Patch Management

Flat white line-art of a magnifying glass scanning stacked browser windows with one flat red dot, on a deep blue background — AI-found Chrome flaws.

Vulnerabilities

Google's AI Agent Harness Found a 13-Year-Old Chrome Flaw — and 1,442 Bugs Across Three Releases

Google's agent harness surfaced a sandbox-escape bug that hid in Chrome for 13 years. The scale behind it: 1,442 fixes across Chrome 149, 150 and 151 — more than the prior 23 milestones combined. For defenders, the problem is now absorbing patches as fast as AI can find them.

Flat white line-art of a magnifying glass over a browser window holding a bug, on an emerald background — Chrome 151's AI-assisted patch release.

Vulnerabilities

Chrome 151 Ships 370 Vulnerabilities in Single Release — Thanks to AI Bug Hunting

Three hundred seventy CVEs in one release — Chrome's AI patch cadence lands this week.

Flat white line-art of a firewall console opened by a built-in key, on a teal background — the Cisco FMC static-credentials zero-day, CVE-2026-20316.

Vulnerabilities

Cisco FMC Zero-Day CVE-2026-20316 Actively Exploited via Static Credentials

Static credentials shipped inside a firewall manager handed attackers a built-in way in. Cisco has released hot fixes for Secure Firewall Management Center, and the zero-day is already on CISA's exploited-vulnerabilities list.

Flat white line-art of an upload arrow feeding a large folder that opens to a key, on a crimson background — the Rails KindaRails2Shell file-read flaw.

Vulnerabilities

KindaRails2Shell — Critical Rails File Read and Possible RCE (CVE-2026-66066)

From a single image upload to arbitrary file read, and possibly remote code execution — Ruby on Rails has patched the critical Active Storage flaw its finders call KindaRails2Shell, and defenders running Rails should verify their version this week.

Flat white line-art of a magnifying glass over a management console and a script sheet, on a teal background — Check Point SmartConsole CVE-2026-16232 PoC.

Vulnerabilities

Rapid7 Publishes Public PoC for Exploited Check Point SmartConsole Auth Bypass

From advisory to public PoC — Check Point SmartConsole in the spotlight this week.

Flat white line-art of a network orchestrator console with a single open door, on a deep-teal background — the Arista VeloCloud Orchestrator command-injection zero-day.

Vulnerabilities

Arista VeloCloud Orchestrator Zero-Day (CVE-2026-16812, CVSS 10.0) Under Active Exploitation

CVSS 10.0 on the on-premises SD-WAN management box — Arista has shipped fixes, active exploitation is confirmed, and CISA has put federal agencies on a short clock.

Flat white line-art of a build-server tower with an open door and a shield patch, on a teal background — TeamCity CVE-2026-63077 unauthenticated RCE patched.

Vulnerabilities

JetBrains TeamCity On-Premises Critical Unauth RCE Patched (CVE-2026-63077, CVSS 9.8)

Every TeamCity On-Premises version is affected by CVE-2026-63077, a CVSS 9.8 unauthenticated remote code execution flaw. JetBrains shipped fixes in 2025.11.7 and 2026.1.3 this week, plus a security patch plugin for operators who cannot upgrade immediately.

Flat white line-art of a phone and a laptop beside a large shield, on a deep-blue background — Apple's iOS and macOS Tahoe patch cycle.

Vulnerabilities

Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe

87 for iOS, 155 for macOS Tahoe — Apple's biggest patch drop of the quarter lands this week, with no in-the-wild exploitation reported.

Flat white line-art of a router receiving a network packet beside a shield, on a solid background — OpenWrt's CVE-2026-53921 DHCPv6 patch.

Vulnerabilities

OpenWrt 24.10.8 Patches Critical DHCPv6 Unauth RCE (CVE-2026-53921, CVSS 9.8)

A CVSS 9.8 unauthenticated remote-code-execution flaw sits in odhcpd, OpenWrt's default-on DHCPv6 server. The project shipped 24.10.8 to close it, and router operators should push firmware this week.

Flat white line-art of a JSON document linked to a Java coffee cup and an open padlock, on a teal background — the unpatched Fastjson CVE-2026-16723 flaw.

Vulnerabilities

Unpatched Fastjson Vulnerability Now Actively Exploited

From unpatched advisory to active exploitation — Fastjson on the wire this week.

Flat white line-art of a forum message board with an open padlock, on a deep-blue background — the vBulletin pre-auth code-execution exploit.

Vulnerabilities

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

Patch first, patch fast — a public vBulletin exploit lands this week.

See all

Google's AI Agent Harness Found a 13-Year-Old Chrome Flaw — and 1,442 Bugs Across Three Releases

Chrome 151 Ships 370 Vulnerabilities in Single Release — Thanks to AI Bug Hunting

Cisco FMC Zero-Day CVE-2026-20316 Actively Exploited via Static Credentials

Three Critical VMware vCenter Flaws Patched — Auth Bypass, RCE, and VM Escape

KindaRails2Shell — Critical Rails File Read and Possible RCE (CVE-2026-66066)

Rapid7 Publishes Public PoC for Exploited Check Point SmartConsole Auth Bypass

Arista VeloCloud Orchestrator Zero-Day (CVE-2026-16812, CVSS 10.0) Under Active Exploitation

JetBrains TeamCity On-Premises Critical Unauth RCE Patched (CVE-2026-63077, CVSS 9.8)

Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe

OpenWrt 24.10.8 Patches Critical DHCPv6 Unauth RCE (CVE-2026-53921, CVSS 9.8)

Unpatched Fastjson Vulnerability Now Actively Exploited

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw