Network Security

Flat white line-art of a network orchestrator console with a single open door, on a deep-teal background — the Arista VeloCloud Orchestrator command-injection zero-day.

Vulnerabilities

Arista VeloCloud Orchestrator Zero-Day (CVE-2026-16812, CVSS 10.0) Under Active Exploitation

CVSS 10.0 on the on-premises SD-WAN management box — Arista has shipped fixes, active exploitation is confirmed, and CISA has put federal agencies on a short clock.

Flat white line-art of a server management chip sitting beneath a stacked server, one door left ajar, on a deep-teal background — internet-exposed BMC IPMI hash disclosure.

Vulnerabilities

24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

Twenty-four thousand hash leaks underneath the OS — the BMC exposure map lands this week, and the fix is not a patch but a posture change.

Flat white line-art of a forum message board with an open padlock, on a deep-blue background — the vBulletin pre-auth code-execution exploit.

Vulnerabilities

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

Patch first, patch fast — a public vBulletin exploit lands this week.

Flat white line-art of a management console with an open lock swinging free, on a deep-blue background — the Check Point SmartConsole authentication bypass CVE-2026-16232.

Vulnerabilities

Check Point Patches Exploited SmartConsole Authentication Bypass CVE-2026-16232

A Check Point SmartConsole authentication bypass under active attack — defender teams accelerate patch verification this week.

Editorial illustration of an NGINX worker gear cracking under an overloaded heap stack with a fresh patch, marking F5's critical CVE-2026-42533 fix.

Vulnerabilities

F5 Publishes Critical NGINX Patch for Heap Buffer Overflow (CVE-2026-42533) That Could Enable Denial of Service or RCE

A critical NGINX flaw with remote-unauthenticated attack surface — defender verification across NGINX and NGINX Plus deployments this week.

Line-art of two magnifiers over a breached gateway appliance revealing a fingerprint, marking Volexity's UTA0533 attribution of the SonicWall SMA zero-days.

Threat Intelligence

Volexity Attributes SonicWall SMA Zero-Day Exploitation to Previously Undocumented UTA0533 Actor Since June 22

A second SonicWall SMA attribution lands — Volexity names UTA0533 alongside the Dark Reading INC Ransomware framing this weekend.

Editorial illustration of a banner planted on a breached gateway appliance, marking attribution of SonicWall SMA zero-day exploitation to INC Ransomware.

Ransomware

Dark Reading Attributes SonicWall SMA Zero-Day Exploitation to INC Ransomware Operation

INC Ransomware named as the SonicWall SMA zero-day exploiter — defender teams stay in accelerated verification posture this weekend.

Editorial illustration of a sandbox tray cracked open beside a two-day calendar, marking CISA's urgent-patch order for exploited Fortinet FortiSandbox flaws.

Vulnerabilities

CISA Mandates Urgent Patching for Actively Exploited Fortinet FortiSandbox Vulnerabilities (July 19 Deadline)

Two FortiSandbox flaws under active attack — CISA's July 19 deadline puts defender teams on the clock this week.

Vulnerabilities

F5 Publishes Patches for Multiple NGINX and BIG-IP Vulnerabilities

F5's July patch cycle continues — defender verification across NGINX and BIG-IP deployments this week.

Editorial illustration of a timeline with a wide gap between an early marker and a patch marker, marking SonicWall SMA zero-days exploited weeks before disclosure.

Vulnerabilities

CyberScoop Reports SonicWall SMA 1000 Zero-Days Were Reportedly Exploited Three Weeks Before Vendor Disclosure

A three-week pre-disclosure exposure window for the SonicWall SMA zero-days — defender teams review the timeline this week.

Editorial illustration of a gateway appliance with a severity dial pinned to maximum, marking SonicWall SMA 1000 zero-days CVE-2026-15409 and CVE-2026-15410.

Vulnerabilities

SonicWall SMA 1000 Zero-Days Detailed: CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 (Admin Command Execution)

SonicWall's SMA 1000 zero-days now have CVE-level detail — defender teams accelerate patch verification this week.

Editorial illustration of an envelope crossing between two mailboxes with a key tag, representing RabbitMQ OAuth and cross-tenant metadata flaws.

Vulnerabilities

Researchers Disclose RabbitMQ Flaws That Could Leak OAuth Secrets, Expose Cross-Tenant Queue Metadata

A message-queue vulnerability with OAuth and multi-tenancy implications — defender review for RabbitMQ deployments this week.

See all