Blog
Node2Shell (CVE-2026-111497, CVSS 9.2): The Brotli RCE on CISA’s KEV — Is Your Stack Exposed?
CVE-2026-111497 (Node2Shell, CVSS 9.2) hit CISA’s KEV on 27 Oct 2026. This Brotli out-of-bounds RCE affects Node.js, Python, .NET, Envoy and Istio. Patch now.
Read More →GMO Internet’s ¥8-Billion Ransomware Crisis: 26,739 Trading Accounts Exposed — The Zero-Trust Wake-Up Call Indian Enterprises Cannot Ignore
Japan's GMO Internet faced a ¥8 billion ($50M) ransomware demand in October 2026, exposing MetaTrader credentials of 26,739 traders. Here's what Indian enterprises must do now.
Read More →CVE-2026-35273 (CVSS 9.8): Oracle PeopleSoft’s Three-Chained Zero-Day — ZDI Reveals Full RCE Chain After 100+ Org Breach Wave
ZDI reveals CVE-2026-35273 in Oracle PeopleSoft is three chained flaws (SSRF, auth bypass, XMLDecoder RCE). ShinyHunters exploited 100+ organisations before the June 2026 patch. Act now.
Read More →CVE-2026-48356 (CVSS 9.3): Magento ‘PolyShell’ Zero-Day Hits CISA KEV — 471 Stores Backdoored in One Hour
CISA added CVE-2026-48356 to KEV on October 27, 2026. The Magento ‘PolyShell’ flaw lets unauthenticated attackers upload PHP webshells via the guest cart API. Patch to APSB26-73 by November 10.
Read More →eMudhra CA Key Compromise: 8 Intermediate Certificates Cracked — What Indian IT Leaders Must Do Now
Eight eMudhra intermediate CA private keys were cracked due to a flaw in key generation — exposing TLS and code-signing trust for 17 months. Here is what Indian organisations must…
Read More →Storm-0940 & ARTEX: China’s AI Agents Breach 2,250+ Microsoft 365 Tenants via ConnectWise Supply Chain
China-aligned Storm-0940 used ARTEX agentic AI to breach 2,250+ Microsoft 365 tenants via compromised ConnectWise Cloud Backup credentials, achieving privileged access in under 3 hours.
Read More →BlackX UEFI Bootkit (CVE-2022-21894): APT41 Bypasses Secure Boot on Fully Patched Windows — Complete the Revocation Now
APT41-linked BlackX UEFI bootkit exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot on fully patched Windows. Your patch isn't enough — complete KB5025885 DBX revocation now.
Read More →CVE-2026-104286 (CVSS 9.8): FortiMail Zero-Day Exploited in the Wild — Patch to Fixed Build Now
Critical FortiMail zero-day CVE-2026-104286 (CVSS 9.8) allows unauthenticated arbitrary file writes. Actively exploited before patch — CISA KEV listed. Fixed builds 7.4.9, 7.6.7, 8.0.2 released October 21. Patch now.
Read More →CVE-2026-70242 (CVSS 9.8): Five Critical Outlook Reading Pane RCEs — Patch Before the Exploit Drops
Microsoft's October 2026 Patch Tuesday buried five critical Outlook RCEs — led by CVE-2026-70242 (CVSS 9.8) which fires from the Reading Pane with zero user interaction. Patch now.
Read More →LiteLLM 1.107.0 Supply Chain Breach: AI Credential Stealer Hit 2 Hours Before Removal — Is Your AI Stack Safe?
On 21 Oct 2026 LiteLLM v1.107.0 carried a credential stealer targeting cloud & AI API keys. Learn what was stolen and how to secure your Python AI stack now.
Read More →