https://kevinthecyberguy.com/vuln-watch Zero-days and actively exploited vulnerabilities affecting mainstream platforms, curated by Kevin Swaney. Only what matters, with what to do about it. en-us Sat, 14 Nov 2026 12:00:00 GMT https://kevinthecyberguy.com/vuln-watch CISA added the Check Point DynamicCLI flaw to KEV on November 13, due November 16. Install the November Jumbo Hotfix now, starting with internet-facing Mobile Access portals. By Kevin Swaney. Sat, 14 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added the UnrealIRCd flaw to KEV on November 13, due November 16. Apply the vendor mitigations now. By Kevin Swaney. Sat, 14 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Attackers used cloud ScreenConnect panels to push rogue clients and the SCKit toolkit to 288 endpoints in 90 minutes. Disable the five extensions and update technician clients to 26.6.5. By Kevin Swaney. Fri, 13 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch 4EverAble2Shell gives unauthenticated attackers root on N-central servers already running the HF2 patch. Disable the Legacy API now, there is no fix yet. By Kevin Swaney. Fri, 13 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Citrix patched 28 NetScaler flaws, nine of them critical, plus a critical Console auth bypass. Update ADC and Gateway now. By Kevin Swaney. Fri, 13 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch A researcher published proof-of-concept code for more than 30 N-central flaws, and attackers are already scanning for them. Update to N-central 2026.4 HF2 now. By Kevin Swaney. Thu, 12 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch A public proof of concept turns a local Windows user into SYSTEM through the CLFS driver, and there is no patch yet. Watch for unexpected .cnpf files. By Kevin Swaney. Thu, 12 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch A crafted cookie logs an attacker into Xen Orchestra as an admin, and Vates confirms it is being exploited. Update to 6.9.2 or 6.10.1. By Kevin Swaney. Thu, 12 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Apache 2.4.71 fixes a critical heap overflow in mod_http2 that can lead to remote code execution. No public exploit yet. By Kevin Swaney. Thu, 12 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Open a crafted message file and Outlook hands over your NTLM login hash. Install the November updates now, starting with Outlook. By Kevin Swaney. Wed, 11 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch A pre-auth bypass plus a command injection can hand attackers root on the appliance. Patch by Friday, November 13. By Kevin Swaney. Wed, 11 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Four unauthenticated CVSS 10 flaws in SAP NetWeaver, including a Gateway default that treats outsiders as trusted servers. By Kevin Swaney. Wed, 11 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Chrome CVE-2026-125350 is now in CISA's exploited list, along with Cisco BroadWorks and Openwave flaws. Due November 24. By Kevin Swaney. Wed, 11 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch A malicious page can run attacker code through a use-after-free flaw in Chrome's XML parser. Update to Chrome 157 and restart. By Kevin Swaney. Tue, 10 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch All four have confirmed exploitation in the wild and a November 12 federal deadline. Patch OpenSSH, GPUStack, FreeSWITCH, and Aspera Faspex before Thursday. By Kevin Swaney. Tue, 10 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Attackers came in through a third-party cloud provider and reached Fireworks dev machines. Rotate your Fireworks API keys and check billing for abuse. By Kevin Swaney. Tue, 10 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Northflank says the first secrets were decrypted hours before the first alert, and stolen AI keys were already being abused. Rotate AI and payment keys first. By Kevin Swaney. Mon, 9 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Apiiro found 1,122 public copies of .claude/settings.local.json holding secrets, and 215 files slipped past both gitleaks and TruffleHog. Rotate any credential the file ever held. By Kevin Swaney. Mon, 9 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch SonicWall says GMS 9.5.2 and earlier will get no fix for a 9.1 unauthenticated file read or a 6.8 SQL injection. Migrate to Network Security Manager and isolate GMS until then. By Kevin Swaney. Sun, 8 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Previdian reports the first exploitation attempt less than nine hours after disclosure, with root on an Alpine honeypot. Upgrade to OpenSSH 10.6p2 and restart sshd. By Kevin Swaney. Sun, 8 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added CVE-2026-19868 to KEV on November 6, confirming exploitation in the wild. Upgrade SonicOS to 7.3.4-7013 or 8.2.3-8015 or later; no workaround exists. By Kevin Swaney. Sat, 7 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch A password of 257 to 1,024 bytes is accepted for passwordless accounts on musl libc systems without PAM, notably Alpine Linux. Upgrade to OpenSSH 10.6p2 or disable password logins. By Kevin Swaney. Sat, 7 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch ESET reported November 3 that Russia-aligned Gorbag uses weaponized RAR archives exploiting CVE-2025-8088 to deploy the BeautyStealer infostealer. Update WinRAR to 7.13 or later. By Kevin Swaney. Fri, 6 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added Apple CVE-2024-27834 to KEV on November 4, linked to Sekoia's Poisoned Source campaign. Update every iPhone, iPad, and Mac, especially older devices still on iOS 16.7. By Kevin Swaney. Thu, 5 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Singapore CSA warned November 4 that CVE-2026-72898 is actively exploited with a public proof of concept. Update self-hosted Metabase to the fixed release for your branch, or block the reset_password endpoint. By Kevin Swaney. Thu, 5 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added WordPress CVE-2026-119977 to KEV on November 3, with a federal due date of November 6. Update to 7.1.4 or the fixed release for your branch, and block web access to wp-content/upgrade if you cannot patch yet. By Kevin Swaney. Wed, 4 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Zyxel confirmed a second GS1900 root flaw on November 3 after Binarly found all ten earlier fixed releases still open. Update to the October 22 fix or newer and rotate credentials on exposed switches. By Kevin Swaney. Wed, 4 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch VulnCheck caught exploitation of the CVSS 10.0 Node-RED flaw on Siemens gateways on October 30. Update to Industrial OS V4.3.4.1 or later, or take Node-RED off the public internet behind authentication. By Kevin Swaney. Wed, 4 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added both Ivanti flaws to KEV on October 30. Upgrade to 22.8R2.6 or 25.1.1.3, and do not trust a clean Integrity Checker result on a box exposed since early October. By Kevin Swaney. Sat, 31 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Drupal warned October 28 that its Commerce Core flaw is under active attack across more than 42,000 sites. Upgrade to 3.3.13 or 8.x-2.41 and audit orders. By Kevin Swaney. Sat, 31 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Wordfence blocked 62,969 exploit attempts in 24 hours after the October 28 patches. Update WordPress Core to 7.1.4. By Kevin Swaney. Sat, 31 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added the GitLab flaw to KEV on October 29, with a federal due date of November 1. Upgrade to 19.2.8, 19.3.5, or 19.4.2 or later, and check Ruby too: source and custom installs need Ruby 3.3.13, 3.4.12, or 4.0.9. By Kevin Swaney. Fri, 30 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added the Linux kernel flaw to KEV on October 28, with a federal due date of October 31. Apply the distribution kernel update, reboot, and hunt for webshells, since patching PHP alone is not enough. By Kevin Swaney. Thu, 29 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added the VMware ESX logging flaw to KEV on October 28, with a federal due date of November 11. CrowdStrike says Warp Panda used it as a zero-day against the US legal sector. Apply the July 2026 Broadcom builds. By Kevin Swaney. Thu, 29 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Cisco patched the ASA and FTD SSL VPN denial-of-service zero-day on October 28 after finding exploitation in October. An unauthenticated attacker can force a device reload. Disable secondary authentication on affected tunnel groups if you cannot patch yet. By Kevin Swaney. Thu, 29 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Talos detailed KeyDrift on October 28: an implant on SD-WAN Controllers that copies AES-256 traffic keys from decrypted control messages. Patching alone does not remove an existing implant or un-steal copied keys. By Kevin Swaney. Thu, 29 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added PolyShell to KEV on October 27, with a federal due date of November 10. Adobe fixed it in July in APSB26-73, so confirm the 2026-jul build and hunt uploads, CMS blocks, and rogue admins. By Kevin Swaney. Wed, 28 Oct 2026 09:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added the Brotli decoder flaw to KEV on October 27, with a federal due date of November 10. Update Brotli to v1.2.1 and apply downstream runtime updates. By Kevin Swaney. Wed, 28 Oct 2026 09:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Apple 27.2 fixes 163 iOS flaws and 263 macOS flaws, about 140 shared. Update current iPhones, iPads, and Macs now; this is separate from the older-device 18.7.11 backport. By Kevin Swaney. Wed, 28 Oct 2026 09:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Arctic Wolf found more than 400 incidents of fake IT support over external Teams chat, often after mail bombing, with payload execution in under 15 minutes. Verify IT through a known channel. By Kevin Swaney. Wed, 28 Oct 2026 09:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added both PHP2Shell flaws to KEV on October 26, with a federal due date of October 29. Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and hunt for compromise before assuming the patch closed the incident. By Kevin Swaney. Tue, 27 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, finally patching the exploited CoreGraphics flaw for older devices. Update iPhone XS, XR, and similar devices now. By Kevin Swaney. Tue, 27 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch UNM Health diverted ambulances and canceled 30+ clinic appointments on October 26. A Byod ransomware claim about the incident is UNVERIFIED and not corroborated by UNM. By Kevin Swaney. Tue, 27 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Check Point profiled Aokigahara, which steals AI app sessions, Git and SSH credentials, and cloud configs from endpoints. Revoke sessions and keys from a clean system, not just passwords. By Kevin Swaney. Tue, 27 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Canada's Cyber Centre warned on October 23 that CVE-2026-106173 is being exploited in the wild. Upgrade FortiSIEM 7.5.0 to 7.5.1, restrict TCP 27918, and hunt scheduled script timestamps. By Kevin Swaney. Mon, 26 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch A honeypot recorded confirmed remote code execution against Apache mod_php on PHP 8.4.26, with an 800 KiB decoded cookie dump before the shell command. Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. By Kevin Swaney. Mon, 26 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Whitearmor posted a leak site claim naming J.B. Hunt with a $5 million demand; no part of the claim is independently verified and no confirmation from J.B. Hunt was found. Treat it as a trigger to verify, not proof of a breach. By Kevin Swaney. Mon, 26 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Group-IB and NyxLab disclosed a k0t campaign that harvested 70,000+ credentials from exposed Fortinet and Palo Alto appliances via CVE-2025-64446, CVE-2026-0257, and brute force, persisting with MeshCentral and AdaptixC2. Patch edge devices, pull management off the internet, and rotate stored credentials. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Everest claimed 590 GB from PwC on October 22; PwC confirmed on October 23 that a third-party learning platform vendor was hit, saying no client or sensitive personal data was involved. The 590 GB figure itself is unverified. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Capcom confirmed on October 24 that hackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer accounts. Change that password, enable MFA, and watch for phishing built on gaming account details. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch BlackX, a UEFI bootkit from an early 2026 espionage campaign, exploited the Baton Drop flaw to bypass Secure Boot and load a driver that interferes with Kaspersky and Avast protections. Enforce Secure Boot validation and apply firmware updates. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added CVE-2026-110447 to KEV on October 23, confirming active exploitation of the Collabora Online Built-in CODE Server command injection. Upgrade richdocumentscode to 26.4.303 or later, or remove the app, and hunt for web shells left behind. By Kevin Swaney. Sat, 24 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Qilin published a leak-site listing naming Commonwealth Community Bank on October 24. Nothing beyond the listing is confirmed, so treat it as a trigger to verify, not proof of a breach. By Kevin Swaney. Sat, 24 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Arista disclosed CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator On-Prem under active exploitation: the lowest-privilege read-only role can escalate to superuser. Patch on-prem VCO to 5.2.3.18, 6.1.3.10, or 6.4.2.12, restrict the web interface to admin networks, and block the two observed attacker IPs. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CVE-2026-113380 in Signal's RingRTC calling library lets a malicious caller flood the call's event queue so your hang-up never processes, keeping audio and possibly video streaming after you think the call ended. Update Signal; the fix is RingRTC 2.72.0. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Sophos named BRONZE SANDCASTLE, a China-aligned cluster active since mid-2025, using DLL sideloading through legitimate signed apps like Sandboxie to deploy encrypted in-memory backdoors across Asia and Africa. Hunt the loader sequence, not single files: adjacent DLLs, config.ini reads, and vssadmin or ntds.dit access. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Cisco patched 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications, including a critical RCE-as-root in Expressway (CVE-2026-76466). No exploitation reported yet. Update Expressway to X15.5.20 and Snort 3 to 3.12.4.0 in your next maintenance window. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Fixes landed October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but details leaked October 20 and AWS honeypots caught exploit attempts starting October 17. Patch PHP everywhere today: the flaw is in the interpreter, not any one app. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Ten vulnerabilities fixed October 21 across Node 26.x, 24.x, and 22.x. The worst is an out-of-bounds write in the Brotli decoder that can run attacker code. Upgrade to 26.12.1, 24.22.1, or 22.23.4, including containers, runners, and bundled products. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch An unauthenticated RCE affects self-managed GitLab all the way back to 7.0 (2014). If you patched the October 12 bug, you are not done: fixed releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch LiteLLM 1.107.0 carried malware in all seven PyPI wheels and the Docker images, delivered through stolen GitHub CLI OAuth tokens. If you pulled it anywhere, treat the host as compromised and rotate every secret it could see. Last safe version: 1.106.2. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch The FBI, CISA, the US Secret Service, and German and UK agencies published joint advisory AA26-293A on SafePay ransomware, active since August 2024 with 600+ victims. It names five exploited edge-device CVEs and ships fresh IOCs. Patch edge devices, enforce MFA on remote access, and hunt for LOLBin activity. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Unit 42 confirms Qilin, INC, and Settra ransomware operators are actively exploiting the PAN-OS GlobalProtect authentication bypass, in CISA KEV since May 2026. Attackers establish VPN sessions that look legitimate and can bypass MFA. Patch now and explicitly terminate existing sessions. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Burger King Japan disclosed that attackers accessed a mobile-app customer database between October 2 and 7, exposing 11 million records with names, birth dates, and phone numbers. No payment card data reported so far. Segment customer data stores away from app servers and watch for targeted phishing. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch The n0n ransomware group listed 38 maritime firms across 18 countries, demanding $2.4M to $14M in Bitcoin per target with an October 19 deadline. The claims are UNVERIFIED; no victims have confirmed incidents. Maritime and OT-adjacent firms should verify backups, segment OT networks, and hunt the group's tooling. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Beyond Gravity, Switzerland's state-owned space company, disclosed a targeted cyberattack by what it called a highly professional threat actor, with Chinese involvement suspected internally. Aerospace suppliers should treat this as a supply-chain warning: segment engineering networks and enforce phishing-resistant MFA on privileged accounts. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Comparitech reports ransomware attacks against US healthcare organizations rose 64% in Q3 2026, with confirmed attacks exposing 618,149 patient and staff records. Healthcare CISOs should assume they are in the target set: segment clinical systems, drill downtime procedures, and ensure backups can restore EHRs without paying. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Canva confirmed enterprise customer records were exposed after attackers hit Canny, a third-party feedback tool with a standing connection into its Salesforce environment. The Seven Deadly Sins group claims it spent 72+ hours inside Canva's Salesforce and sold the data; claimed volumes are unverified. Audit every third-party app with persistent CRM access. By Kevin Swaney. Mon, 19 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Apple patched CVE-2026-20700, a memory corruption flaw in dyld that lived in every Apple OS for nearly twenty years, exploited in extremely sophisticated targeted attacks chained with two December 2025 WebKit zero-days. In CISA KEV. Update to iOS 26.3 / macOS Tahoe 26.3 or the legacy releases now. By Kevin Swaney. Mon, 19 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch UTA0576 has exploited Ivanti Connect Secure appliances since October 3, including a fully patched 22.8R2.4 build, chaining CVE-2026-104935 with an RCE and an unpatched privilege escalation. The actor runs entirely in memory with no malware, evading Ivanti's Integrity Checker Tool. Patch now and hunt the published artifacts; assume cached AD credentials are burned. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Adobe's October 13 emergency bulletin patched CVE-2026-103849, a CVSS 10.0 pre-auth RCE in the Magento email template engine. Sansec reproduced four attack paths in 24 hours and warns working exploits are days away. Not yet in CISA KEV. Update to the 2026-oct releases and keep September's StyleSmuggler fix in place. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Helix added Quikrete and Bay Alarm to its leak site October 17-18 with timed-release download links. Neither company has confirmed an incident; no attack vector or data volume disclosed. Treat as extortion pressure, not a confirmed breach. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Ledger confirmed unauthorized implants in wallets sold via reseller CryptoBilis that read the 24-word recovery phrase off the screen and transmit it over LTE, undetectable by Genuine Check. Buy direct from the manufacturer; if you bought from CryptoBilis, move funds to a fresh wallet. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch BeyondTrust disclosed CVE-2026-102764 on October 15: an unauthenticated file-operations flaw in Remote Support exploited since late August by ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor. Added to CISA KEV October 16 with a federal deadline of October 19. Patch BT26-05-RS and treat every exposed appliance as potentially compromised. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch CISA added CVE-2025-61624 to KEV on October 16: a path traversal in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that Unit 42 says attackers used to deploy PEERSTITCH, a memory-resident implant evading FortiOS detection. Federal deadline October 19. Patch per FG-IR-26-122 and hunt rogue FortiManager registrations. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Trojanized Rank Math SEO PRO 3.0.123 packages served October 15-16, 2026 carried a backdoor with C2 at rank1cdn[.]com, planting hidden PHP backdoors, rogue admins, and credential harvesters. Update to 3.0.124 and treat any install from the 11-hour window as fully compromised. CVSS 9.8. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Attackers are actively exploiting CVE-2026-110447, a critical command execution flaw in the Collabora Online Built-in CODE Server app, to backdoor Nextcloud servers. Upgrade to 26.4.303 or later and do forensics: a patched server is no proof it was never compromised. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Central Ohio Primary Care acknowledged an August vishing attack that exposed protected health and personal information of more than 1.4 million patients and employees. No malware was needed; the attacker posed as a trusted source to reach PHI files. The Chaos ransomware group's claimed credit is UNVERIFIED. Require call-back verification for any voice request that moves access or credentials. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Microsoft, Health-ISAC, JC3, and partners disrupted the YAM Store marketplace and its CoGUI, Haozi, and Iron Man phishing kits under a federal court order. The kits supported 1B+ messages since January 2026 against 75,000+ organizations. Hunt Entra ID sign-in logs for device-code flow abuse and audit app consent grants; the operators persist through app-only auth with stolen client secrets. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch The DOJ charged 14 individuals and seized roughly 187 computers, targeting 40+ laptop farms in the Famous Chollima group's North Korean remote IT worker scheme. Vet every remote worker like a privileged account: verify identity, audit remote access logs for geographic anomalies, and geofence VPN and remote desktop. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Cisco disclosed CVE-2026-76519, a path traversal in Secure Email Gateway's Advanced Malware Protection that lets an unauthenticated attacker run commands as root via a crafted email attachment. Second SEG zero-day in a month. Federal remediation deadline October 17. Check Content Scanner Tools version via the contentscannerstatus CLI and hunt for Cisco's compromise-indicator alerts. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Palo Alto Networks disclosed CVE-2026-0322, a code injection in the PAN-OS management interface that gives an authenticated attacker with network access root on the firewall. Very limited exploitation observed. Federal deadline October 17. Restrict management access to trusted internal IPs, patch now, enable Threat IDs 510046 and 510047 for interim coverage. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch UTA0576 chained three zero-days on Ivanti Connect Secure for unauthenticated root: an auth bypass and file-write race (CVE-2026-104935) plus an unpatched privesc. The actor stole domain credentials, hunted LAPS and BitLocker keys, and wiped logs. In-memory-only payloads evade Ivanti's Integrity Checker. Patch to 22.8R2.5, 25.1.1.2, 25.1.3.0, or 25.1.3.1, then forensically hunt. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Of 1,400+ October Patch Tuesday fixes, CVE-2026-96951 was already exploited in the wild: a Windows Shell command injection that bypasses Mark of the Web, stripping warnings from downloaded files. Deploy across Windows 10, 11, and Server first. Two other disclosed zero-days show no confirmed exploitation yet. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch N0n claims encrypted files at Florida architecture firm Company #22 with stolen data to be exposed October 14 at 12:00 UTC. No verified samples, no company statement, no ransom demand disclosed. A claim with a deadline is still just a claim. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Microsoft shipped an out-of-band Exchange Server update on October 2 for CVE-2026-96940, an elevation-of-privilege flaw (CVSS 8.8) that lets an authenticated attacker read other users' mailboxes in the same organization. No exploitation observed yet, but Microsoft tags it "Exploitation More Likely." If you run on-prem Exchange, apply the update now. Tue, 13 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch The Gentlemen ransomware group has listed KFC on its leak site, alongside this week's Deloitte and MoneyGram claims. No data samples posted, no company confirmation. Treat as a claim, not a confirmed breach. Tue, 13 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch An integer overflow in GitLab's CI/CD Regular Expression Compiler lets an unauthenticated attacker run arbitrary code on self-managed CE/EE servers via a crafted regex in a CI/CD configuration. Upgrade to 19.2.8, 19.3.4, or 19.4.2 immediately. GitLab.com already patched. Update October 30: now confirmed exploited, added to CISA KEV October 29, 2026. Mon, 12 Oct 2026 22:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Memory overflow in NetScaler ADC/Gateway (CVSS 9.5) allowing RCE or DoS on appliances configured as SAML SP or IdP. Third NetScaler patch round in under two weeks. Upgrade to 14.1-73.46+, 13.1-64.29+, or corresponding FIPS builds. Citrix reports no known exploitation; CISA urged patching October 9. Mon, 12 Oct 2026 22:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch The five CVEs tied to China-linked Flax Typhoon carried an October 11 federal remediation deadline. That date has passed. The FBI seized seven domains tied to the campaign's MicroScan scanner and FishHub spear-phishing malware. CISA calls for forensic triage on exposed instances, not just patching. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect/Prisma Access, five months after Palo Alto's May patch. Upgrade affected builds, disable unnecessary authentication overrides, and terminate all active GlobalProtect sessions after patching. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch A ransomware attack on Japanese cloud provider IDC Frontier hit 495 companies and local government services. Four cloud zones were damaged so badly customer data is likely unrecoverable. Validate offline backups and know which single providers your critical workloads depend on. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch The Gentlemen listed MoneyGram on its leak site claiming a breach of the payment network. No data samples posted, no company confirmation. Treat as a claim only until samples or a statement appear. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Seven-nation joint advisory attributes active exploitation to actors tied to Integrity Technology Group. Five CVEs: CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi). Hunt internet-exposed instances, patch or decommission. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Path traversal plus improper NULL byte handling that can allow an unauthenticated attacker in. Added to CISA KEV October 1, 2026. Patch immediately if you run FortiMail. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Hex encoding flaw allowing an unauthenticated remote attacker to access the system. Added to CISA KEV September 30, 2026. Patch and review access logs. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Out-of-bounds write in CoreGraphics that can lead to arbitrary code execution across Apple platforms. Added to CISA KEV September 29, 2026. Push Apple updates to managed and unmanaged devices. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/vuln-watch Code injection allowing an authorized attacker to execute code over the network. Added to CISA KEV September 25, 2026. Scope exposure: internet-facing SharePoint servers first. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney)