Blog
CVE-2026-96951 (CVSS 8.8): Windows Shell Zero-Day Bypasses SmartScreen — Patch Now Before Ransomware Actors Strike
CVE-2026-96951 is an actively exploited Windows Shell zero-day (CVSS 8.8) that bypasses Mark of the Web protections. Added to CISA KEV on October 13, 2026 — patch immediately to prevent…
Read More →8 CVSS 10.0 Flaws in HPE Aruba AOS: 72 Vulnerabilities Patched — Act Before Exploits Drop
HPE patches 72 ArubaOS vulnerabilities (HPESBNW05162), including 8 CVSS 10.0 RCE flaws. AOS-8 and AOS-10 Mobility Controllers, Gateways, and APs affected. Patch now or segment management interfaces.
Read More →CVE-2026-114625 (CVSS 9.9): Arista VeloCloud Orchestrator Zero-Day Exploited — Third SD-WAN Attack in 2026
CVE-2026-114625 is an actively exploited CVSS 9.9 SQL injection zero-day in Arista VeloCloud Orchestrator. Even read-only accounts can gain superuser access — the third VCO zero-day exploited in 2026.
Read More →CVE-2026-0257 (CVSS 7.8): Qilin, INC & Settra Ransomware Exploit PAN-OS GlobalProtect — Attackers Now Pivot to ESXi
Three ransomware gangs — Qilin, INC, and Settra — are actively exploiting CVE-2026-0257 in PAN-OS GlobalProtect. Unit 42 confirmed an ESXi pivot attack. Patch now.
Read More →CVE-2026-110264 (CVSS 10.0): GitLab’s Second Critical RCE in 10 Days Hits Every Version Since 2014 — Patch Now
CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE in every self-managed GitLab CE/EE since 2014. The October 12 patch for CVE-2026-97229 does not cover this. Patch now.
Read More →PHP2Shell (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2): Critical PHP RCE Hits 70% of the Web — Emergency Patches Out Now
PHP2Shell: Two CVSS 9.2 RCE flaws (CVE-2026-109618 & CVE-2026-109619) threaten every PHP-powered site. Emergency patches released Oct 21. Here's what Indian IT teams must do now.
Read More →SafePay Ransomware: FBI & CISA Warn of 600+ Victims and Backup Destruction — CVE-2024-40711 Exploited
Joint advisory AA26-293A (FBI, CISA, Oct 2026) warns of 600+ SafePay ransomware victims. CVE-2024-40711 in Veeam (CVSS 9.8) exploited for unauthenticated RCE and backup destruction.
Read More →CVE-2026-106173 (CVSS 9.8): Public PoC Drops for FortiSIEM Unauthenticated RCE — Patch or Block Port 27918 Now
A public Horizon3.ai PoC for CVE-2026-106173 (CVSS 9.8) enables unauthenticated RCE on FortiSIEM via gRPC port 27918. Patch to 7.5.1 or block the port immediately.
Read More →CVE-2026-110936 (CVSS 8.4): ClickFix Campaign Hijacks Siemens Software Center — Patch OT Endpoints Now
CVE-2026-110936 is a DLL sideloading flaw in Siemens Software Center now actively exploited in ClickFix campaigns. CVSS v4.0: 8.4. Patch to version 4.0.9.8 immediately to protect ICS and OT environments.
Read More →PwnEscape (CVE-2026-99999, CVSS 9.3): Critical Linux Kernel Zero-Day Lets Guest VMs Read Host Memory — Patch Now
A critical Linux kernel flaw (CVE-2026-99999, CVSS 9.3) nicknamed PwnEscape lets guest VMs read host kernel memory. Vercel confirmed exploitation. Patch host kernels immediately.
Read More →