Ivanti Connect Secure Zero-Days Added to CISA KEV
CISA added two actively exploited Ivanti Connect Secure flaws to the KEV catalog on October 30, while PHP php2shell and GitLab bugs stay hot.
Ivanti Connect Secure Zero-Days Added to CISA KEV
CISA added two actively exploited Ivanti Connect Secure flaws plus Cisco ASA/FTD and a max-severity GitLab bug to the KEV catalog. Patch these now.
Cisco ASA Zero-Day and GitLab CVSS 10 Hit CISA KEV
CISA added a Cisco Secure Firewall ASA/FTD zero-day and a CVSS 10 GitLab flaw to the KEV catalog on October 29, both tied to active exploitation.
PHP2Shell RCE and four fresh KEV adds to patch now
CISA flagged PHP2Shell CVE-2026-109618 and CVE-2026-109619 as actively exploited, plus new KEV adds for Brotli, Adobe Commerce, Linux Kernel, and VMware ESX.
PHP2Shell CVEs Now Exploited, Brotli Added to CISA KEV
CISA confirms the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 are being exploited, and the Brotli bug CVE-2026-111497 hits PAN-OS and beyond.
PHP2Shell CVEs Now in CISA KEV and Exploited
CISA added two PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) to KEV on October 26 as attacks hit universities and business sites. Patch now.
PHP php2shell flaws now exploited in the wild
CVE-2026-109618 and CVE-2026-109619 in PHP php2shell are now exploited in the wild, and Palo Alto confirms PAN-OS and other network products are affected.
PHP php2shell RCE Goes Wild, Two New CISA KEV Adds
Public php2shell exploit code is being used to deploy botnets, and CISA added Collabora Online and Arista VeloCloud Orchestrator flaws to the KEV catalog.
Two New KEV Adds: Arista VeloCloud and Collabora Online
CISA added Arista VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9) and Collabora Online to KEV on Oct 23, with a third VeloCloud zero-day in four months.
PHP php2shell RCE and a China-Linked M365 Campaign
PHP shipped emergency patches for two unauthenticated RCE flaws (CVE-2026-109618, CVE-2026-109619) as a China-linked actor hit 2,250 Microsoft 365 tenants.
PHP2Shell RCE Patched as Exploitation Starts
PHP shipped emergency patches on 2026-10-21 for CVE-2026-109618 and CVE-2026-109619 as first exploitation attempts hit sensors. Plex and Siemens join CISA KEV.
Two CISA KEV adds are already under active exploitation
CISA added six KEV entries on October 20, and two of them, Siemens Software Center and SiteGuard Server Edition, are being actively exploited right now.
October Windows Updates Break Exchange Mail Flow
Microsoft confirms October Windows Server updates break Exchange sign-in and mail flow, while Ivanti Connect Secure and TeamCity stay hot on the CISA KEV list.
ConnectWise Supply-Chain Attack Hits 173 Microsoft 365 Accounts
Attackers used stolen ConnectWise backup credentials to breach 173 Microsoft 365 accounts, while CISA flags a BeyondTrust zero-day and new KEV adds.
BeyondTrust Remote Support CVE-2026-102764 added to CISA KEV
CISA added BeyondTrust CVE-2026-102764 (CVSS 9.8) and Fortinet CVE-2025-61624 to the KEV catalog on Oct 16 after Chinese APT exploitation since August.
Chinese APT Exploits BeyondTrust Zero-Day, Now in CISA KEV
CVE-2026-102764, a BeyondTrust Remote Support authentication bypass with CVSS 9.8, was exploited by a Chinese APT since August and is now on the CISA KEV list.
Palo Alto PAN-OS CVE-2026-0322 added to CISA KEV
CISA flagged Palo Alto PAN-OS code injection CVE-2026-0322 as actively exploited, and a Chinese APT hit a BeyondTrust zero-day. Patch priorities for October 16.
Three network edge zero-days hit CISA KEV at once
CISA added exploited zero-days in Palo Alto PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS. Ivanti Connect Secure was added a day earlier. Patch now.
Ivanti Connect Secure and Windows Shell zero-days hit CISA KEV
CISA added CVE-2026-104935 (Ivanti Connect Secure) and CVE-2026-96951 (Windows Shell) to the KEV catalog on October 13, both actively exploited.
CISA Flags Apache Struts CVE-2016-3081 as Actively Exploited
CISA warns CVE-2016-3081 in Apache Struts is being exploited in attacks, SonicWall and Bricksforge flaws hit the wild, and GitLab ships a critical RCE fix.
Palo Alto PAN-OS CVE-2026-0257 Exploited by Ransomware
Ransomware actors are abusing the Palo Alto GlobalProtect auth bypass CVE-2026-0257, a CISA KEV flaw, for stealthy VPN access. Here is what to patch first.
Edge Devices Under Fire: Citrix, SonicWall, AhsayCBS Exploited
Citrix NetScaler RCE CVE-2026-107406 needs patching now, SonicWall SMA1000 CVE-2026-102255 is actively exploited, and AhsayCBS flaws are dropping webshells.
Citrix NetScaler RCE and five new CISA KEV adds
Citrix urges immediate patching of critical NetScaler RCE CVE-2026-107406 while CISA added five older flaws to KEV, including a perfect-10 ProFTPD bug.
Citrix NetScaler RCE and Five New CISA KEV Adds
Citrix urges immediate patching of a critical NetScaler ADC and Gateway RCE while CISA adds five old but actively exploited flaws, including a ProFTPD CVSS 10.
Atlassian CVE-2026-21589 Exploited Hours After PoC
Attackers are hitting Atlassian CVE-2026-21589 within hours of public PoC release, while JetBrains TeamCity and PAN-OS KEV flaws stay hot. Patch now.
Atlassian CVE-2026-21589 Under Active Exploitation
Attackers are exploiting critical Atlassian flaw CVE-2026-21589 after a public PoC, hitting Jira and Confluence with unauthenticated file access. Patch now.
Citrix NetScaler CVE-2026-88779 Exploited After Patch
CISA added Citrix NetScaler CVE-2026-88779 to the KEV catalog on October 4 as attackers crash appliances, including some patched days earlier.
Citrix NetScaler SAML Zero-Day CVE-2026-88779 Added to KEV
CISA added actively exploited Citrix NetScaler flaw CVE-2026-88779 to KEV on October 4, with attacks hitting appliances patched days earlier. Patch now.
NetScaler RCE zero-day exploited, Zammad flaws added to KEV
A Citrix NetScaler RCE zero-day is under active exploitation and CISA added two critical Zammad vulnerabilities to the KEV catalog on October 2.
FortiMail Zero-Day CVE-2026-104286 Actively Exploited
CISA added FortiMail path traversal CVE-2026-104286 and two Zammad flaws to KEV this week, with the FortiMail zero-day under active exploitation now.
NetScaler Zero-Days Hit Government and Finance Orgs
Suspected state-sponsored actors exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 for weeks against government and finance targets.
NetScaler Zero-Days Hit Government and Finance Orgs
Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 were exploited against government and finance orgs for weeks, with one now CISA KEV listed.
NetScaler Zero-Days Hit Government and Finance Orgs
NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 have been exploited since early September against government and finance orgs. Plus one new Apple KEV add.
CISA Adds SharePoint, WSO2, Adobe Commerce to KEV
CISA added five actively exploited flaws to the KEV catalog on September 24 and 25, including SharePoint CVE-2026-65660 and a WSO2 bug rated CVSS 10.
CISA Adds SharePoint and Adobe Commerce Flaws to KEV
CISA added Microsoft SharePoint CVE-2026-65660 and four more actively exploited flaws to KEV on September 25, including a maxed-out WSO2 path traversal.
Check Point VPN Flaws Added to CISA KEV, Now Exploited
CISA added two Check Point flaws, CVE-2026-85102 and CVE-2026-93616, plus Arista and F5 bugs to KEV on Sept 22, and attackers are already exploiting them.
CISA adds F5 BIG-IP APM and Check Point zero-days to KEV
CISA added exploited F5 BIG-IP APM, Check Point, and Arista VeloCloud zero-days to the KEV catalog on September 22, all with critical CVSS scores. Patch now.
CISA orders agencies to patch Zyxel CVE-2026-7273 by Thursday
CISA added Zyxel GS1900 switch flaw CVE-2026-7273 to KEV after Chinese hackers compromised nearly 1,000 switches for data theft. Patch by Thursday.
Exploited Linux Kernel Bugs and September Windows Patch Fallout
CISA warns of three actively exploited Linux kernel vulnerabilities while September Windows updates break File History backups. Here is what to patch first.
CISA Adds Three Linux Kernel Flaws to KEV Catalog
CISA added three actively exploited Linux Kernel vulnerabilities to the KEV catalog on September 18, including CVE-2026-53266 with a CVSS of 8.8. Patch now.
Cisco ISE Zero-Day Exploited, Plus KEV Movers to Patch Now
Cisco warns of a maximum severity Identity Services Engine zero-day under active attack, while GitLab, SonicWall, and cPanel flaws stay hot on CISA KEV.
Cisco ISE zero-day CVE-2026-76460 added to CISA KEV
Cisco ISE flaw CVE-2026-76460 (CVSS 10) is being exploited unauthenticated and is now on the CISA KEV list. Google Pixel and Acronis Backup were added too.
Cisco ISE CVE-2026-76460 and Pixel Zero-Day Hit CISA KEV
CISA added a CVSS 10 Cisco Identity Services Engine flaw, an exploited Google Pixel zero-day, and an Acronis Backup bug to the KEV catalog on September 16.
Cisco Secure Email Gateway Zero-Day CVE-2026-76461 Hits KEV
Cisco patched an actively exploited Secure Email Gateway SQL injection (CVE-2026-76461, CVSS 9.8), now on CISA KEV, that lets attackers run commands as root.
Cisco Secure Email Gateway added to CISA KEV
CISA added Cisco Secure Email Gateway SQL injection CVE-2026-76461 to KEV on Sept 14, while ScreenConnect and JFrog Artifactory flaws see active exploitation.
ScreenConnect worm-like attacks and September Windows patch fallout
ConnectWise patched a ScreenConnect flaw already exploited in worm-like attacks, while September Windows updates broke audio and RDS. Here is what to do first.
GitLab CVE-2026-85706 and ScreenConnect CVE-2026-84869 Hit KEV
CISA added a max severity GitLab path traversal flaw and a 9.9 ScreenConnect bug to KEV on September 11, with GitLab exploited one day after disclosure.
MikroTik RouterOS CVEs Added to CISA KEV, Cisco FMC Exploited
CISA added two actively exploited MikroTik RouterOS flaws to KEV on Sept 10, while Cisco FMC CVE-2026-20079 draws ransomware and state-sponsored attacks.
Cisco FMC CVE-2026-20079 Now Actively Exploited
CISA added a maximum severity Cisco Firewall Management Center authentication bypass to KEV, with ransomware and state-sponsored actors already exploiting it.
September 2026 Patch Tuesday: 974 CVEs and Two Zero-Days
Microsoft shipped a record 974 CVEs with two exploited zero-days, and CISA added four KEV entries including a Windows and N-able N-central bug. Patch now.
September Patch Tuesday breaks 974-CVE record, two zero-days
Microsoft shipped a record 974 fixes with two exploited zero-days, CISA added four KEV entries, and Google patched its seventh Chrome zero-day of 2026.
September 2026 Patch Tuesday: Microsoft Fixes 974, Two Zero-Days
September 2026 Patch Tuesday: Microsoft fixes 974 vulnerabilities, two exploited zero-days among them; Adobe patches a Magento zero-day used to backdoor sites.
CISA adds ownCloud CVE-2023-49105 to KEV catalog
CISA added ownCloud CVE-2023-49105, a Linux kernel flaw, and JFrog Artifactory to the KEV catalog on 2026-08-27, plus fresh Citrix NetScaler exploitation.
Citrix NetScaler CVE-2026-8452 Exploited, Nine New KEV Adds
Citrix NetScaler CVE-2026-8452 is now exploited in the wild and on the CISA KEV list, alongside nine new KEV additions including an ownCloud auth bypass.
August 2026 Patch Tuesday: 751 Fixes, One Exploited
Microsoft fixed 751 CVEs across 67 updates in August 2026, 108 rated Critical, and one is already being exploited. What to patch first, and why.
Adobe ColdFusion CVE-2026-48282 tops KEV movers with EPSS 0.99
Adobe ColdFusion path traversal CVE-2026-48282, CVSS 10 and CISA KEV listed, has EPSS 0.99. Plus SharePoint, Exchange, and a Zimbra campaign to check.
SharePoint CVE-2026-50522 in CISA KEV, Patch Now
Microsoft SharePoint RCE CVE-2026-50522 (CVSS 9.8) is on the CISA KEV list alongside Adobe ColdFusion CVE-2026-48282 and two Exchange flaws. Patch these first.
Russian Hackers Exploit Zimbra Zero-Day, ColdFusion Hits KEV
Russian actors are exploiting an unpatched Zimbra zero-day against US and Ukraine targets while Adobe ColdFusion CVE-2026-48282 sits on CISA KEV at CVSS 10.
Check Point SmartConsole Zero-Day CVE-2026-16232 Exploited
CISA added Check Point SmartConsole flaw CVE-2026-16232 (CVSS 9.1) to KEV after in-the-wild exploitation, alongside a SharePoint deserialization bug.
WordPress wp2shell CVEs added to CISA KEV as attacks spread
CISA added two WordPress Core flaws (CVE-2026-63030, CVE-2026-60137) to KEV on July 21 as wp2shell attacks install webshells.