Vulnerability Management

Surreal navy conceptual: a small server beneath a large red clock face — CISA's three-day federal deadline to patch the N-able N-central "God mode" flaw.

Vulnerabilities

Federal Agencies Given 3 Days to Patch the N-able N-central 'God Mode' Flaw

Seventy-two hours, not twenty-one days. CISA gave federal agencies just three days to patch the actively exploited N-able N-central "God mode" flaw that grants full administrative access to a console — and warned the vendor and MSPs that the hotfix is "not optional."

Isometric clay diorama on navy: a hosting control panel with a red key crossing into a database — the cPanel CVE-2026-58048 privilege break to database root.

Vulnerabilities

cPanel Patches CVE-2026-58048 (CVSS 9.4): A Hosting Customer Could Run SQL as Database Root

From hosting customer to database root. cPanel patched CVE-2026-58048 (CVSS 4.0 score 9.4), where an authenticated customer could execute SQL in the database's root context — crossing the account-to-admin boundary — and closed two more account-boundary routes in the same release.

Isometric clay diorama on deep navy: a red ruby gem on a rail beside an open file drawer — the critical Ruby on Rails unauthenticated file-read patch.

Vulnerabilities

Ruby on Rails Patches Critical Vulnerability — Unauthenticated File Read and Possible RCE

The fix is out. Ruby on Rails has patched the critical KindaRails2Shell flaw (CVE-2026-66066) that let unauthenticated attackers read arbitrary files and potentially reach code execution. What Rails operators should identify, upgrade, and restart now.

Isometric clay diorama on deep navy: a marketing-automation server with its access hatch open in red — the Adobe Campaign Classic CVE-2026-48449 RCE flaw.

Vulnerabilities

Adobe Campaign Classic Hit by a Second CVSS 10.0 RCE (CVE-2026-48449) — and Last Month's Patch Is the Vulnerable Build

Adobe patched CVE-2026-48449, a CVSS 10.0 incorrect-authorization flaw in on-premise Campaign Classic that can run code with no authentication and no user interaction. The catch: build 9397, which fixed July's max-severity bug, is the version this one breaks. Patch to 9398.

Flat white line-art of a build agent and a server exchanging a polling signal, with one flat red dot, on a solid background — TeamCity CVE-2026-63077.

Vulnerabilities

TeamCity CVE-2026-63077: The Agent Polling Protocol Is the Way In

A follow-up on CVE-2026-63077: JetBrains ties the CVSS 9.8 unauthenticated TeamCity RCE to insecure deserialization in the agent polling protocol — the build-agent-to-server channel. What that mechanism detail changes for your exposure check and interim mitigation.

Flat white line-art of a build-server tower with an open door and a shield patch, on a teal background — TeamCity CVE-2026-63077 unauthenticated RCE patched.

Vulnerabilities

JetBrains TeamCity On-Premises Critical Unauth RCE Patched (CVE-2026-63077, CVSS 9.8)

Every TeamCity On-Premises version is affected by CVE-2026-63077, a CVSS 9.8 unauthenticated remote code execution flaw. JetBrains shipped fixes in 2025.11.7 and 2026.1.3 this week, plus a security patch plugin for operators who cannot upgrade immediately.

Flat white line-art of a JSON document linked to a Java coffee cup and an open padlock, on a teal background — the unpatched Fastjson CVE-2026-16723 flaw.

Vulnerabilities

Unpatched Fastjson Vulnerability Now Actively Exploited

From unpatched advisory to active exploitation — Fastjson on the wire this week.

Flat white line-art of an AI chip linked to three agent shields, on a teal background — Microsoft MAI-Cyber-1-Flash and Project Perception.

Artificial Intelligence (AI)

Microsoft Unveils MAI-Cyber-1-Flash and Project Perception in Cybersecurity AI Push

More AI, more acronyms — Microsoft's cybersecurity AI debut lands this week, and it arrives wrapped in a vendor benchmark claim that tops Anthropic and OpenAI.

Flat white line-art of a JSON document feeding a Java coffee cup on a server rack, on a deep-red background — the Fastjson 1.x CVE-2026-16723 flaw.

Vulnerabilities

ThreatBook and Imperva Report Attacks Against Unpatched Fastjson 1.x RCE Vulnerability CVE-2026-16723

An unpatched Fastjson 1.x RCE under active attack — a defender review for Spring Boot deployments this weekend.

Flat white line-art of a repository panel and one open padlock beside a calendar, on a deep-teal background — GitLab RCE proof-of-concept after patch.

Vulnerabilities

Depthfirst Publishes GitLab RCE Proof-of-Concept Six Weeks After Patch; Self-Managed 18.11.3 Servers at Risk

A PoC lands six weeks after the GitLab patch — self-managed servers still on 18.11.3 accelerate remediation this weekend.

Flat white line-art of a hard-disk drive linked to a large keyhole, on a deep teal background — the RefluXFS Linux root-escape disclosure.

Vulnerabilities

Researchers Disclose Nine-Year-Old "RefluXFS" Linux Flaw Giving Local Users Root on Default RHEL Installs

Another long-standing Linux root escape lands — defender verification for RHEL-based environments this week.

Flat white line-art of a code bracket linked to a sealed testing chamber, on a teal background - Google's Gemini 3.5 Flash Cyber and managed CodeMender.

Artificial Intelligence (AI)

Google DeepMind Launches Gemini 3.5 Flash Cyber and Makes CodeMender Available as Managed AI Security Agent

Google joins the vendor-side AI-cybersecurity race with Gemini 3.5 Flash Cyber and managed CodeMender - federal-adjacent defender partnerships this week.

See all