Patch Management

Flat white line-art of a package box paused before a calendar gate and an hourglass, on a teal background — GitHub and PyPI supply-chain timing rules.

Supply Chain Attack

New GitHub, PyPI Policies Boost Supply Chain Security

Three days for GitHub, fourteen for PyPI — the poisoned-package window narrows this week.

Flat white line-art of a JSON document feeding a Java coffee cup on a server rack, on a deep-red background — the Fastjson 1.x CVE-2026-16723 flaw.

Vulnerabilities

ThreatBook and Imperva Report Attacks Against Unpatched Fastjson 1.x RCE Vulnerability CVE-2026-16723

An unpatched Fastjson 1.x RCE under active attack — a defender review for Spring Boot deployments this weekend.

Flat white line-art of a management console with an open lock swinging free, on a deep-blue background — the Check Point SmartConsole authentication bypass CVE-2026-16232.

Vulnerabilities

Check Point Patches Exploited SmartConsole Authentication Bypass CVE-2026-16232

A Check Point SmartConsole authentication bypass under active attack — defender teams accelerate patch verification this week.

Flat white line-art of a figure outline stepping through an open gate in a wall, on a teal background — OpenAI ChatGPT Agent AI-insider fix.

Artificial Intelligence (AI)

OpenAI Fixes ChatGPT Agent Flaw That Could Have Let Attackers Forge an AI Insider

OpenAI patches an AI-insider-forgery vulnerability in ChatGPT Agent — defender review this week.

Flat white line-art of a tall patch stack beside an enterprise server cabinet on a deep teal background — Oracle July 2026 Critical Patch Update.

Vulnerabilities

Oracle Ships July 2026 Critical Patch Update Addressing 1,400+ Vulnerabilities, Many Reportedly AI-Discovered

Oracle's July CPU pushes past 1,400 CVEs — the AI-discovery patch-volume trend continues across major enterprise vendors this week.

Flat white line-art of a shielded server tower with a single key lifted away from its lock, on a deep-blue background — SharePoint CVE-2026-50522 machine-key theft.

Vulnerabilities

Fourth Actively Exploited SharePoint Vulnerability CVE-2026-50522 (CVSS 9.8) Under Attack After PoC Release

SharePoint's fourth actively-exploited flaw in a month lands with a machine-key-theft twist — defender teams patch AND rotate this week.

Editorial illustration of an opened archive box releasing a spark during extraction, marking the 7-Zip CVE-2026-14266 heap overflow in XZ chunked data handling.

Vulnerabilities

Trend Micro ZDI Discloses 7-Zip CVE-2026-14266 Heap Buffer Overflow in XZ Chunked Data Handling

A crafted XZ archive can run code in 7-Zip — defender teams verify the 26.02 update this week.

Editorial illustration of many website blocks toppling like dominoes past an alarm bell, marking wp2shell WordPress mass exploitation putting millions of sites at risk.

Vulnerabilities

wp2shell WordPress Mass Exploitation Expands; Millions of Sites at Risk

wp2shell moves from active exploitation to mass takeover — hosting providers and defender teams accelerate remediation this week.

Editorial illustration of a figure stepping out of a cracked sandbox tray — ServiceNow AI Platform CVE-2026-6875, a CVSS 9.5 sandbox escape under active attack.

Vulnerabilities

ServiceNow AI Platform CVE-2026-6875 (CVSS 9.5 Sandbox Escape) Under Active Exploitation

A ServiceNow AI Platform sandbox escape under active attack — defender teams accelerate patch verification this week.

Editorial illustration of an NGINX worker gear cracking under an overloaded heap stack with a fresh patch, marking F5's critical CVE-2026-42533 fix.

Vulnerabilities

F5 Publishes Critical NGINX Patch for Heap Buffer Overflow (CVE-2026-42533) That Could Enable Denial of Service or RCE

A critical NGINX flaw with remote-unauthenticated attack surface — defender verification across NGINX and NGINX Plus deployments this week.

Editorial illustration of a website building block with an open door and an alarm bell ringing, marking active exploitation of the wp2shell WordPress vulnerabilities.

Vulnerabilities

wp2shell WordPress Vulnerabilities (CVE-2026-60137 and CVE-2026-63030) Confirmed Exploited in the Wild

wp2shell moves from disclosure to active exploitation — defender teams and hosting providers accelerate verification this week.

Editorial illustration of a website building block sealed with two patches, marking the WordPress 7.0.2 release fixing wp2shell and a SQL-injection flaw.

Vulnerabilities

WordPress Ships 7.0.2 Security Release Patching Two High-Severity Vulnerabilities

WordPress ships the 7.0.2 patch pairing wp2shell with a fresh SQL-injection CVE — defender teams and hosting providers apply immediately this weekend.

See all