CISA
Every ZeroDayFeed story on CISA — across breaches, zero-days, ransomware, patches, policy, and industry, newest first.
-
Patches & Advisories
Android's October 2026 bulletin fixes 25 flaws, seven of them critical, in one patch level
Google's October 2026 Android Security Bulletin fixes 25 vulnerabilities in Framework and System under the single patch level 2026-10-01. Seven are rated critical, including four local privilege escalation bugs in Android 16 and 17. Google does not flag any of them as exploited in the wild.
-
Patches & Advisories
GitLab fixes CVSS 10 unauthenticated code execution flaw in CI/CD regex compiler
GitLab's Oct. 12 patch release (19.4.2, 19.3.5, 19.2.8) fixes CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regex compiler that could let unauthenticated users run code on self-managed servers, plus 23 other flaws.
-
Patches & Advisories
Back-to-back Chrome 155 stable updates fix 47 flaws, eight of them critical
Google shipped Chrome 155 desktop updates on Oct 13 and Oct 15, 2026, fixing 47 security bugs, eight of them critical, including an ANGLE buffer overflow and a Prerender use-after-free. Google has not marked any of them as exploited in the wild.
-
Patches & Advisories
NGINX patches heap overflow and use-after-free bugs F5 rates critical; Juniper fixes 150-plus Junos flaws
F5 fixed 11 NGINX defects, including two configuration-dependent heap overflows and an AIO use-after-free it scores CVSS 4.0 9.2, while Juniper shipped 17 advisories covering more than 150 Junos flaws. Neither vendor reports exploitation.
-
Patches & Advisories
Microsoft's record October Patch Tuesday fixes more than 1,400 flaws, including an exploited Mark-of-the-Web bypass
Microsoft's October 13 Patch Tuesday fixed a record of more than 1,400 vulnerabilities. One of them, CVE-2026-96951, is a Windows Shell Mark-of-the-Web bypass that attackers were already exploiting, and CISA added it to the KEV catalog the same day.
