patch management

PHP Critical Vulnerabilities Leaked Before Patch

By Editorial Team | October 21, 2026

Seven padlocks on a steel rail, three rusted and four brass, one with a blue tag, under the headline Critical PHP Flaws Leaked Before the Patch

Two critical PHP vulnerabilities leaked before their patch, early attacks are reported, and the EU’s CERT says internet-facing applications may need to be isolated until it is installed. PHP’s security team released the fix on October 21 at 14:00 UTC (16:00 CEST). Both flaws are rated CVSS v4.0 9.2, and researchers report remote code execution.…

Top 5 Cybersecurity News

By Editorial Team | October 2, 2026

This week’s Top 5 Cybersecurity News for October 2, 2026 follows a pattern that has been building across the year: attackers are targeting the layers that other infrastructure trusts. A critical-severity zero-day in Cisco’s SD-WAN Manager — the console that programs an entire enterprise WAN — arrived in CISA’s Known Exploited Vulnerabilities catalog on September…

Exchange Authentication Bypass Vulnerability Now Exploitable

By Editorial Team | September 1, 2026

A public exploit for an Exchange authentication bypass vulnerability is live, and 85% of German on-prem servers remain unpatched, BSI warns.

A working exploit for an Exchange authentication bypass vulnerability is now public on GitHub, and heise.de reports that roughly 85% of on-premises Exchange servers in Germany remain vulnerable three weeks after Microsoft shipped a fix. The catch: for organizations still running Exchange 2016 or 2019, that fix is locked behind Microsoft’s paid Extended Security Update…

Windows IKE RCE: Patched in April, Exploited Now

By Editorial Team | August 20, 2026

CVE-2026-33824 Windows IKE RCE is now actively exploited despite an April patch. CVSS 9.8, no auth needed. See who's affected and what to check today.

CVE-2026-33824 Windows IKE RCE has gone from a quietly patched bug in April to an actively exploited flaw four months later: CISA added it to its Known Exploited Vulnerabilities catalog on August 18, 2026, giving U.S. federal agencies until August 21 to patch — while Microsoft’s own advisory still lists it as not exploited. What…

CVE-2026-48282 Adobe ColdFusion RCE Exploited in 2 Hours

By Editorial Team | July 9, 2026

CVE-2026-48282 Adobe ColdFusion RCE is now the fastest-weaponized CVSS-10.0 flaw DIESEC has tracked in 2026: attackers began exploiting Adobe’s maximum-severity ColdFusion vulnerability within two hours of public disclosure, and CISA has given US federal agencies until July 10 to patch. What Happened Adobe’s APSB26-68 security bulletin, released June 30, 2026, patched 11 CVEs across ColdFusion,…