTik router whose web interface is reachable from the internet must move to 7.24 or pull that interface off the network.

On October 13, 2026, Microsoft’s Patch Tuesday landed a record 1,411 fixes, including an already-exploited Windows Shell zero-day and a cluster of CVSS 9.8 remote-code-execution flaws on network-facing Windows services. Here is the patch order that actually protects an estate, from the exposed surface inward.

Overnight on 11–12 October 2026, attackers seized Danfoss AK-SM 800A refrigeration controllers and triggered their automatic defrost, destroying fresh produce across 250 to 350 Intermarché, Super U, Leclerc and Monoprix stores. Anyone running industrial refrigeration should inventory their internet-exposed controllers, segment them, and apply the CVE-2025-41450 and CVE-2025-41451 patches.

At Kernel Recipes 2026, Greg Kroah-Hartman walks through his audit of the 79 vulnerabilities Anthropic’s AI tool claimed to have found in Linux: ten real fixes, the rest being noise, duplicates or invented data. The graver signal is elsewhere — the mean time from disclosure to exploitation has dropped to minus seven days, and half of AI-generated patches are wrong.

MediaTek’s October 2026 security bulletin closes 31 flaws, including two critical out-of-bounds writes in the modem (CVE-2026-20519 and CVE-2026-20520) that a rogue base station can trigger to escalate privileges with no user interaction. Treat the gap between MediaTek’s fix and its distribution by device makers as a risk in its own right, and audit the patch level of your Android fleet.

On 1 October 2026 the Apache Software Foundation shipped HTTP Server 2.4.69, fixing twenty vulnerabilities, every one rated “low” or “moderate” by the project’s own security team. None are reachable without an optional module or a non-standard setting, which turns this large patch into routine maintenance plus a configuration audit.

On 5 October 2026 Perforce published three critical CVEs in P4 Search, the containerised search engine for Helix Core: a hardcoded authentication token (CVSS 10) and an exposed JDWP debug interface let an unauthenticated network attacker run code right next to the source repository. The fix is a single container-image update to 2026.4.2 plus strict network isolation.

Dell closed six maximum-severity vulnerabilities in Container Storage Modules, the layer that ties its PowerStore, PowerScale and PowerFlex arrays to Kubernetes. With no authentication at all, an attacker steals the arrays’ admin credentials, gains root on the nodes and reads every Secret: move to CSM 1.18.0 now.

On October 2, GitLab fixed a critical vulnerability (CVE-2026-90970, CVSS 9.9) that lets a logged-in user execute commands on the AI Gateway, the service that connects a GitLab instance to AI models. Only organizations that host their own gateway need to act: move to 19.2.4, 19.3.2 or 19.4.1 now.

CVE-2026-104286, rated CVSS 9.8, lets an unauthenticated attacker write arbitrary files on FortiMail's management interface through a path traversal combined with a NULL byte. No fix is out yet — disable IBE and take the admin console off the internet.

Canonical replaces its four-week and two-week cycles with a single cascading two-week cycle that ships an Ubuntu kernel every week. For an Ubuntu fleet, that shortens the gap between a kernel CVE and its fix — if you adapt your maintenance windows.

The stable rollout of Chrome 154, which began September 22, 2026, closes 108 security flaws including 11 critical, almost all use-after-free and buffer-overflow bugs in the GPU and rendering layers. None is confirmed exploited, but their sandbox-escape potential makes them an immediate deployment priority across every browser in the fleet.

On September 23, 2026, GitLab released a critical patch for 19.4.1, 19.3.3, and 19.2.7, closing two remote code execution flaws at CVSS 9.9 in the pipeline’s regular-expression parser, triggerable by a forged .gitlab-ci.yml file. Any authenticated user who can edit a CI/CD configuration becomes a vector: patch self-managed instances immediately.

CERT Polska has documented the MikroTrick chain: two RouterOS SSH flaws, CVE-2026-67279 and CVE-2026-86060, combine to hand attackers full administrative control of an exposed router with no password and no SSH key. CISA added CVE-2026-67279 to its KEV catalog on September 25, 2026: patch to 6.49.21, 7.23.4 or 7.24.2 and hunt for signs of compromise.

Microsoft described CVE-2026-65660 as a CVSS 6.5 spoofing issue; researcher Dinh Ho Anh Khoa showed it is actually a code-injection flaw (CWE-94) enabling authenticated remote code execution, and CISA added it to the KEV catalog on September 25, 2026 after observed attacks. Apply the August 11 patch and audit your SharePoint 2016, 2019 and Subscription Edition servers.

Microsoft delivered 973 fixes on September 8, 2026 — the biggest Patch Tuesday in its history — including two elevation-of-privilege flaws already exploited in the wild. Deploy the two zero-days within 24 hours, then address the critical remote-code-execution flaws within seven days.

On September 8, 2026, ConnectWise shipped a fix for CVE-2026-84869, a missing authorization (CVSS 9.9) that lets an attacker push and run files on a machine during an active ScreenConnect session without host confirmation. Upgrade the client to version 26.6.5, then audit past sessions and file transfers before remote access becomes the entry point into your fleet.

A Chinese-speaking actor tracked as Red Heron exploited CVE-2026-60004, the Gitea RCE, to scan 1,386 instances across seven countries and steal industrial source code. Patch self-hosted forges, lock down registration, and treat any exposed instance as already breached.

On September 2, 2026, Greg Kroah-Hartman warned that the Linux 7.3 cycle is shaping up to be ’rough’: his USB subsystem queue is overflowing with AI-generated patches, while the kernel approaches 2,000 CVEs per release. For distros and infrastructure teams, that means prioritizing real security fixes and bracing for a stable release around October 18.

On August 30, 2026, the gitoxide project — the pure-Rust implementation of Git — shipped a bundled fix for five parsing vulnerabilities, including an HTTP credential leak and several submodule-based path traversals. The lesson for anyone pulling Rust libraries: memory safety is no substitute for input validation.

Two authentication flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, exploited since mid-August 2026, let an unauthenticated visitor become an administrator. The six paid editions never received a public advisory, so no vulnerability scanner could detect them.

CVE-2026-73678, scored CVSS 10, lets an attacker with no account run system commands on the MindsDB platform through the Anton agent’s scratchpad tool. If you expose a MindsDB instance, cut public access before even waiting for a patch.

On August 13, 2026, the PostgreSQL project released 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3, fixing 28 security vulnerabilities — a record — including a dozen memory bugs exploitable for code execution. Apply the minor release now, and if you are still on version 14, plan the major upgrade before November 12, 2026.

The August 11, 2026 Patch Tuesday ships 421 fixes — a zero-day already exploited in the wild (CVE-2026-68820) by North Korea’s Lazarus group, plus two network flaws exploitable without authentication. Here is the patch order that actually protects your estate.

The Linux project published 46 CVEs between August 2 and 8, 2026. Every single one is already fixed in stable, none are 0-days, but the gap between the available patch and the kernel running on your machines is the real risk.

A use-after-free bug in the Linux kernel’s SCTP stack, dormant for 18 years and now tracked as CVE-2026-64564, lets a local attacker escalate to root and escape containers. Patches landed August 4, 2026 — kernel updates are not optional.

A vulnerability chain in WordPress Core, dubbed XSS2Shell, lets an unauthenticated attacker turn a single failed login attempt into full PHP remote code execution. The 7.0.3 patch landed August 6, 2026 — 43% of the web needs to apply it now.

An automated ransomware campaign dubbed RedLocker exploits passwordless Redis instances exposed to the internet. By August 4, 2026, 3,200 servers had already been compromised. Close port 6379 or enable Redis authentication now.

EU Regulation 2024/2847, the Cyber Resilience Act, enters phased application starting in 2026. It requires every software vendor selling in the EU to produce a complete SBOM, fix known vulnerabilities within five business days, and notify critical incidents to ENISA within 24 hours. Here's what your organization must do before the first binding deadline.

On July 14, 2026, Microsoft patched an AD CS flaw letting any authenticated user impersonate a domain controller. By July 27, the PoC was public — every unpatched domain is one script away from full compromise.

Broadcom disclosed three critical VMware vulnerabilities on July 29, 2026 — a VMXNET3 VM escape and two unauthenticated RCE flaws targeting vCenter. Patch immediately: compromising vCenter gives an attacker total control over your entire virtualized infrastructure.