Owen Pike

Articles by Owen Pike

• Android's October 2026 bulletin fixes 25 flaws, seven of them critical, in one patch level
  Patches & Advisories · 2026-10-19

  Google's October 2026 Android Security Bulletin fixes 25 vulnerabilities in Framework and System under the single patch level 2026-10-01. Seven are rated critical, including four l…

• Apple's Sept. 28 updates fix CoreGraphics zero-day CVE-2026-86950, possibly exploited against targeted iOS users
  Zero-Days & Exploits · 2026-10-19

  Apple's September 28 updates fix CVE-2026-86950, a CoreGraphics out-of-bounds write that Apple says may have been exploited against specific targeted people on iOS versions before …

• Exploited Cisco Catalyst SD-WAN Manager flaw CVE-2026-76504 gives unauthenticated admin API access
  Zero-Days & Exploits · 2026-10-19

  Cisco says attackers are exploiting CVE-2026-76504 (CVSS 9.8), a URI-encoding authentication bypass in Catalyst SD-WAN Manager that grants unauthenticated admin-level API access. T…

• Citrix NetScaler zero-day CVE-2026-88771 moves to mass exploitation after PoC; CVE-2026-88772 also exploited
  Zero-Days & Exploits · 2026-10-19

  Two NetScaler ADC and Gateway flaws rated CVSS v4 9.5 were exploited before disclosure; CVE-2026-88771 was then attacked widely after a public PoC. Responders found stolen config a…

• FortiMail zero-day CVE-2026-104286 allows unauthenticated file writes; CISA's 3-day deadline has passed
  Zero-Days & Exploits · 2026-10-19

  Fortinet says CVE-2026-104286 has been exploited in the wild. The flaw is a CVSS 9.8 path traversal bug in FortiMail that lets unauthenticated attackers write arbitrary files. CISA…

• Adobe patches CVSS 10 'BlockStrap' flaw in Adobe Commerce and Magento; Sansec expects exploits to follow
  Patches & Advisories · 2026-10-19

  Adobe's APSB26-153 fixes CVE-2026-103849, an unauthenticated CVSS 10.0 template-injection flaw in Adobe Commerce and Magento that Sansec calls BlockStrap; Adobe knows of no exploit…

• Cisco fixes five critical Nexus NX-OS flaws and a CVSS 10.0 bug in License On-Prem
  Patches & Advisories · 2026-10-19

  Cisco has fixed five critical NX-OS flaws in Nexus 3000 and 9000 switches that can be reached when NX-API, NGOAM or MPLS OAM is enabled, plus four License On-Prem bugs rated as hig…

• GitLab fixes CVSS 10 unauthenticated code execution flaw in CI/CD regex compiler
  Patches & Advisories · 2026-10-19

  GitLab's Oct. 12 patch release (19.4.2, 19.3.5, 19.2.8) fixes CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regex compiler that could let unauthenticated users run code…

• Plex2Shell: Attackers exploit chained Plex Media Server flaws the day after a public write-up
  Zero-Days & Exploits · 2026-10-19

  Attackers began exploiting Plex2Shell, a chain of four Plex Media Server flaws fixed in version 1.43.3, on Oct. 17, the day after the researcher published a write-up and proof-of-c…

• SonicWall SMA1000 SSRF flaw CVE-2026-102255 draws exploitation attempts days after hotfix
  Zero-Days & Exploits · 2026-10-19

  Honeypots began logging exploitation attempts consistent with CVE-2026-102255 two days after SonicWall patched the CVSS 10.0 pre-auth SSRF flaw in SMA1000 appliances, and no source…

• Attackers chain two AhsayCBS flaws for SYSTEM access; first patch failed, CISA deadline passed
  Zero-Days & Exploits · 2026-10-19

  Attackers are chaining an AhsayCBS authentication bypass with a command injection flaw to get SYSTEM-level access, plant webshells and mine crypto. Ahsay says its 10.3.4.0 fix was …

• Back-to-back Chrome 155 stable updates fix 47 flaws, eight of them critical
  Patches & Advisories · 2026-10-19

  Google shipped Chrome 155 desktop updates on Oct 13 and Oct 15, 2026, fixing 47 security bugs, eight of them critical, including an ANGLE buffer overflow and a Prerender use-after-…

• Citrix NetScaler SAML flaw CVE-2026-88779 exploited in targeted attacks; CISA deadline has passed
  Zero-Days & Exploits · 2026-10-19

  Citrix says attackers are targeting CVE-2026-88779, a memory-buffer flaw in SAML-configured NetScaler ADC and Gateway appliances, and CISA's October 7 federal patch deadline has no…

• Collabora's built-in CODE server for Nextcloud exploited for weeks before CVE-2026-110447 was published
  Zero-Days & Exploits · 2026-10-19

  An unauthenticated command injection in Collabora's built-in CODE Server app for Nextcloud was used to plant webshells from September. The fix shipped Sep 11, but CVE-2026-110447 (…

• NGINX patches heap overflow and use-after-free bugs F5 rates critical; Juniper fixes 150-plus Junos flaws
  Patches & Advisories · 2026-10-19

  F5 fixed 11 NGINX defects, including two configuration-dependent heap overflows and an AIO use-after-free it scores CVSS 4.0 9.2, while Juniper shipped 17 advisories covering more …

• Cisco Secure Email Gateway Flaw CVE-2026-76519 Exploited: Crafted Attachment Can Yield Root Access
  Zero-Days & Exploits · 2026-10-19

  Cisco says attackers are exploiting CVE-2026-76519 (CVSS 9.8), which lets an unauthenticated attacker gain root on a Secure Email Gateway with File Reputation enabled by sending a …

• Atlassian Data Center File-Read Flaw CVE-2026-21589 Exploited After Public PoC; CISA Adds It to KEV
  Zero-Days & Exploits · 2026-10-19

  Attacks began within hours of a public proof of concept for CVE-2026-21589, a CVSS 9.3 unauthenticated file-read flaw in eight self-hosted Atlassian Data Center products, and CISA …

• Ivanti Connect Secure zero-day CVE-2026-104935 chained for root access; third flaw still unpatched
  Zero-Days & Exploits · 2026-10-19

  Attackers exploited Ivanti Connect Secure auth bypass CVE-2026-104935 before disclosure, and Volexity says they chained it with a still-unpatched privilege escalation flaw to get r…

• Microsoft's record October Patch Tuesday fixes more than 1,400 flaws, including an exploited Mark-of-the-Web bypass
  Patches & Advisories · 2026-10-19

  Microsoft's October 13 Patch Tuesday fixed a record of more than 1,400 vulnerabilities. One of them, CVE-2026-96951, is a Windows Shell Mark-of-the-Web bypass that attackers were a…

• Palo Alto patches exploited PAN-OS management-interface flaw that grants root (CVE-2026-0322)
  Zero-Days & Exploits · 2026-10-19

  Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management-interface code-injection flaw that is being exploited in a very limited number of attacks. It gives authenticated …