Round-ups of significant threats, actively exploited vulnerabilities, and security advisories, with practical steps to consider.
Awareness content, not a monitored service.
Attacks on supermarket refrigeration controllers across Europe, exploited WordPress, SonicWall, and Zyxel flaws, and phishing that steals Microsoft and Google sessions.
WordPress core flaw CVE-2026-119977 is under active attack: update every self-hosted site to WordPress 7.1.4 or its branch fix and check for compromise.
Ivanti Connect Secure, Cisco ASA, GitLab, and Adobe Commerce flaws under attack, plus a trojanised Claude Code extension and AI-assisted state-linked intrusions.
GitLab CE/EE flaw CVE-2026-97229 (CVSS 10.0) is under active attack: upgrade self-managed GitLab to 19.4.2, 19.3.4, or 19.2.8 and check for compromise.
Adobe Commerce/Magento flaw CVE-2026-48356 and Brotli flaw CVE-2026-111497 in Node.js are under active attack: apply APSB26-73, update Node.js, and check for compromise.
Exploited PHP2Shell flaws in PHP, an Arista VeloCloud Orchestrator zero-day, and a chained Plex Media Server attack lead this week, alongside backdoored WordPress sites via stolen UpdraftCentral keys and a joint warning on SafePay ransomware.
Arista VeloCloud Orchestrator On-Prem flaw CVE-2026-114625 is under active attack: upgrade to a fixed release, restrict access, and check for compromise.
Websites worldwide were taken offline on 21 October 2026 after two critical PHP vulnerabilities were disclosed. Here is what it means for your business website and what to do now.
Zero-days in Ivanti Connect Secure, Cisco Secure Email Gateway, BeyondTrust Remote Support, and PAN-OS lead this week, alongside ConnectWise Cloud Backup credentials used to break into Microsoft 365 tenants and attacks on supermarket refrigeration controllers.
BeyondTrust Remote Support 26.2.3 and earlier has a critical flaw under attack (CVE-2026-102764): apply the BT26-05 patch now and check self-hosted appliances for compromise.
Cisco Secure Email Gateway flaw CVE-2026-76519 is under active attack: update Content Scanner Tools or AsyncOS now and check your appliances for compromise.
Ivanti Connect Secure CVE-2026-104935 is under active attack: upgrade to 22.8R2.5, 25.1.1.2, or 25.1.3.0 or later now and check appliances for compromise.