Insights that apply internationally, including most vulnerabilities, threats, and international standards.
Barracuda Email Security Gateway flaws CVE-2026-116606 and CVE-2026-111560 are under active attack: update to the latest firmware and lock down the admin interface.
Attacks on supermarket refrigeration controllers across Europe, exploited WordPress, SonicWall, and Zyxel flaws, and phishing that steals Microsoft and Google sessions.
WordPress core flaw CVE-2026-119977 is under active attack: update every self-hosted site to WordPress 7.1.4 or its branch fix and check for compromise.
Ivanti Connect Secure, Cisco ASA, GitLab, and Adobe Commerce flaws under attack, plus a trojanised Claude Code extension and AI-assisted state-linked intrusions.
GitLab CE/EE flaw CVE-2026-97229 (CVSS 10.0) is under active attack: upgrade self-managed GitLab to 19.4.2, 19.3.4, or 19.2.8 and check for compromise.
Binance lost about $6.3 billion in the largest crypto theft on record, which blockchain analysts attribute to North Korea’s TraderTraitor group.
Adobe Commerce/Magento flaw CVE-2026-48356 and Brotli flaw CVE-2026-111497 in Node.js are under active attack: apply APSB26-73, update Node.js, and check for compromise.
Exploited PHP2Shell flaws in PHP, an Arista VeloCloud Orchestrator zero-day, and a chained Plex Media Server attack lead this week, alongside backdoored WordPress sites via stolen UpdraftCentral keys and a joint warning on SafePay ransomware.
Arista VeloCloud Orchestrator On-Prem flaw CVE-2026-114625 is under active attack: upgrade to a fixed release, restrict access, and check for compromise.
Websites worldwide were taken offline on 21 October 2026 after two critical PHP vulnerabilities were disclosed. Here is what it means for your business website and what to do now.
Zero-days in Ivanti Connect Secure, Cisco Secure Email Gateway, BeyondTrust Remote Support, and PAN-OS lead this week, alongside ConnectWise Cloud Backup credentials used to break into Microsoft 365 tenants and attacks on supermarket refrigeration controllers.
BeyondTrust Remote Support 26.2.3 and earlier has a critical flaw under attack (CVE-2026-102764): apply the BT26-05 patch now and check self-hosted appliances for compromise.