Topic
iOS 18.7.11 closes CVE-2026-86950, a CoreGraphics flaw used in targeted attacks, on the iPhone XS, XS Max, XR and iPad 7th generation. Newer devices were fixed in September.
A memory-corruption bug in Google's Brotli decoder is under active attack. Anything that decompresses Brotli data from outside needs the fixed library or runtime.
The Gentlemen added Vietnam Airlines to its leak site on 26 October with a countdown and no data sample. The airline hasn't commented.
Microsoft fixed a record 1,411 flaws in October, including an exploited Windows Shell zero-day. What to patch first and which Windows versions lost support.
Unit 42 says Qilin and Inc ransomware crews use CVE-2026-0257 in PAN-OS GlobalProtect to get in. Patched in May, still hitting unpatched firewalls.
Launched at Singapore International Cyber Week, the strategy adds a national cyber command centre and rules for autonomous AI agents.
CVE-2026-102764 lets attackers into self-hosted BeyondTrust Remote Support without a login. Mandiant ties it to ARMORY CASTLE. Patch and hunt now.
Two Ivanti Connect Secure flaws went in on 30 October; GitLab, Cisco ASA, VMware ESX and the Linux kernel came in the two days before.
Browsers have distrusted the eight CAs. Servers, Go, Node.js and Linux need updated certificate stores, and macOS command-line tools still trust them.
IBM's 2026 Cost of a Data Breach study puts the ASEAN average at US$4.12 million. Costliest sectors, AI-driven attacks and the encryption gap.
Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 CVEs, including CVE-2026-111497 in the Brotli decoder, and remove three emSign roots from the bundled certificate store.
PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets one unauthenticated request run code on PHP servers. Fixed versions, who is exposed and what to do now.
