Intelligence desk
Vulnerability Management
A permanent file of Security.io’s selected briefings tagged to this executive theme. It reflects the publication’s curated coverage, not a census of all global activity.
Zyxel GS1900 patch status no longer proves safetyVulnerability Management
WordPress updater race requires patching and compromise reviewVulnerability Management
PowerSYSTEM Center flaws put low-privileged users inside an OT management control planeOperational Technology
WordPress upgrade-window RCE draws sustained probingVulnerability Management
Ivanti's first October patch is no longer enoughVulnerability Management
PHP2Shell moves from patch emergency to PAN-OS compromise responseIncident Response
Active Brotli exploitation turns software inventory into an incident decisionVulnerability Management
Out-of-band .NET fixes reopen October patching and require application rebuildsVulnerability Management
BlackX shows why Secure Boot enabled is not enoughEndpoint Security
PHP2Shell was targeted before disclosure, resetting the compromise windowVulnerability Management
PHP2Shell patches close unauthenticated RCE across web-serving PHPVulnerability Management
PHP critical-release warning demands an emergency application change windowApplication Security
BeyondTrust zero-day requires appliance forensics after patchingVulnerability Management
BeyondTrust zero-day requires appliance and credential containmentVulnerability Management
Exploited Windows Shell flaw defeats a core file-trust signalVulnerability Management
Ivanti zero-day chain reaches root while evading integrity checksVulnerability Management
Windows zero-day, patch volume and end-of-support collideEndpoint Security
GitLab code-execution flaw puts CI/CD control planes on an emergency upgrade clockVulnerability Management
SonicWall SMA 1000 exploitation turns an edge patch into an incident decisionVulnerability Management
N-Tron switch flaws require an engineering-led availability decisionOperational Technology
Atlassian file-access flaw turns inventory into the first controlVulnerability Management
Android fleet assurance moves to patch level 2026-10-01Endpoint Security
Exchange V2 release adds privilege-escalation fix ahead of scheduleVulnerability Management
Exploited NetScaler SAML flaw turns authentication availability into an emergency changeVulnerability Management
FortiMail zero-day reaches Monday as a compromise investigationVulnerability Management
Exploited Cisco SD-WAN bypass turns patching into a compromise investigationVulnerability Management
Apple CoreGraphics zero-day demands branch-specific MDM proofEndpoint Security
NetScaler zero-days turn patching into an incident-response decisionVulnerability Management
StyleSmuggler compromise count forces Magento incident responseVulnerability Management
SharePoint KEV addition turns patching into a compromise huntVulnerability Management
WSO2 KEV listing forces an API control-plane reviewApplication Security
F5 BIG-IP APM exploitation requires hunting, not patch-only closureVulnerability Management
F5 BIG-IP APM OAuth zero-day demands patching and compromise assessmentVulnerability Management
Check Point management zero-day requires compromise hunting, not patch-only closureVulnerability Management
Public Click2Shell chain raises the bar for WordPress closureVulnerability Management
Cisco ISE zero-day requires patching and compromise reviewVulnerability Management
Forged admin tokens target WSO2 API control planesApplication Security
Pixel modem flaw sees targeted exploitationEndpoint Security
GitLab patching does not close potential secret exposureApplication Security
Sogou exploitation delivered GRAYRABBIT through a trusted input toolEndpoint Security
GitLab file-read flaw enters KEV with Monday’s deadlineVulnerability Management
ScreenConnect joins KEV: check clients and remote-session evidenceVulnerability Management
Check Point VPN flaws expose gateways and management serversNetwork Security
BlueMoon turns the browser patch gap into a shared espionage capabilityThreat Intelligence
Cisco confirms active exploitation against the firewall management planeVulnerability Management
Adobe expands StyleSmuggler remediation beyond patchingApplication Security
Microsoft fixes two Windows zero-days already used for SYSTEM accessVulnerability Management
Adobe hotfix demands a separate StyleSmuggler compromise huntVulnerability Management
N-central Hotfix 4 resets the control-plane decisionVulnerability Management
StyleSmuggler leaves Magento stores without a vendor patchApplication Security
Artifactory authentication bypass exploitation raises build-control-plane riskApplication Security
SonicWall SMA 1000 zero-days demand compromise checks, not patch-only closureVulnerability Management
JFrog Artifactory admin bypass forces patch-and-compromise decisionVulnerability Management
PaperCut Release 3 supersedes earlier fixes as exploitation continuesVulnerability Management
PaperCut’s Sunday indicators make compromise review mandatoryVulnerability Management
ServiceNow’s three unauthenticated critical flaws put deployment ownership under scrutinyCloud Security
PaperCut zero-day requires isolation, patching and compromise reviewVulnerability Management
CISA adds six exploited flaws; NetScaler gateways need immediate triageVulnerability Management
Actively exploited Gitea flaw puts the software forge in scopeVulnerability Management
Public SharePoint chain converts authentication bypass into RCEVulnerability Management
Calix router flaw can turn a trusted NAT boundary into public exposureVulnerability Management
TrueConf Server exploitation requires more than an upgrade ticketVulnerability Management
Actively exploited MLflow flaw can expose cloud credentialsVulnerability Management
CISA adds MLflow SSRF flaw to exploited-vulnerability catalogueVulnerability Management
Exploited vCenter flaw requires control-plane compromise reviewVulnerability Management
Fresh Windchill indicators force compromise reviews beyond patch statusVulnerability Management
SAP Commerce Cloud exploitation attempts collapse the patch windowApplication Security
vCenter exploitation turns patching into a compromise investigationVulnerability Management
Internet-exposed macOS Screen Sharing is yielding root accessVulnerability Management
Lazarus campaign used a Windows zero-day to suppress endpoint visibilityThreat Intelligence
NIST asks how the NVD should operate in the age of AIVulnerability Management
CISA’s ransomware designation changes the SMA1000 closure standardVulnerability Management
PeopleSoft exploitation keeps the compromise hunt openVulnerability Management
Overdue WordPress exploit response now requires compromise evidenceVulnerability Management
N-central patch bypass turns one RMM server into many access pathsVulnerability Management
Actively exploited SharePoint flaw demands compromise evidence after emergency remediationVulnerability Management
Cisco FMC zero-day requires hunting and secret rotation, not patching aloneVulnerability and Network Security
Arista VeloCloud Orchestrator zero-day puts SD-WAN control planes on an incident footingVulnerability and Network Security
Actively exploited Arista flaw exposes the SD-WAN control planeNetwork and Infrastructure Security
Fastjson 1.x exploitation turns dependency discovery into an emergencyApplication and Software Supply Chain Security
Check Point exploitation makes management-plane verification a Monday priorityNetwork and Perimeter Security
Clop turns Windchill exploitation into an extortion decision, not a patching exerciseEnterprise Threat and Exposure
GitHub and PyPI put time between a new package release and enterprise trustApplication and Supply-Chain Security
Cl0p-linked extortion changes the Windchill response from patching to breach investigationEnterprise Risk and Incident Response
Exploited Check Point bypass puts firewall policy integrity in questionNetwork and Security Platforms
Adobe extension flaw shows browser add-ons can bridge trusted SaaS sessionsEndpoint and SaaS Security
CISA gives exposed SharePoint farms three days as attackers pursue machine keysVulnerability and Exposure Management
LegacyHive reopens the coordinated-disclosure argumentVulnerability research
SharePoint is no longer a patch question; it is a compromise decisionVulnerability desk
Splunk and Zoom fixes test the long tail of enterprise softwareEnterprise applications
AI-assisted discovery is exposing a capacity mismatchSecurity engineering
Patchapalooza changes the economics of vulnerability managementVulnerability desk
SAP patching remains a business-process dependencyEnterprise applications
The weekend KEV watch belongs in Monday operationsVulnerability desk