4 min read
Did a Workflow You Trusted Just Exfiltrate Your Secrets?
Attackers compromised maintainer accounts on 340+ repositories and inserted malicious GitHub Actions workflows that steal secrets during CI runs. If your pipeline…
Cybersecurity
4 min read
Domain Validation Is Dead. Certificate Transparency Won.
Attackers took over three country-code domain registries and issued valid HTTPS certificates for Google domains. Every validation method the CAs checked passed—because…
8 min read
The GET Request That Reads Your Database Password: Atlassian CVE-2026-21589
An unauthenticated attacker who can reach your Confluence login page can read the file that stores your database password—no credentials, no phishing,…
4 min read
CVE-2026-66804: Fifteen Researchers Found What Microsoft’s Dark Elevator Patch Missed
Microsoft patched the Dark Elevator privilege escalation, but the fix addressed only one lookup path—not the underlying COM trust model. Now CVE-2026-66804…
6 min read
Three Things That Broke When GitLab Handed Its AI Gateway a 9.9
A critical flaw in GitLab's AI Gateway gives any authenticated Duo user command execution on self-hosted instances. If you run GitLab with…
7 min read
The Appliance Guarding Your Inbox Got Owned: FortiMail Zero-Day CVE-2026-104286 Actively Exploited
Fortinet confirmed October 1 that CVE-2026-104286, a critical RCE vulnerability in FortiMail, is being actively exploited in zero-day attacks. The device you…
7 min read
Three checks before you trust your Zimbra server: CVE-2026-73570 actively exploited
Microsoft confirmed web shells on internet-facing mail servers, deployed through an unauthenticated command injection that requires nothing but network reach. If your…
4 min read
Three Things Broke When I Patched 400 Apple Devices for CVE-2026-86950
Apple's emergency patch for CVE-2026-86950 went out to 400 devices in our fleet. The inventory lied, unmanaged devices hid, and compliance rules…
6 min read
The Maintenance Window Is Dead. The 24-Hour Clock Won.
CISA gave federal agencies until today to patch CVE-2026-65660, a SharePoint vulnerability under active exploitation. If you run on-premises or hybrid SharePoint,…
5 min read
Your PeopleSoft WAF Rule Is a String Match. ShinyHunters Brought a Percent Sign.
Organizations deployed WAF rules to block CVE-2026-35273 exploitation and marked the tickets closed. ShinyHunters just proved those virtual patches fail when attackers…