On November 3, 2026, Puppet by Perforce and the OpenVox fork fixed CVE-2026-115731: a deserialization flaw in report handling lets any agent holding a signed certificate run code on the Puppet server and steal the CA signing key. A public exploit is available, and autosigning environments become effectively unauthenticated.
On October 7, 2026, JFrog disclosed CVE-2026-105192, an unauthenticated remote code execution flaw rated 9.8 in LMCache, the cache layer that speeds up LLM servers such as vLLM, with no fix available. If your LMCache cache listens on a routable address, isolate it now instead of waiting for a patch.
On September 15, 2026, Oracle released its September Critical Security Patch Update with 673 fixes across 17 product families, including several unauthenticated remote takeovers of WebLogic Server. Inventory every exposed WebLogic instance and cut T3/IIOP before a diffable exploit turns your servers into a target.
