Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.
Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept zero-day exploit demonstrating an arbitrary file read as SYSTEM that bypasses Microsoft's recent patch for Defender flaw CVE-2026-69414.
Read briefing →Security researchers uncovered a sophisticated in-memory Linux rootkit dubbed PoisonedRefresh deployed against F5 BIG-IP APM appliances, abusing Apache hooks and memory-resident web shells to evade detection and survive firmware updates.
Read briefing →cPanel has patched a high-severity SQL injection vulnerability tracked as CVE-2026-67401 in its EmailTrack module, enabling authenticated shared hosting tenants with basic mail privileges to write arbitrary files and execute code as root.
Read briefing →Microsoft released its September 2026 security updates addressing 974 flaws, headlined by two actively exploited zero-day privilege escalation vulnerabilities in the Windows ALPC mechanism and Windows Update Stack tracked as CVE-2026-85880 and CVE-2026-81963.
Read briefing →SAP released emergency security updates addressing a maximum-severity memory corruption flaw dubbed OVERPASS in the SAP Kernel. Tracked as CVE-2026-44756 with a CVSS 10.0 score, the vulnerability allows unauthenticated remote attackers to execute arbitrary code across exposed enterprise systems.
Read briefing →N-able issued an emergency hotfix for a maximum-severity unauthenticated remote code execution flaw in its N-central RMM platform, tracked as CVE-2026-86218, following conflicting disclosures of active in-the-wild exploitation.
Read briefing →SonicWall issued emergency hotfixes for two actively exploited zero-day flaws in SMA 1000 VPN appliances that attackers chained together to achieve unauthenticated remote code execution.
Read briefing →E-commerce security firm Sansec disclosed an unpatched zero-day vulnerability dubbed StyleSmuggler impacting Magento Open Source and Adobe Commerce deployments.
Read briefing →Google addressed an actively exploited zero-day flaw in Chrome's V8 JavaScript engine that allowed arbitrary code execution within the browser sandbox.
Read briefing →Threat actors compromised Coder's Cloudflare account to inject rogue endpoints serving credential-harvesting Terraform modules to engineers.
Read briefing →