IT and AI security incidents, checked against the primary source

Daily Recap

Daily Recap

Two CVEs got a deadline today, and 219 others arrived with no score at all

Both KEV additions are due Tuesday, November 10, 2026, and the vendor paperwork on each one argues with the catalog that now lists it.

Oct 27, 9:38 pm
Daily Recap

Thirteen stories, no confirmed exploitation, and eleven fixes you cannot simply install

Deal with FortiSandbox first. Fortinet’s CVE-2026-107656 is an authentication bypass that takes crafted HTTP requests, no credentials, and ends in code execution on the appliance organizations wire to…

Oct 26, 9:38 pm
Daily Recap

Sunday’s most urgent item scores 5.3, and both of the day’s 9.2 criticals were fixed months ago

The thing to deal with first on Sunday scored 5.3, medium. Two WordPress payment plugins, disclosed in the same WPScan batch, let an unauthenticated caller mark a store’s…

Oct 25, 9:37 pm
Daily Recap

Three of today’s seven stories are one certificate compromise, and the hardest item on the list is the one where Java is already patched

Deal with Java first, and deal with it even though today’s two highest scores are somewhere else. Oracle published a second out-of-band alert for the eMudhra certificate authority…

Oct 24, 9:37 pm
Daily Recap

Two exploited flaws come due Monday, and in four of the day’s eleven stories the fix cannot be installed

Two exploited flaws entered CISA’s catalog on Friday evening carrying the same federal deadline, Monday, October 26, and the one to deal with first is Arista’s. CVE-2026-114625 in…

Oct 23, 9:37 pm
Daily Recap

Five perfect 10.0s, and in all ten of today’s stories the record is at odds with itself, the vendor, or the fix

Five of today’s ten stories carry a perfect 10.0, and the one to deal with first is none of the three Microsoft published. Patch YOOtheme Pro: the image…

Oct 22, 9:36 pm
Daily Recap

Three records come due Friday, and the day’s biggest-sounding story has nothing to patch

Patch SiteGuard first, and do it in the right order. CISA added six records to its catalog on Tuesday, October 20, and three of them come due Friday,…

Oct 21, 9:39 pm
Daily Recap

The flaw to patch first today is a 7.8 that no catalog lists, not one of the six 9.9s

Six records scored 9.9 published today and none of them is being exploited. The one flaw a vendor says attackers are already using is scored local-access-only, annotated exploitation…

Oct 20, 9:37 pm
Daily Recap

Six of today’s ten records name a fix version that does not get you a fixed install

Deal with Rank Math first, and not because of the 9.8. Between October 15, 2026 at 8:02 p.m. UTC and October 16 at 7:12 a.m. UTC, copies of…

Oct 19, 9:36 pm
Daily Recap

In all nine of today’s stories, the authoritative record is unscored, wrong, or missing

Fourteen CVE records published today carry no severity metric at all, two fixes shipped without being called security fixes, and the 9.8 that needs acting on tonight names…

Oct 18, 9:36 pm
Daily Recap

Four fix versions in today’s records were never released, and the record behind Sunday’s federal deadline is gone

A federal deadline falls Sunday on a record Atlassian withdrew, and three of today’s nine stories name a fixed version the project never shipped.

Oct 17, 9:37 pm
Daily Recap

Seven federal deadlines land across this weekend, and five of today’s eleven stories have no version number that means fixed

Seven federal remediation deadlines fall between Saturday and Monday, two of them set on Friday afternoon. Across the day’s eleven stories, a version number was not a reliable…

Oct 16, 9:41 pm
Daily Recap

A federal clock lands Sunday, and in five of today’s ten stories the control was switched on and reported success

Five of today’s ten stories describe a security control that was switched on, ran, and reported success while the request went through. The item to deal with first…

Oct 15, 9:41 pm
Daily Recap

Five of today’s nine stories name a fix that does not exist, does not install, or does not fix

Three of today’s nine stories concern vulnerabilities already being exploited, and the one to deal with first is attached to the smallest vendor: Ahsay says the version NVD…

Oct 14, 9:43 pm
Daily Recap

Two three-day federal clocks land on the same Friday, and in seven of today’s nine stories the record and the vendor disagree

Ivanti Connect Secure and the Windows Shell zero-day both went onto CISA’s catalog with a Friday, October 16 deadline and a forensic-triage obligation — and in seven of…

Oct 13, 9:38 pm