Act now: patch, respond or decide this week.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCISA added a GitLab CE/EE integer-overflow RCE (CVE-2026-97229, CVSS 10.0) and a Cisco Secure Firewall ASA/FTD denial-of-service flaw (CVE-2026-76418, CVSS 8.6) to its Known Exploited Vulnerabilities catalog on 29 October, both with a 1 November federal deadline. A day later it added two Ivanti Connect Secure flaws that chain with an earlier auth bypass to reach unauthenticated root. Volexity reported active exploitation; fixes are in ICS 25.1.1.3 and 22.8R2.6.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCloudflare detailed eight eMudhra intermediate CA certificates whose private keys were literal small integers (4, 56, 66 and others), letting anyone recover the signing key and forge a certificate for any domain. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Cloudflare saw about 22,000 handshake attempts using the weak keys and a forged certificate dated under an hour after the public bug report. A week later, more than half of probes still accepted the chain.
November 2, 2026 · Azure's edge falls over, and a record crypto heistHosting platform Northflank disclosed a breach on 30 October in which stored environment variables were decrypted and customers' AI API keys were stolen and misused. Northflank told customers to assume all stored environment variables were compromised and to rotate every key, database password, token and secret. It followed similar breaches at Railway earlier in the month.
November 2, 2026 · Azure's edge falls over, and a record crypto heistA use-after-free in the kernel's IPv4 TCP path affecting multipath TCP listeners is tracked as CVE-2026-98432 and rated CVSS 9.8 by the kernel CVE team. Eight stable kernels shipped around 30 October with the fix. Anthropic reported that an AI model wrote a working exploit for the race.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityPHP maintainers released fixes on 21 October for CVE-2026-109618 and CVE-2026-109619, both unauthenticated remote code execution rated CVSS 9.2. The highest risk is mod_php, where an unauthenticated request can trigger the flaw before any application code runs. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Krebs reported working exploits already circulating.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityCloudflare found eight eMudhra intermediate CA certificates whose private keys were catastrophically weak, letting anyone recover the signing key and forge a certificate for any domain. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Cloudflare deployed mitigations on 19 and 20 October, and eMudhra later said it will exit the global TLS certificate business.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityA malicious LiteLLM 1.107.0 was published to PyPI on 21 October with a credential stealer and a persistent backdoor that polled GitHub for commands. Attackers used stolen GitHub CLI credentials to bypass branch protection and build from a lookalike repo before PyPI removed it. The same day, Railway disclosed unauthorized access to systems holding customer environment variables, some decrypted, and told customers to rotate everything.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityCVE-2026-88771 is an unauthenticated remote command-execution flaw in NetScaler Gateway, exploitable in default configuration and confirmed exploited in the wild by CISA and Mandiant. Cloudflare recommends putting authentication and WAF controls in front of the appliance because patching lags exploitation.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOn 13 October Microsoft shipped fixes for more than 1,400 vulnerabilities, roughly ten times a normal month, with at least 78 rated critical. CVE-2026-96951, a Windows Shell security-feature bypass affecting Windows 10, 11 and some Server versions, is confirmed exploited in the wild. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch but not yet exploited at publication.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOpenCode disclosed that attackers accessed a legacy system being decommissioned, exposing third-party API keys for OpenAI, Anthropic and Google that users had saved in OpenCode Console workspaces. The company said about 1.4 percent of Console users were affected, and Anthropic revoked affected Claude API keys. The open-source CLI itself was not the breached component.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionDanish authorities disclosed that attackers abused a private company's legitimate access to the Central Person Register (CPR), running about 14 million automated searches in September before detection in early October. Exposed data includes names, addresses and CPR numbers for roughly 8.8 million people, about 80 percent of the register. A party claiming responsibility said access came via an IT company account protected by the password 123456.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionA researcher published CVE-2026-107181, an IPC-injection flaw in Telegram Desktop through version 7.2.8 combined with an unauthorized URI scheme that enables arbitrary local file read and exfiltration, leading to account takeover from a single malicious link click. It is rated CVSS 8.1 and fixed in version 7.2.9.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionKrebs reported that before recent arrests, the ShinyHunters group extorted Jeppesen ForeFlight, a former Boeing subsidiary. Related reporting ties the group to mass exploitation of CVE-2026-35273, a PeopleSoft and Oracle vulnerability, beginning in June, with published firewall mitigations bypassed through URL-encoding.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedCISA added three exploited flaws to its Known Exploited Vulnerabilities catalog. CVE-2026-86950 is an out-of-bounds write in Apple's CoreGraphics (CVSS 8.8), fixed in iOS and macOS updates and triggered by processing a malicious file. CVE-2026-76504 is a critical authentication bypass in Cisco Catalyst SD-WAN Manager (CVSS 9.8) with no workaround. CVE-2026-104286 is a path-traversal flaw in Fortinet FortiMail (CVSS 9.8) allowing unauthenticated file write.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedDebian published DSA-6528-1 on 29 September, fixing an unusually large batch of Linux kernel CVEs that may lead to privilege escalation, denial of service or information leaks. Debian stable is fixed in kernel 6.12.111-1, and the advisory drove a widely read Hacker News thread.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedSimon Willison argued that agentic AI tooling needs default hard budget caps to prevent runaway spend, drawing 652 points and 313 comments on 3 October.
