Vulnerabilities
Microsoft patched UnDefend (CVE-2026-41091) and RedSun (CVE-2026-45498), two Defender zero-days exploited in the wild since April. Their purpose is the security tool itself — one escalates through Defender, the other disables it. Barracuda ties the wave to the researcher behind MiniPlasma.
Vulnerabilities
Microsoft released mitigations for YellowKey (CVE-2026-45585), a BitLocker bypass disclosed by the researcher behind MiniPlasma. A USB port and a reboot defeat the encryption on any TPM-only device — and the only fix is a TPM+PIN configuration change, not a patch.
Vulnerabilities
cPanel released its second emergency Technical Security Release in 10 days on May 8, patching three new vulnerabilities (CVE-2026-29201, CVE-2026-29202, CVE-2026-29203) just after CVE-2026-41940 compromised an estimated 44,000 servers. The pattern is the story.
Vulnerabilities
CISA confirmed active exploitation of two vulnerabilities — a ConnectWise ScreenConnect path traversal flaw linked to Medusa ransomware and a Microsoft Windows Shell spoofing bug attributed to Russian APT28 — adding both to its Known Exploited Vulnerabilities catalog with a federal patching deadline of May 12, 2026. WASHINGTON, D.C. — The Cybersecurity
Vulnerabilities
A critical cPanel/WHM authentication bypass — CVE-2026-41940 — let attackers reach hosting control panels with no credentials, and was exploited as a zero-day for months before April's emergency patch. What to patch, lock down, and hunt for.
Vulnerabilities
A file-upload bug in the Breeze Cache plugin is under active exploitation, but only sites with the optional “Host Files Locally – Gravatars” feature enabled appear exposed. The issue highlights how a niche plugin setting can create outsized risk across a large WordPress install base. VALENCIA, SPAIN — Threat actors have
Vulnerabilities
A dormant TOCTOU race in PackageKit — the daemon almost every Linux distro ships — lets any local user poison a transaction and install a root-owned package with no password. It hid for 12 years, and a public exploit is already out.
Vulnerabilities
Oracle has released its massive April 2026 Critical Patch Update (CPU), addressing 450 security flaws across its global product suite, including critical vulnerabilities that allow for unauthorized remote code execution. Austin, TX — Oracle Corporation has issued its quarterly security offensive, releasing a comprehensive set of patches to address hundreds of
Trending
Adobe has issued an emergency out-of-band update to address a critical memory corruption vulnerability that allowed threat actors to exfiltrate data from targeted workstations for months. SAN JOSE, CA — Adobe has released emergency security updates for Acrobat and Acrobat Reader to patch a critical zero-day vulnerability, tracked
Patch Management
In an unprecedented escalation of its security communications, Apple has begun pushing urgent, full-screen "Critical Software Alerts" to millions of iPhone and iPad users. The notifications, which bypass standard "Do Not Disturb" settings, warn users that their devices are running outdated versions of iOS 17
Cybersecurity 101
A clear guide to why unpatched software is one of the biggest security risks — why known vulnerabilities are so dangerous, the challenges of patching, and how to build a resilient patch management strategy.