Latest updates on cloud, security, Microsoft and the tools that keep your infrastructure running.
Stay informed with the latest IT news, security updates and product changes.
GitLab patched a CVSS 10.0 path traversal bug in the repository commits API on September 10. Within a day, watchTowr saw probes and CISA added CVE-2026-85706 to the KEV catalog.
ServiceNow fixed four vulnerabilities in its AI Platform and Now Platform, three of them rated CVSS v4.0 10.0 and exploitable without credentials. The fourth, a sandbox escape first published as high severity, has since been upgraded to critical.
HPE Networking has fixed CVE-2026-73749, a CVSS 9.8 buffer overflow in an ArubaOS-CX daemon that lets an unauthenticated attacker run code with elevated privileges on enterprise switches. It headlines an advisory covering 34 CVEs.
SonicWall says attackers are chaining CVE-2026-83548 and CVE-2026-83549 to run code on SMA1000 remote access appliances. A hotfix is out, there's no workaround, and no IoCs have been published yet.
WordPress shipped forced updates 6.9.5 and 7.0.2 on July 17, 2026, closing a pre-auth remote code execution flaw named wp2shell that an anonymous HTTP request can trigger against a default core install with no plugins. The bug affects 6.9.0-6.9.4 and 7.0.0-7.0.1.
Researchers H0j3n and Aniq Fakhrul have released a working exploit for Certighost, an Active Directory Certificate Services flaw patched in July 2026 that let any low-privileged domain user impersonate a domain controller and reach full domain compromise.
BeyondTrust has patched a critical auth bypass vulnerability set in Remote Support (RS) and Privileged Remote Access (PRA). Two of the four flaws are critical pre-authentication bypasses (CVE-2026-40138 and CVE-2026-40139, CVSS 9.2). Under a specific authentication configuration, they let unauthenticated attackers reach affected appliances.
CISA has added an actively exploited Langflow authorization bypass flaw (CVE-2026-55255) to its Known Exploited Vulnerabilities Catalog, ordering U.S. federal civilian agencies to patch it by Friday under BOD 26-04. The IDOR bug lets authenticated attackers access other users' AI flows and the sensitive data they process.
A newly disclosed vulnerability, tracked as CVE-2026-54886, can trigger a denial-of-service condition in an affected SSH/SFTP server implementation through an infinite loop in the handling of extended channel data. Administrators should watch for vendor advisories and patch details as they become available.
Canada's Cyber Centre warns that attackers are exploiting CVE-2026-48282, a maximum-severity Adobe ColdFusion vulnerability that allows unauthenticated remote code execution. Adobe patched the flaw days earlier and urged admins to update within 72 hours.
CISA added Microsoft SharePoint Server flaw CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog, citing active exploitation and setting a July 4, 2026 remediation deadline for U.S. federal agencies.
Linux KVM Januscape (CVE-2026-53359) is a use-after-free in KVM's shadow MMU. A guest VM can trigger it to crash or take over its x86 host on both Intel and AMD. This 16-year-old flaw was fixed in mainline on June 19, 2026.
Microsoft's June 2026 security update KB5094125 patches five vulnerabilities in Windows Server 2025, including a critical unauthenticated Remote Desktop Services RCE (CVE-2026-0235) and a Hyper-V guest-to-host escape (CVE-2026-0237). The update raises the OS build to 26100.32995 and applies to all editions across full GUI and Server Core installations.
Microsoft released KB5094122, the June 2026 cumulative security update for Windows 10 Version 1607 and Windows Server 2016, addressing critical remote code execution and privilege escalation vulnerabilities. The update moves the build to 14393.9234 and fixes flaws in the Windows Kernel, CLFS Driver, Graphics Component and Print Spooler.
Microsoft's June 2026 security update KB5094128 patches multiple critical vulnerabilities in Windows Server 2022, including an unauthenticated NFS remote code execution flaw (CVE-2026-26001, CVSS 9.8), a Task Scheduler privilege escalation bug, an AD CS authentication bypass, and a Windows kernel memory corruption issue. The update raises the OS build to 20348.5256 and requires a restart.
Microsoft's KB5087051 cumulative update for .NET Framework 3.5 and 4.8.1 on Windows 11 Version 25H2 addresses four CVE-tracked vulnerabilities, including remote code execution, an ASP.NET Core authentication bypass, and a serialization denial-of-service flaw, alongside WCF stability and Entity Framework performance fixes.
Microsoft released KB5087545 for Windows Server 2022 on May 12, 2026, patching five critical vulnerabilities including an unauthenticated RDP remote code execution flaw (CVE-2026-0145, CVSS 9.8) and a Hyper-V guest-to-host escape. The cumulative update raises the OS build to 20348.5139 and carries several known post-install issues.
Microsoft released KB5082142 on April 14, 2026, a critical security update for Windows Server 2022 that patches remote code execution, privilege escalation, information disclosure, and denial-of-service vulnerabilities. The cumulative update raises the OS build to 20348.5020 and requires a restart.
