George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.
VMware vCenter CVE-2026-59310: Ransomware Gangs Join Unauth Syslog RCE

VMware vCenter CVE-2026-59310: Ransomware Gangs Join Unauth Syslog RCE

CISA confirmed ransomware gangs are exploiting the critical vCenter Syslog RCE patched in July. Patch fixed trains and hunt the…
The 5-Minute Cyber Brief: September 15, 2026

The 5-Minute Cyber Brief: September 15, 2026

Cisco email gateway root RCE due Wednesday, Sogou one-click to GRAYRABBIT, Windows ALPC SYSTEM zero-day, and F5 PoisonedRefresh fileless webshell....
F5 BIG-IP APM PoisonedRefresh: Fileless PHP Web Shell After CVE-2025-53521 — Patch ≠ Clean

F5 BIG-IP APM PoisonedRefresh: Fileless PHP Web Shell After CVE-2025-53521 — Patch ≠ Clean

PoisonedRefresh injects a PHP webshell into BIG-IP APM memory after CVE-2025-53521. Patching alone does not remove the implant....
Windows ALPC Heap Overflow CVE-2026-85880: AppContainer to SYSTEM Zero-Day (Not the Update Stack Bug)

Windows ALPC Heap Overflow CVE-2026-85880: AppContainer to SYSTEM Zero-Day (Not the Update Stack Bug)

CVE-2026-85880 is an exploited Windows ALPC heap overflow to SYSTEM — separate from Update Stack CVE-2026-81963. KEV due September 22....
UNC3569 / Sogou Input Method CVE-2026-51990: One-Click RCE to GRAYRABBIT

UNC3569 / Sogou Input Method CVE-2026-51990: One-Click RCE to GRAYRABBIT

Gen Digital observed UNC3569 exploiting CVE-2026-51990 in Sogou Input Method to deploy GRAYRABBIT. Fix ≥ 16.3.0.3498....
Cisco Secure Email Gateway CVE-2026-76461: Unauth SQL Injection to Root — KEV Due Wednesday

Cisco Secure Email Gateway CVE-2026-76461: Unauth SQL Injection to Root — KEV Due Wednesday

CVE-2026-76461: unauthenticated SQL injection in Cisco AsyncOS email parsing escalates to root. CISA KEV due September 17, 2026. Fixed AsyncOS…
GitLab CVE-2026-85706: One Request, No Login, Your Secrets on Disk — Patch Deadline Is Today

GitLab CVE-2026-85706: One Request, No Login, Your Secrets on Disk — Patch Deadline Is Today

Self-hosted GitLab: one unauthenticated commits-API request can read secrets on disk. Federal due date is today....
ConnectWise ScreenConnect CVE-2026-84869: Guest Session, Host Compromise — KEV Due Today

ConnectWise ScreenConnect CVE-2026-84869: Guest Session, Host Compromise — KEV Due Today

A ScreenConnect client bug can transfer and run files on the host without confirmation. Due today....
The 5-Minute Cyber Brief: September 14, 2026

The 5-Minute Cyber Brief: September 14, 2026

Monday due dates: GitLab file-read, ScreenConnect client, Chrome’s seventh 2026 zero-day, WatchGuard ransomware flag....
Chrome CVE-2026-87491: Google’s Seventh Exploited Zero-Day of 2026 — Update to 153

Chrome CVE-2026-87491: Google’s Seventh Exploited Zero-Day of 2026 — Update to 153

Google patched a V8 bug already exploited in the wild. Chrome 153 is the floor....
WatchGuard Firebox CVE-2025-14733: CISA Flags Ransomware Use on a Stubborn Edge RCE

WatchGuard Firebox CVE-2025-14733: CISA Flags Ransomware Use on a Stubborn Edge RCE

CISA marked the WatchGuard Firebox RCE as known ransomware campaign use. Patch the edge....
The 5-Minute Cyber Brief: September 11, 2026

The 5-Minute Cyber Brief: September 11, 2026

Published: 09/11/26 Today’s pattern is management-plane root: when the systems that configure firewalls, terminate VPN, and run ERP kernels become…
SAP OVERPASS CVE-2026-44756: unauth OS command exec on NetWeaver/Web Dispatcher

SAP OVERPASS CVE-2026-44756: unauth OS command exec on NetWeaver/Web Dispatcher

What Changed SAP’s September 2026 Patch Day, with Onapsis Research Labs, shipped Security Note 3747649 for OVERPASS (CVE-2026-44756): a memory-corruption…